Real ID: States chase moving target

Real ID, a federal law intended to give states a minimum standard for issuing driver’s licences and identity cards, was supposed to be technology’s answer to the political hot potato known as the national identity card.

But technology, like politics, contains its own conflicts and cross purposes. Ongoing uncertainties surrounding the four-year-old Real ID Act are making it hard for many states to reach the law’s goal of launching new technologies by the end of 2009 to secure driver's licenses against fraud and terrorist activities.

In North Dakota, for instance, the state's Department of Transportation has twice lobbied the legislature for funding to replace a 35-year-old mainframe-based system with a modern license-issuing application, which some estimates peg at $12 million.

“When DOT requested the funds two years ago, the legislators held it up because they said we don’t know what the final Real ID guidelines would be,” said Lisa Feldner, North Dakota's chief information officer. Her department manages the existing system.

The modernization effort didn't fare any better in this year’s session, for much the same reason. “They said, 'The mainframe isn’t going to die, so we're not going to fund the new system at this time. But we promise that next session we will fund it, when you have guidelines,'” she said.

The North Dakota legislature meets only once every two years, which means the state will be at least two years behind the law’s target implementation date. And there's no guarantee that lawmakers there — or anywhere else, for that matter — will be comfortable writing checks for Real ID anytime soon, especially in light of a U.S. Senate proposal last month that would scale back the controversial program — and change requirements yet again.

“Just trying to keep the ball rolling on commitments to education, health and transportation is a challenge far exceeding the attention that Real ID is going to get” during the economic downturn, said Michael Bird, senior federal affairs counsel at the National Conference of State Legislatures (NCSL), a research organization for state policy-makers.

Now with states facing historic budget shortfalls, officials believe they cannot risk implementation mistakes caused by shifting guidelines, even with Real ID deadlines set for the end of this year.

Officials know they are in a bind. States must apply for an extension of the year-end Real ID deadline by Oct. 11 and make progress on 18 milestones that the Homeland Security Department has set — or their residents might have trouble conducting official business with federal agencies or traveling beyond U.S. borders.

The cost of compliance

Creating more secure identity documents has been a federal objective since the 2001 terrorist attacks. Given the objections posed by both conservatives and liberals against a national identity card, Real ID was intended to be the next best thing. However, its success depends on the cooperation of the states, each of which maintains its own driver’s license program.

The lack of strong direction — and federal funding — for Real ID has left the program in perpetual limbo.

Early estimates put the Real ID price tag for U.S. states and territories at more than $11 billion over five years, which prompted DHS to extend the deadline for full enrollment to 2017. But the investments for states remain significant, if still unknown.

“Until we know what the actual requirements will be and have some certainty as to an implementation date, an accurate cost assessment is not possible,” said Patrick Fernan, operations manager at the Wisconsin Division of Motor Vehicles.

The uncertainty grew when the Obama administration chose Janet Napolitano to be homeland security secretary. As governor of Arizona, she was an outspoken critic of the act, calling it an unfunded mandate by the federal government. Arizona is among 20 states that have adopted legislation barring compliance with the act, according to NCSL.

As DHS secretary, Napolitano has voiced her support for the Real ID replacement program introduced last month in the Senate. The Providing for Additional Security in States' Identification (PASS ID) Act would be “a cost-effective, common-sense solution that balances critical security requirements with the input and practical needs of state governments,” she said.

State officials contacted for this story declined to comment on the new legislation, saying they haven’t had sufficient time to study it. But they might soon find themselves forced to devise strategies flexible enough to accommodate two possible approaches with fundamental philosophical differences, said Chris Dixon, manager of state and local industry analysis at market research firm Input.

What officials are wondering now is whether the new requirements will call for an identity verification or an identity validation process, Dixon said.

Verification requires states to determine the legitimacy of license applicants’ identity documents. Validation means states merely request documents to confirm identities but don't investigate their authenticity.

Real ID calls for a verification approach in which states would create and share databases and use an electronic system to verify certain official records and whether applicants are already licensed by other states. However, many of those electronic systems still do not exist. In addition, some federal databases require states to pay a fee for each transaction, Bird said.

“Real ID was moving down the verification path, and the early scuttlebutt is that PASS ID will move more down the document validation path,” Dixon said.

Moving forward

Lingering questions about the federal program have left some states walking a fine line between compliance and avoiding investments that could prove wasteful if security mandates continue to change.

