The state of the REAL ID debate

November 13, 2008

In May of 2005, Congress passed HR 1268 – a massive defense appropriations bill that the congressional leadership had set on a “must-pass” track. Included in the legislation were a number of non-defense provisions that laid out national standards for state drivers licenses through a program known as REAL ID. The REAL ID initiative not only sought to enact federal driver’s licenses mandates, but it also aimed to link state license databases together, in order to make them mutually searchable. Rules issued by the Department of Homeland Security earlier this year will soon require state governments to begin complying with REAL ID standards, unless individual states can qualify for a DHS-issued extension.

The congressional investigative office, the GAO, estimates that the cost of REAL ID implementation will reach $9.9 billion nationwide. Defenders of the program say that the cost is worth it to help secure the country against terrorism. According to DHS head Michael Chertoff, “Secure identification is an essential way of ensuring that people are who they say they are. And therefore this kind of identification gives us a tremendous tool in preventing dangerous people from getting on airplanes or getting into federal buildings.”

Skeptical of its merits, critics across the nation have raised a host of objections to REAL ID – including claims that the program won’t provide meaningful protection of either sensitive facilities or personal data. “REAL ID,” according to computer security expert Bruce Schneier, “won’t be nearly as secure as we might hope … computer scientists don’t know how to keep a database of this magnitude secure.”

Concerned about ballooning costs and a perceived lack of data privacy protections, the Minnesota legislature tried to opt out of the REAL ID program earlier this year. Governor Tim Pawlenty vetoed bills that contained such “opt-out” language, but then passed an executive order that prohibited REAL ID compliance without legislative approval.

As next year’s deadline for state compliance approaches, it is worth looking back at the legislative and political history of this issue, in order to understand what the future might hold for REAL ID.

From 9/11 to REAL ID
In the aftermath of the 9/11 attack, government agencies and private think tanks scrambled to formulate new security protocols to respond to the threats posed by suicide hijackers and other “asymmetrical” terrorists. A number of proposals floated in those frenetic months dealt with changes to the issuance and verification of identity documents. At the time, some of this discussion revolved around the question of whether America should adopt a national identity document similar to those issued in continental Europe. A 2002 Christian Science Monitor opinion piece by Georgetown University Professor Amitai Etzioni is representative of such sentiments. In his piece, Etzioni noted that a tamper-resistant national identity card would help deter terrorism by making it more difficult for terrorists to travel while using falsified documents. Despite long-standing American antipathy toward this kind of centralized solution, Etzioni noted that the times demanded such a change:

“We live in a new world,” Entzioni wrote, “and now must make some careful adjustments to our way of life. To require everyone within our borders to identify themselves in a reliable manner is a reasonable step in the right direction.”

Push-back to the idea of a national ID card was immediate and broad-based, ranging across the political spectrum from the ACLU to a variety of gun rights groups. This opposition ultimately impacted the enabling legislation that created the Department of Homeland Security. The final DHS bill included a provision expressly prohibiting the department from implementing a national identity document. Homeland Security chief Tom Ridge later reiterated this position during a 2004 speech at Johns Hopkins University. “The legislation that created the Department of Homeland Security,” he said, “was very specific on the question of a national ID card. They said there will be no national ID card.”

Two years after DHS was created, the tenor of the ID security debate changed dramatically with the publication of the 9/11 Commission Report. In addition to providing a narrative of the 9/11 event, the commission’s final report contained a list of security proposals that received strong bi-partisan praise. High among these recommendations was the idea that the federal government should tighten travel regulations as a way of impeding the free passage of terrorists. According to the report, “Constraining terrorist travel should become a vital part of counterterrorism strategy.” The report then went on to stress the importance of checking identity documents at airports, border crossings, and other sensitive areas.

