Real ID opposition sparks revisions to national driver's license standard

Widespread opposition to a 2005 bill designed to create a national standard for driver's licenses has prompted a revised version of the bill that no longer contains its most controversial provisions.

The proposed revision is called the "Providing for Additional Security in States' Identification" Act of 2009, or Pass ID Act, and was introduced in the U.S. Senate late on Monday by Senators Daniel Akaka (D-Hawaii), George Voinovich (R-Ohio), Patrick Leahy (D-VT), Jon Tester (D-MT), Max Baucus (D-MT) and Thomas Carper (D-DE).

The bill is a revised version of the Real ID Act of 2005, which was signed into law by then President Bush but the implementation of which has almost stopped amid cost concerns and fears that it could end up becoming a de facto national ID card.

Like Real ID, the proposed Pass ID is designed to give states a set of minimum standards they are required to follow when issuing driver's licenses. These include the need for issuing agencies to ensure that all individuals applying for a license have credentials that establish their identity, age, principle residence, their U.S. citizenship or their proper legal status in the country.

Pass ID requires states to establish processes for vetting the credentials presented by individuals applying for licenses, and to periodically check the legal status of individuals who have been issued licenses but are not U.S. citizens.

The proposed bill, like Real ID, requires state driver's license agencies to store digital photos of individuals to whom driver's licenses have been issued, as well as digital copies or paper copies of all supporting documents. As with Real ID, a license that is compliant with Pass ID will be machine-readable and will eventually be required for individuals to board commercial aircraft, or federal facilities such as those associated with defense or national security.

Controversial aspects cut

Pass ID also seeks to repeal some of the most controversial aspects of the Real ID bill. For instance, the proposed bill would strictly limit the official purposes for which a Pass ID credential would be required, compared with Real ID, for which no such restrictions existed. It also eliminates the requirement that all state driver's license databases be linked to each other, and that each state allow their databases to be electronically accessible by other states.

Under Pass ID states will no longer be required to authenticate birth certificates, Social Security numbers or other credentials with the issuing authority and instead are only required to "validate" them. States will also not be charged for tapping the U.S. Department of Homeland Security's (DHS) databases to verify the immigration status of an individual as they would have been under Real ID.

In addition, Pass ID seeks to limit the kind of information that a license-issuing agency should include in the machine readable portion of the license, and the purposes for which that data can be used. States will be prohibited from including Social Security numbers in the machine readable zone of a license, whereas previously there were no such limitations. Importantly, the proposed bill also requires new privacy and security safeguards for personally identifiable data.

The changes come amid a virtual rebellion by states over the implementation of Real ID, which was signed into law in conformance with the recommendations of the 9/11 commission on terrorism. So far, more than two dozen states have passed measures either rejecting or opposing the Real ID mandate including Arizona, Arkansas, Idaho, Maine, Montana, New Hampshire, South Carolina and Washington.

Last month, Oregon lawmakers joined the rebellion, approving a bill that would prohibit agencies from spending state money to implement the requirements of the Real ID Act unless the federal government reimbursed them. The bill would also prevent the state's Department of Transportation from implementing requirements of the Real ID Act unless it can demonstrate specific security controls for protecting license data.

Such protests have stemmed from what many states say is the unreasonable cost burdens of Real ID with its increased documentation, identity verification, data storage and database linking requirements.

Privacy, data security conerns

Privacy and civil rights advocates have blasted Real ID and said that it would result in the creation of a de facto national ID card that could be used to track and snoop on individuals. They have warned that the proposal to link state driver's licenses databases together would greatly increase the potential for data compromise and data theft.

As a result of such concerns, the DHS, which is the agency in charge of implementing Real ID has been pushing back compliance deadlines. After stating earlier that individuals with standard state-issued licenses would not be able to board commercial aircraft starting May 2008, the DHS now says state licenses will be acceptable as identification by federal agencies until December 2014. Individuals age 50 or older will not have to show Real ID cards until December 2017.

Today's proposed bill has received a decidedly mixed response so far. The Center for Democracy and Technology, (CDT), which in the past has expressed concern over the privacy and civil rights implications of Real ID, today welcomed the proposed legislation.

"We think it addresses the main privacy issues we had with Real ID," said Ari Schwartz, executive director of the Washington-based think tank. The removal of the database linking provision, the proposal to limit the official purposes for which the card would be needed and the changes relating to the machine readable data are all good steps, Schwartz said.

The changes effectively counter the likelihood of the card being used for tracking people, while also meeting the 9/11 commission's recommendations, he said. The decision to revise Real ID rather than repeal it altogether as some have called for is a good step, Schwartz said. "We think this was a pragmatic approach," he said.

But Janice Kephart, director of national security policy at the Center for Immigration Studies, blasted Pass ID, saying it would do nothing to improve security. "It is in fact a dumbing down of ID verification [practices]," Kephart said. "I would call in a Pass on anything ID Act."

"It would not conform at all to the 9/11 commission standard and would help terrorists get on airplanes," she said. The proposed legislation will only introduce confusion, give states money without accountability, roll back airport security and eliminate information sharing between states, she said.

The American Civil Liberties Union (ACLU), which has been an ardent critic of Real ID, today expressed dissatisfaction with the proposed bill. It said in a statement that while Pass ID included some welcome privacy protections, the legislation "could ultimately resurrect the discredited Real ID Act and become the basis for a National ID."

The statement pointed to the widespread opposition to Real ID in many states and said the law should have been repealed rather than "fixed."

Security budgets are falling, survey says

A Deloitte survey of more than 200 information security officers in the high-tech, media and telecom sectors shows that 32% face reduced information-security budgets.

The Deloitte 2009 Global Security Survey for the technology, media & telecom industry also said that the information security managers are less inclined to invest in new security technologies as early adopters than they were in 2007, the last time the survey was undertaken.

Previously, 67% of respondents "considered themselves early adopters of security technology," the report states, while that number has dropped to 53%. The Deloitte survey concludes information security managers in high-tech, media and telecom face increased pressures of "reduced security investment and increased focus on keeping the day-to-day business up and running."

"Thirty-two percent of them said they had reduced security budgets, though there were no details," says Irfan Saif, principal in Deloitte's enterprise risk services, about the 2009 Global Security Survey.

While 25% of the survey's respondents did say they were seeing their security budgets raised, the increase was less than 5%.

"Sixy percent said they feel they're falling behind or still just catching up," Saif says, adding that social-networking technologies and regulatory concerns rank among the main worries of information security managers polled in the survey.

The survey also showed that only 28% felt confident they were protected by internal attacks caused by insiders.

Moreover, the position of "privacy officer" (sometimes "chief privacy officer", whose job is to ensure an organization's data-management processes conform to established law and preferred corporate practices) also appears to be in some decline among the companies questioned about it.

The previous Deloitte survey of the high-tech, media and telecom industry showed that half of the companies responding did have "an executive responsible for privacy," but this year's survey showed a decrease of 6% from that.