“There are things in Real ID that states have been trying to do for years to improve the process and make it more secure,” said David Beary, senior systems analyst at the Iowa Department of Transportation. “Those are the things that we’ve been trying to work toward without waiting on Real ID. It’s a matter of [designing] your system so that, with minor adjustments, you could make it fit into everything that gets legislated.”

Some states have chosen to embrace the spirit but not the letter of the Real ID Act. For example, Iowa, Vermont and others have hardened security by centralizing the issuing of licenses. Local DMV offices in those states collect paperwork, take photos and conduct driving tests, but they don’t issue driver's licenses.

“The process is exactly the same except you don't walk out with the hard plastic,” said Barbara West, field manager at the Iowa Office of Driver’s Services. “You walk out with a temporary driver’s license, and your actual license is mailed to you.” She expects Iowa to meet this year’s Real ID milestones and request an extension beyond the end of the year for achieving full compliance.

Centralization increases security by protecting license materials from theft and forgery at multiple local offices.

“Consistent processing and security help keep card stock from going out the back door to a counterfeiting operation,” Dixon said.

Digital photography — now a standard feature at many licensing facilities — allows states to more easily manage and analyze images for possible fraud. Some states, including Wisconsin and Iowa, have added facial-recognition software to compare newly captured digital head shots against databases of existing photos to flag applicants who use false names.

States are also shooting digital photos at the start of the licensing process as an added tool for stopping fraud, said Michael Charter, a DMV project specialist for Vermont, which is also trying to qualify for a Real ID extension.

If the applicant is denied a license or quits before completing the process, law enforcement officials have a photo to scan for follow-up facial-recognition screening, he said.

“In states where the picture is taken later in the process, you may have a situation where the applicant becomes nervous about being caught and decides to flee,” Charter said. “In that case, you have the application with presumably fictitious information and no photo to help apprehend the applicant.”

Other measures

Some states are moving to toughen the security of driver's licenses by meeting the Western Hemisphere Travel Initiative's standards for enhanced driver's licenses (EDLs). The initiative is a result of the Intelligence Reform and Terrorism Prevention Act of 2004, which requires travelers to present a passport or other document, such as an EDL, that denotes identity and citizenship when entering the United States.

EDLs require background checks of applicants and certain DMV employees and the addition of tamper-resistant capabilities. They also use embedded radio frequency identification chips to help border authorities quickly verify cardholders’ identities as they cross international boundaries.

RFID goes beyond the latest Real ID mandates, and some privacy advocates have objected to the sensors because unauthorized people could potentially scan private information from cards. But EDL issuers said RFID’s threats to privacy are minimal.

“The RFID technology does not contain any personal information — only a unique number that allows border officials to retrieve information off their system,” said Kelly Chesney, communications director at the Michigan Department of State. Michigan is one of a handful of states that offer EDLs.

Vermont, which began offering EDLs this spring, had to upgrade its licensing application with new hardware and software that came primarily from the company that supplied its existing licensing application.

“Vermont is in the final stages of an overall upgrade to all internal systems,” Charter said. “Had that not already been in progress, it is likely we would have required far more upgrades in order to issue the EDL.”

Because EDLs are produced off-site and mailed to customers, Vermont had to install a new secure network connection to the card-producing facility and one to DHS for the identity checks required for EDLs.

Charter said the state will eventually link to the new federal Electronic Verification of Vital Events system to verify birth certificates with issuing agencies nationwide. And Vermont's EDLs will evolve into Real ID compliance, he added.

But some states are hitting roadblocks with the new licenses. Canada’s Manitoba province has pressured North Dakota officials to implement EDLs to save citizens on both sides of the border the expense of obtaining passports. And even though EDL guidelines are clearer than those for Real ID and might dovetail with the final rulings, funding problems have stalled the effort.

“That ended up in the same place as the replacement driver’s license system,” Feldner said.

States are also balking at investing significant sums of money to connect with central databases for interstate verification of identity documents or performing background checks against federal anti-terrorism watch lists, as mandated by Real ID, Dixon said.

“On the technology side, there’s always that worry that five years down the road, when the [federal government] finally does decide to roll out the databases, the processes you implemented aren’t going to work,” he said. “So they are basically doing the veneer of compliance now and waiting for the [federal government] to build the infrastructure behind it. And that’s a scary position for the states to be in.”

NEXT STORY: Real ID compliance score card

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.