After the report’s publication, both political parties began to champion various aspects of the report’s recommendations, and several versions of implementation legislation were introduced. Late in 2004, Congress passed S2845 – the Intelligence Reform and Terrorism Prevention Act – which drew heavily on the commission’s proposals. For instance, the law required DHS to create plans for the collection of biometric data at national ports of entry, and it set out goals for national driver’s license standards. The legislation also set out a “negotiated rule-making process” whereby states would have input into the crafting of the final license mandates. One year later, Wisconsin Representative James Sensenbrenner went a step further, and sought to replace the state-federal negotiating process with a purely federal approach, through a program known as REAL ID.

As envisioned by Sensenbrenner, REAL ID would serve as both a counter-terrorism program, and an immigration status verification regime. To obtain a REAL ID compliant card, applicants for driver’s licenses would have to show several forms of pre-existing documents – including social security documentation and birth certificates – that would be theoretically difficult for illegal immigrants to obtain. In 2005, Sensenbrenner told FOX News that, “American citizens have the right to know who is in their country, that people are who they say they are, and that the name on the driver’s license is the real holder’s name, not some alias.”

The REAL ID Act was first introduced as stand-alone legislation, and it passed the House in early 2005. Later that year, its core provisions were added onto a defense appropriations bill that passed Congress in the late spring, and it became law on May 11th, 2005.

The intent behind REAL ID
Proponents of REAL ID claim that its nation-wide standards will frustrate the production of fraudulent state IDs, and thus inhibit their use by illegal immigrants and prospective terrorists. According to the DHS web site:

“State-issued identification is an important step toward enhancing national security. Because driver’s licenses serves so many purposes, terrorists actively seek fraudulent state-issued identification. The REAL ID rules will make it more difficult for them, while making it easier for law enforcement to detect falsified documents.”
DHS maintains that standardization – in conjunction with improved security features on the cards themselves – will remedy numerous problems related to ID card fraud. Driver’s licenses issued under REAL ID will also contain additional information that officials can use to more thoroughly verify individual identity. This information will include a card holder’s full legal name, address, date of birth, sex, plus a digital photograph.

Information sharing under REAL ID is intended to facilitate a greater degree of communication between the officials of various states, who will be able to verify IDs through connections to each other’s databases. According to the DHS final rule on REAL ID, the department also contemplates federal access to these databases for the purposes of law enforcement and identity verification. Homeland Security officials have also articulated purposes for REAL ID cards beyond immigration and counter-terrorism uses. According to a Feb 12, 2008 GAO report, DHS has claimed that REAL ID “could reduce fraudulent activities (related to) government subsidies and welfare programs … unlawful employment, unlawful access to firearms, and voter fraud.”

The detractors
The concerns of REAL ID skeptics are numerous, and chief among them is the charge that the system will simply not provide the security that it claims to deliver. Minneapolis-based computer security consultant Bruce Schneier has been one of the highest profile critics of REAL ID, and he has consistently critiqued the program on security grounds. In testimony before Congress, Schneier held that REAL ID cards would not prevent counterfeiting in any meaningful way. At the same time, he noted that the interconnected nature of REAL ID databases would make them ripe to be targeted for identity theft. In a 2008 Star Tribune editorial, Schneier wrote that:

“The main problem with any strong identification system is that it requires the existence of a database. In this case, it would have to be 50 linked databases of private and sensitive information on every American, widely and instantaneously accessible nationwide. The security risks of this database are enormous.”

Schneier also faulted the federal mandate that requires all REAL ID compliant card data to be accessible by “common machine-readable technology.” Standardizing access to card data across the nation, according to Schneier, would increase the number of card holders at risk for identity theft.

REAL ID has also been attacked as a federal intrusion into state sovereignty. Republican congressman Ron Paul has characterized the card as a “national ID card” which flies in the face of states’ rights. “Federally imposed standards for drivers’ license and birth certificates make a mockery of federalism and the 10th amendment,” Paul wrote in a 2005 commentary.

REAL ID in Minnesota
The last two years have seen a growing state-level resistance to REAL ID mandates. The initial deadline for REAL ID compliance was May 11th of this year, but most states have been slow to move toward implementation, and no state was ready to meet the 2008 deadline. Recognizing this, DHS allowed states to apply for extensions until December of 2009, at which time they will have to begin issuing REAL ID compliant cards, or else become eligible to apply for a second extension.

