States move warily on Real ID

Officials still crave funding and firm guidance on nationwide standards for driver’s licenses

Having aired their concerns about cost and policy implications, many state officials now seem resigned to the Real ID Act, which requires states to issue driver’s licenses that conform to new federal standards. Many states are preparing for the new requirements and hiring systems integrators rather than waiting for the Homeland Security Department to release final technical standards.

Nevada’s Department of Motor Vehicles, for example, is investigating facial recognition and various methods for sharing driver’s license information with other states and the federal government, even though it can only go so far without more detailed guidance from DHS, said Tom Jacobs, public information officer at Nevada’s DMV.

“At this point, we have no vision of a complete solution because we still don’t know what Real ID completely is,” Jacobs said.

He added that paying for a program that hasn’t been fully defined is not popular with state leaders. The national price tag for the Real ID program — estimated to be $11 billion — worries state officials, who are expecting DHS to pick up only about 20 percent of the cost in the form of state grants.

“We see cost and technology issues tied for first place,” Jacobs said. “We’re struggling with the lack of money, the lack of time and the lack of flexibility that characterize the Real ID Act as we know it today.”

DHS wants states to act
DHS officials say they are sympathetic to states’ concerns. “The implementation could be burdensome for some states,” said Darrell Williams, DHS’ director of Real ID programs.

In March, DHS extended the original deadline for states to start fielding Real ID programs from 2008 to Dec. 31, 2009. In the meantime, Williams said DHS is doing everything it can to help states comply with the new law, including reviewing a variety of mature technologies that could assist states in complying with the act.

“Although we have yet to determine what the solution might look like, we continue to move forward with that process,” Williams said.

DHS expects to issue final standards directives soon, and those directives must provide solid answers for states, said Erin Kenneally, a member of the National Association of State Chief Information Officers’ Real ID Working Group.

The program’s success will depend on having standard data models to support interoperability among diverse systems in the states, Kenneally said. States could verify data via a federated architecture of independently operated databases without creating a federally managed national database of driver information, she added.

Techniques for collecting and sharing data dominate most Real ID policy discussions, said Peter Laberee, chairman of the Homeland and Premises Security Group at the law firm Fox Rothschild. He said many people are concerned about Real ID’s implications for data privacy and states’ independence.

And the privacy debates aren’t likely to end even if the states develop a federated model for exchanging data, Kenneally said. People have concerns about the new driver’s licenses being used for purposes other than registering and validating drivers’ identities.

“Because of the advantages Real ID cards might have over current driver’s licenses and ID cards, it is likely that Real ID will be used beyond its original purpose,” Kenneally said.

“There is no real reason to believe history won’t repeat itself,” she said. “Witness how the Social Security number has become the de facto national identifier when its original purpose was to track retirement benefits.”

Stick to the basics
Even as Real ID looms, most states are focused on upgrading their DMV systems and are only beginning to think about interoperability with other states, said Gregg Kreizman, research director for security issues at Gartner. “Even if Real ID did not exist, states have a natural requirement to maintain and upgrade systems.”

Many state officials are beginning to fret about the condition of those systems. “The databases running DMV systems are 20 to 30 years old and will not be able to support the Real ID requirements,” said Harold Kocken, manager of BearingPoint’s National Motor Vehicle Group.

Faced with such basic problems, many states are scurrying for immediate fixes. “We see states now looking at easy wins and going for solutions such as document scanning and authentication equipment,” Kocken said.

The hunt for industry partners will accelerate rapidly as more states begin adding the infrastructure and system components they will need for Real ID. They will be looking for help with system replacement or upgrades, managed services, project management, and feasibility studies, he said.

“There was much buzz around whether the card would include biometric or smart-chip technology, but that won’t happen unless DHS changes the rules after reviewing comments,” Kreizman said.

DHS has imposed only minimal requirements for the cards’ physical attributes. Real ID cards must have digital photos and present data in a machine-readable format using an industry-standard, unencrypted 2-D bar code. That type of bar code is easy and inexpensive to use but not data-rich or secure, Laberee said. 

Some states might opt to go beyond the requirements and add encryption, biometrics or radio frequency identification technology. Many experts say DHS has missed an opportunity to push for adoption of those technologies.

“One of the frustrating things about Real ID is that it is not currently requiring improvements to the physical security of the card, even though this would be easy to do and would provide real benefit,” said Paul Kocher, president and chief scientist at Cryptography Research, a data security company.

Ultimately, however, it isn’t the Real ID card standard or even the privacy issues that most concern state officials. It’s the funding, said Janice Kephart, president of consulting firm 9/11 Security Solutions.

“While the cost for a Real ID driver’s license in the next 10 years will be about $20 per person, over the short haul there will be significant expenditures,” she said. “The states can’t and shouldn’t have to do all that heavy financial lifting themselves.”

McAdams is a freelance writer based in Vienna, Va.
Real ID FAQsThe Homeland Security Department offers some answers on its Web site to the most frequently asked questions about the Real ID Act.

Q: What is Real ID?

A: It’s a nationwide program created to thwart terrorism, reduce fraud, and improve the reliability and accuracy of identification documents that state governments issue.

Q: How do the proposed regulations protect the privacy of license holders?

A: The notice of proposed rulemaking contains a detailed analysis of the connectivity of the databases involved, the protection of personal information stored in state databases, and the protection of personal information stored on machine-readable cards. DHS invites comment on whether the steps outlined are appropriate and adequate for protecting the privacy of license holders.

Q: Do the proposed regulations require states to collect fingerprints or iris images from drivers?

A: No. Although states may independently choose to implement biometrics in their driver’s licensing process, the proposed rulemaking does not require a state to collect fingerprints, iris images or other biometric data in connection with obtaining a license and has no plans to serve as a repository for the face images some states collect
.
Q: What is the machine-readable technology specified in the proposed regulations?

A: The regulations propose the use of 2-D bar code technology, which 46 state jurisdictions use. DHS leans toward encrypting the data on the bar code as a privacy protection and requests comments on that point.

Q: Will Real ID driver’s licenses include radio frequency identification chips?

A: The proposed regulations do not specify the use of RFID chips as a minimum standard. States may independently choose to implement an RFID solution in addition to the standard 2-D bar code.

Source: Homeland Security Department

States’ to-do listThe Real ID Act requires states to issue tamper-proof driver’s licenses and develop mechanisms for initiating and responding to requests for identity and license verification.

States must:
  • Decide whether to create a clearinghouse of information similar to the one maintained by the American Association of Motor Vehicle Administrators for commercial driver’s licenses.
  • Establish mechanisms for accessing data repositories such as the Social Security Online Verification system and the National Association for Public Health Statistics and Information Systems’ Electronic Verification of Vital Events.
  • Complete internal Department of Motor Vehicle system upgrades and make plans for sharing information with other DMVs.
Source: Gartner

2014 Rising Star Awards

Help us find the next generation of leaders in federal IT.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above