Congress Must Act Soon to Address the Privacy Disaster That is REAL ID
Last month, after almost three years, the Department of Homeland Security released its much-anticipated final regulations to implement the controversial REAL ID Act of 2005.
In light of DHS' final rules, CDT released an analysis of the REAL ID program, concluding that REAL ID will do little to make the driver's license a more reliable identity document, but will create huge privacy and civil liberties risks for hundreds of millions of Americans.
We listed five main criticisms of REAL ID:
- The REAL ID card will become a de facto national ID card, particularly if it becomes required for more purposes. We recently blogged about such "mission creep."
- REAL ID will likely result in the creation of a central ID database, which will threaten the privacy and security of 240 million Americans. I recently wrote an op-ed piece about this issue, which DHS has for the time being left unresolved. And when DHS is finally ready make a decision about what technical architecture will be built to implement REAL ID, the Department will likely not solicit public input.
- DHS is mandating a standardized and unencrypted Machine-Readable Zone (MRZ), which will facilitate intrusive tracking by both government and commercial entities, thereby exacerbating a serious existing problem.
- Following a lack of explicit Congressional authority under the Act, DHS failed to adopt meaningful privacy and security standards for the protection of personal information in the REAL ID system.
- In a related initiative, DHS is creating driver's licenses with imbedded, insecure RFID chips ("Enhanced Driver's Licenses") that will threaten the personal privacy and security of American citizens, without Congressional oversight or an administrative rulemaking.
The REAL ID Act was shoved down the throat of a previous Congress, having been attached to a must-pass war and tsunami relief emergency funding bill. There was little debate in the House and no debate in the Senate. CDT encourages this Congress to take action to address the privacy and civil liberties disaster that is REAL ID.
We have supported Senator Akaka's S. 717 and Rep. Allen's H.R. 1117, bills that would repeal the REAL ID Act and replace it with a negotiated rulemaking process that would actually make driver's license issuance more secure, involve all relevant stakeholders, happen faster than DHS' current REAL ID implementation plan, and specifically address privacy and civil liberties concerns.
Alternatively, Congress could replace a repealed REAL ID Act with legislation that is a "carrot" rather than a "stick." Congress could change how it exercises authority over the states, from invoking the right to regulate IDs used for federal purposes to conditioning federal money on states taking certain driver's license reform actions. This would create a financial incentive for all states to follow the same minimum standards to make driver's license issuance more secure.
Specifically, the legislation could provide that verification of source documents is the primary minimum requirement to receive federal funding. Arguably the only meaningful thing REAL ID does is to require states to verify identity and legal status against federal databases. Congress could provide federal money and a clear directive to the relevant federal agencies to expand source document electronic verification systems while at the same time encouraging states to join the program. This singular focus would go a long way at making driver's licenses and state ID cards more reliable identification credentials.
Finally, Congress should aim to upgrade the Driver's Privacy Protection Act, which provides no meaningful protection of the personal information individuals must reveal in order to get driver's licenses and state ID cards.
States like Montana, whose governor has outright pledged not to implement REAL ID, are making it clear that REAL ID is a failed attempt at driver's license "reform." And Congress would be wise to act before May 11, which is the date that DHS will stop accepting driver's licenses as IDs from people whose state governments have failed to indicate at least a preliminary intention of complying with the law. Airport chaos is already being predicted if millions of people are forced to submit to longer and more intrusive physical searches because their driver's licenses are no longer considered valid for air travel.