Chertoff’s Defense of REAL ID is “Dead Wrong”
Department of Homeland Security Secretary Michael Chertoff has a hard job. Among other things, it’s his responsibility to make sure that our country isn’t attacked by terrorists and that undocumented immigrants don’t cross our borders. So it’s understandable when he vociferously defends his Department’s efforts at “protecting the homeland.” But it’s inexcusable when the guy is simply factually (and vociferously) wrong on an important policy issue.
On April 2, Chertoff, testifying before the Senate Judiciary Committee during a hearing on DHS oversight, had the gall to say that public interests groups have been putting out “misinformation” and are “dead wrong” about the privacy and civil liberties risks of REAL ID. Yet it was the Secretary who put out misinformation and was dead wrong about the risk of the wrong people gaining access to personal information stored in the REAL ID card’s “machine-readable zone” (MRZ). Specifically, Chertoff said – in response to a question from Sen. Feingold – that it would be impossible to “skim” personal information off REAL ID cards, all of which will have a DHS-mandated two-dimensional (2D) barcode as the MRZ. An MRZ is a section of an ID card that stores digitized personal information that can be quickly scanned and collected by an electronic reader. Other MRZ examples are the common magnetic stripe or the one-dimensional bar code like those seen on grocery packages. Chertoff asserted that the skimming of personal information can only happen with RFID chips. He also said that DHS is not mandating that REAL ID cards have an RFID chip (this actually is true). While CDT is glad that DHS is not mandating an RFID chip for REAL ID cards, the Secretary is nevertheless – in his words – dead wrong.
The RFID chip isn’t the only “machine-readable zone” that can be scanned and from which personal information can be collected. Police officers regularly scan the various MRZs of state driver’s licenses, as do businesses such as bars that seek to verify that patrons are over 21. One of the many problems with the REAL ID Act is that it mandates a standardized machine-readable zone. DHS in turn, in its implementing regulations, picked the 2D barcode to be the national MRZ but did not mandate that the personal information stored in the MRZ be encrypted or otherwise protected from unauthorized use – despite extensive comments from privacy advocates to do just that (see p. 5292 of DHS’ final REAL ID regulations). 2D barcode readers are already widely available, and mandating that all REAL ID driver’s licenses and ID cards use the same unsecured MRZ technology will make the readers even more ubiquitous, thereby putting personal information at an even greater risk than it already is.
The legislative history of the REAL ID Act makes clear that the MRZ was only meant to help law enforcement – yet neither the Act nor DHS made an effort to protect the personal information that will be digitally stored on the REAL ID cards. It’s not unreasonable to fear that businesses and government agencies alike will increasingly scan the 2D barcode, collect personal information, possibly resell that information, and at the same time log the activities and movements of innocent Americans. Yet Chertoff responded to Sen. Feingold that it’s a “blatant falsehood” that REAL ID cards could be used to track people. CDT brought up the risks of a standardized, unencrypted machine-readable zone in our recent analysis of DHS’ final REAL ID regulations, as well as in the comments we submitted to the Department on its proposed regulations last year. DHS has punted the issue of MRZ security (and REAL ID privacy and security in general) to the states. But we believe that if the federal government is going to get into the business of regulating state driver’s licenses, then it has a responsibility to make sure personal privacy is protected. We also believe that Chertoff needs to get his facts straight before he attacks public interest advocates who have legitimate concerns about REAL ID.
