eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
After months of waiting for the Real ID Act regulations to be spelled out, the U.S. Department of Homeland Security announced Jan. 11 the final rule establishing minimum security standards for state-issued driver’s license and identification cards.
The bottom line for security and privacy advocates: RFID technology will not be required as the mandated machine-readable technology. But the DHS is sticking with the proposed two-dimensional bar code. The states, which have been impatiently waiting to learn the requirements, won’t be directed to collect any biometric identifiers like fingerprints or iris images.
With these requirements, the burden and cost of implementation will not be quite as onerous as had been predicted. The DHS said in a statement that actual implementation costs have been cut by about 73 percent, mainly by giving states more time to issue the new Real ID-compliant license to older Americans.
For citizens, the picture is not so rosy if their states choose not to comply with Real ID-and at least 38 states have banned together to legislatively impede the Act. As of May 11, citizens of states that do not minimally comply with the requirements of Real ID may not use their driver’s licenses or state IDs to pass through security at airports.
“Citizens in this category will likely encounter significant travel delays,” the Real ID Act ruling said.
Click here to read more about why security advocates are fighting a plan to use “vicinity RFID” in U.S. passports.
During the 60-day open comment period for Real ID that ended May 8, 2007, the DHS received over 21,000 comments. In its final rules documentation, the DHS said it had received “several” comments expressing support for the proposed rule.
“One commenter wrote that Real ID correctly specified a set of performance standards rather than listing static prescriptive standards, and that enhanced document security is essential to combat terrorists, can help improve transportation safety, and can combat identity theft or other criminal acts,” the documentation said. “DHS agrees with these commenters and believes that States that fully implement these rules will improve national security by improving the security and reliability of a key document carried by many Americans.”
However, according to the rules documentation, “many” people opposed the Real ID program. “Many commenters wrote that the rule fails to provide appropriate security, utility or privacy, according to the rule,” the DHS wrote, and added in response that while it “appreciates the many comments received…DHS respectfully disagrees. … DHS strongly disagrees with the proposition that the rules will lead to an increase in identity theft, harm privacy or enable the government to track individuals in their daily lives.
“To the contrary, the rules create an environment where it is far less likely that an individual can fraudulently obtain a State-issued identity document using another person’s identity and identity documents and minimizes the possibility that one individual can obtain identification documents in multiple names and identities.
“The privacy interests of driver’s license and identification card applicants are strengthened, rather than weakened, since this rule requires all States to protect the personally identifiable information that DMVs collect from applicants.”
The finalized Real ID ruling requires that compliant licenses and ID cards include much of the same information that is on a standard driver’s license: a person’s full legal name, date of birth and gender, the driver’s license number, a digital photograph, and address and signature.
But is also requires “physical security features designed to prevent tampering, counterfeiting, or duplication of the drivers’ licenses and identification cards for fraudulent purposes; and a common machine-readable technology, with defined minimum elements.”
Other technology mandates such as the database specifications to maintain the documentation required by citizens to obtain a Real ID are not yet clear, nor are the rules about how states will share data with one another and with the Federal government, as required by the Act.
The first deadline for compliance with Real ID is Dec. 31, 2009. By then, states must upgrade the security of their license systems “to include a check for lawful status of all applicants to ensure that illegal aliens cannot obtain Real ID licenses. Some states are expected to be compliant well before that time. Compliance will be needed for access into a federal facility, boarding commercial aircraft and entering nuclear power plants.”
One big complaint from states has been the estimated costs to implement the mandatory systems and procedures needed to comply with Real ID-a cost, it was feared, that would not be supplemented or reimbursed by the federal government. But the DHS said in its Jan. 11 ruling that it is making approximately $360 million available to assist states with Real ID implementation-$80 million in dedicated Real ID grants and another $280 million in general funding as part of the Homeland Security Grant Program.
Whether $360 million split among the states will be more than a drop in the bucket remains to be seen.
“The American public’s desire for greater identity protection is undeniable,” Homeland Security Secretary Michael Chertoff said in a statement. “Americans understand today that the 9/11 hijackers obtained 30 drivers licenses and IDs, and used 364 aliases. For an extra $8 per license, Real ID will give law enforcement and security officials a powerful advantage against falsified documents, and it will bring some peace of mind to citizens wanting to protect their identity from theft by a criminal or illegal alien.”