As of this writing, ten individual states have enacted laws prohibiting their governments from complying with REAL ID mandates. Montana’s law, for example, characterizes REAL ID as “inimical to the security and well-being of the people of Montana,” and its statutory language prohibits the Montana Department of Motor Vehicles from complying with REAL ID mandates. Even more states have passed non-binding resolutions against REAL ID.

Earlier this year, the Minnesota legislature passed bills that contained anti-REAL ID provisions on two separate occasions. In April, the legislature passed an omnibus transportation bill that contained REAL ID opt-out language. This legislation was vetoed by Governor Pawlenty, who set out his veto rationale in a three page memo. In his memorandum, Pawlenty criticized legislators for acting rashly, and for not allowing the federal government time to modify the REAL ID program before rejecting it outright. “The federal government’s response is not complete or finalized,” read the Governor’s memo. “Until it is, we should be careful not to duly restrict our abilities to at least begin preparations for implementing REAL I.D.” Failing to do so, Pawlenty wrote, would ultimately subject Minnesota residents to situations in which their driver’s licenses would be unusable for boarding airplanes.

Pawlenty also leveled criticism at legislators for ignoring his own suggestions about how to deal with REAL ID issues – particularly those related to closing the gap in federal funding. “My suggestions for improving the REAL I.D. provisions of the bill were not incorporated in the bill,” read Pawlenty’s memo. “My concerns could have been easily addressed in the bill, but my suggestions were rejected.”

Shortly after the governor’s veto, the legislature passed HF 3807 – a stripped-down version of the anti-REAL ID provisions included in the earlier transportation bill. The language of HF 3807 prohibited the Commissioner of Public Safety from taking any action to implement the REAL ID Act. Senator Jim Carlson, a co-author of the bill, set out his rationale in a 2008 press release, stating that REAL ID “would cost Minnesota tens of millions of dollars, and could compromise the personal information of all Minnesotans.” Carlson noted that the cost of the program could reach $31.4 million over three years, with limited federal reimbursement money available. In a recent interview, Carlson said that the state has yet to have advanced discussions about how the program might be funded. While there was once talk of passing REAL ID costs on in the form of additional license tab fees, Carlson said that no formal proposals had emerged.

Like its predecessor bill, HF 3807 was vetoed by Governor Pawlenty once it reached his desk. One day after his veto, Pawlenty issued executive order 08-08, which instructed the Commissioner of Public Safety to take steps to put Minnesota on the road to REAL ID compliance, so long as those steps did not “obligate Minnesota to fully implement the REAL I.D. Act.” Pawlenty’s order also stipulated that full REAL ID implementation would have to wait until the legislature had expressly authorized it.

Over the REAL ID horizon
At this juncture – one year out from the revised DHS deadline – many states appear to be pursuing a dual-track strategy regarding REAL ID compliance. At the same time that political resistance to REAL ID was spreading through state houses across the nation, many state DMVs were taking halting steps to enact REAL ID’s mandates – at least to the point where they could qualify for DHS extensions. According to a March 2008 story in Government Computer News, “All but a handful of states have made preparations to comply with … the federal REAL ID law that mandates secure driver’s licenses … The states’ quiet steps to fall in line with the law appear to contradict state officials’ blustering claims that they will resist the new requirements.”

In Minnesota, resolution over the REAL ID impasse is still elusive. Ultimately, the state’s final response to REAL ID will be decided by the legislature, even as the state government continues to explore its compliance options. Spokespeople for the Department of Public Safety did not return calls to comment on the specific steps that Minnesota had taken toward REAL ID implementation thus far.

Senator Carlson has said that he has no plans to introduce a REAL ID-related bill during the next legislative session, although he couldn’t speak to what his colleagues might do. Carlson said that at this point, he plans to wait to see what the Obama administration and Congress will do to address the issue at a federal level. In the meantime, he assumed that DHS would continue to grant extensions to states on a rolling basis.