On Jan. 11, 2008 -- just 120 days before the law's original compliance deadline -- the DHS issued its final rule on Real ID. The 300-page document pushed back the compliance deadline to 2014 for states working to implement Real ID, and it relaxed the deadline even further -- to 2017 -- for drivers over age 50. But according to several observers, the new rule does little to ease funding and privacy concerns that have prompted numerous states to refuse to comply with the Real ID requirements.
Troubled History
Government Technology first reported on Real ID shortly after President George W. Bush signed it into law in 2005. We revisited the issue in 2007 due to a growing uproar within the states over the DHS's failure to provide clear details about how states were to issue new drivers' licenses. Also high on the list of states' concerns was the glaring omission of federal funds to help pay for what is estimated to be a multi-billion dollar undertaking.
The Real ID Act, according to its authors and supporters, is intended to establish a set of national standards for drivers' licenses to prevent terrorism and reduce security breaches and identity theft. The law came under immediate fire for the aforementioned issues as well as for requiring license-holder information to be available to all 50 states. This, according to critics, amounts to the creation of a national database of citizen information, which many believe is a privacy disaster in the making. Moreover, many opponents decry Real ID as a subversive attempt to establish a system of national ID cards.
Originally states had to comply with Real ID by May 11, 2008. However, by mid-2006, DHS had yet to define the technologies states needed to implement and no funding had been secured. In response, a number of states passed resolutions -- some even passed binding legislation -- to opt out of participation in Real ID -- this despite the fact that without a Real ID-compliant license, a citizen could not enter a federal building or board an aircraft. The revolt prompted DHS to push back the deadlines for deployment and, instead of a "drop-dead" date for implementation, DHS added a rollout window of several years, beginning Dec. 31, 2009 and lasting through 2011.
With the open revolt among states ongoing, many close to the issue hope the latest announcement will help restore order.
"We are still sifting through them to see how they compare with what we've asked for and what kind of changes the department has made," said Jeremy Meadows, senior committee director for the National Conference of State Legislatures' (NCSL) Standing Committee on Economic Development, Trade and Cultural Affairs. "Generally speaking, it does look like they listened. There are some changes we think are very favorable, such as the additional time for re-enrollment and not requiring states to utilize verification systems until they're actually operational."
A Mixed Bag
According to the final regulations, the date for compliance will be extended again, to 2014, for those states that can prove they are actively attempting to get their licenses in compliance
with federal standards. Additionally those born prior to Dec. 1, 1964, will not be required to obtain a Real ID-compliant license until 2017, a move DHS says reduces the estimated compliance cost to states from $11 billion to $3.9 billion.
But Meadows has already found a lot to be disappointed with. He said that, despite the concessions, DHS didn't heed a number of other requests from states. Funding and privacy concerns appear to have gone ignored.
"Even if we accept the [Homeland Security] Department's new cost estimate of $3.9 billion, that's still $3.9 billion," said Meadows. "One of our requests of the department was that certain populations be exempted from the Real ID process, such as people who have already been vetted by the federal government, namely people who already have passports or military IDs who are going to be able to use those forms of identification for all of the official purposes that a Real ID is going to be used for -- boarding aircraft, entering federal buildings, etc. And they didn't do that."
Meadows said the NCSL, as well as organizations like the National Governors Association (NGA) and the American Association of Motor Vehicle Administrators (AAMVA), had hoped citizens already granted a passport or military ID would be able to skip the enrollment process required by Real ID, which requires every citizen to appear in person at the DMV -- a crush of humanity the motor vehicles offices are ill prepared for, as well as the millions now accustomed to managing such affairs online.
Questions also loom about states that have passed laws requiring nonparticipation in Real ID. The final regulations may go a long way toward bringing such states back into the fold -- but they still may not be enough, especially for states such as New Hampshire and Nevada whose residents pride themselves on independence and a tradition of states' rights.
"The good news is that DHS seems to have listened to some of the recommendations of the states and what it may take to move Real ID from the improbable to, at least, the possible," said David Quam, director of federal relations for the NGA. "But every state has to evaluate its situation to see if these rules match up to reality. Those states are going to have to look at the decisions they've made and determine whether to make a change. But that is ultimately going to be up to them. They've made some very strong statements, and as of right now I haven't heard of anyone changing."
Technical Hurdles
Technology continues to present challenges as well. As they exist today, DMVs generally can't share information with other states effectively. However, there is a promising solution that could make such information exchange possible without the need for a national database, which many fear would be a cyber-terrorist's dream come true.
A couple dozen pages into the massive final regulations document, DHS outlines a strategy to utilize an existing system called the Commercial Driver's License Information System (CDLIS). CDLIS, according to DHS, "currently supports queries to every state DMV every time an individual applies for a driver's license in any state or the District of Columbia. CDLIS already meets the data exchange requirements of Real ID for those drivers holding commercial drivers' licenses. Moreover, CDLIS is a secure, state-governed system that stores the minimum amount of personal information possible to facilitate the routing of queries and responses between states. DHS is considering an effort to define system requirements for Real ID state-to-state data exchanges based upon the CDLIS model or platform."
Such a system is promising, according to Brendan Peter, senior director of LexisNexis special services and chair of the Information Technology Association of America's (ITAA) subcommittee on identity management. Peter said CDLIS should quell concerns about information being vulnerable because data
is not stored in a single place.
"CDLIS is a system AAMVA operates for the states, and all the states use it to check, when somebody comes for a commercial driver's license, whether you have a license in any other jurisdiction," he explained. "The records aren't centralized anywhere, it's a pointer system that when the states initiate a query through AAMVA, AAMVA sends messages to the individual states and gets responses back, then sends them back to the jurisdiction that initiated the query. That's the same type of architecture that would exist for the state-to-state transactions to cover all drivers."
Despite the final rule, the future of Real ID seems unclear. The law severely challenges states' rights while simultaneously saddling states with an estimated $4 billion bill. And as anyone ever remotely familiar with government cost estimates can attest, there is a good chance that number will get a lot higher.
Half the states in the union have either passed or are considering passing laws requiring noncompliance with Real ID, setting the stage for an epic showdown between the states and the federal government. If half the nation refused to carry the only ID the federal government recognizes, what would happen to the airline industry? No one without a Real ID will be able to pass airport security. It's just one of the intriguing questions Real ID presents.
But some states, such as California and Alabama, already issue drivers' licenses that meet almost every technological requirement set forth in the Real ID Act, according to those states' DMVs. For these states, funding deployment and managing tens of millions of DMV appointments will be the biggest challenges.
While it's true DHS issued its final regulations regarding Real ID, the reality is this is just the beginning.
