Identity Crisis

Real ID comes under fire from a growing number of states.

by / May 31, 2007

Since 9/11, high-profile events at venues that hold tens of thousands of spectators have been widely regarded as potential terrorist targets.

The Super Bowl, more than any other such event, seems most ripe for an attack. Given how many people attend -- and how many millions watch it on TV -- a terrorist would be hard-pressed to find a more inviting mark at which to strike. 

On a rainy Sunday afternoon in early February, the hundreds of law enforcement officials deployed throughout Dolphin Stadium in Miami during Super Bowl XLI were on the highest alert. It would be fair to conclude that on that day, the stadium was one of the most secure facilities in the nation. In addition to the massive police presence, bomb-sniffing dogs were working alongside high-tech tools like facial recognition software. 

Certainly no one could infiltrate these safeguards. But someone did -- six someones in fact. 

A group of men with fabricated media badges moved more than 2,000 "party packages" into the stadium. The packages contained light-up necklaces and instructions on how to use them. With virtually no hassling from security officials, the men distributed the packages to thousands of specially selected fans. Following the instructions they received, the recipients turned on their necklaces at halftime -- spelling out a secret message seen around the world. 

Fortunately for everyone, the scheme was a prank perpetrated by the guys who run, a popular comedy Web site. The secret message was largely illegible due to ambient light during halftime, but hidden camera footage of their escapade captured how simple it was for them to gain total stadium access. 

Although the stunt didn't directly involve fake drivers' licenses, the incident shows how shockingly easy it is to use a false identity -- even during a high-profile event with extensive security. The Real ID Act proposes to address the fake ID problem by standardizing and enhancing the security features on every citizen's driver's license -- thus preventing people from making and passing off fake drivers' licenses or using phony ones to obtain other counterfeit IDs. 

On the flip side, opponents contend the Real ID Act will not prevent security gaps, but will in fact create larger ones. 

Since Government Technology's previous article on the matter (Papers Please, November 2005), a lot has changed. And for a growing bipartisan chorus, the Real ID Act is looking like little more than an expensive Band-Aid.


Answers and Questions
In May 2005, the Real ID Act was signed into law after it sailed through the Republican-controlled House to the Senate where it was attached to a supplemental spending bill for hurricane relief and troops in Iraq -- making the bill almost impossible to vote against. 

The Real ID Act is an unusual piece of legislation. It allows the federal government to generate specific requirements regarding what a state driver's license must contain, which sets the stage for an epic states' rights battle. 

States can choose to abide by these regulations, but if they decline, the federal government can bar their citizens from using facilities like airports and federal courthouses. The Real ID Act prohibits noncompliant license holders from entering any federally controlled building. 

On March 1, 2007, the U.S. Department of Homeland Security (DHS) unveiled the long awaited clarification of what exactly a driver's license issued under the Real ID Act must contain. 

In concert with the expected news, the DHS announced an extension for the Real ID rollout deadline. 

Originally states had to begin rollout in May 2008. But at a Washington, D.C., press conference, DHS Secretary Michael Chertoff announced that states could request a new rollout deadline of Dec. 31, 2009. 

In the 162-page clarification document -- the Notice of Proposed Rulemaking (NPRM) -- the DHS confirmed what many had assumed but waited nearly two years to hear. The NPRM sets minimum, suggested guidelines for driver's license security standards. After a 60-day public commenting period, the DHS says it will issue final rules about what constitutes an acceptable, secure driver's license. 

The guidelines address specific questions raised by states, but do little to quell the underlying controversy generated by Real ID, which stems from three main sources. 

First, the DHS is requiring drivers' licenses to incorporate security features that will make them as tamper- or copy-resistant as possible. According to the NPRM, the security features include offset lithography instead of traditional printing; digital photographs; a machine-readable magnetic strip containing all the data printed on the license (which 45 states already use); and a still undetermined encryption method for the data stored on the card. 

In addition, any person applying for a driver's license must present proof of identity, such as a valid U.S. passport or obtaining a certified copy of a birth certificate from the county recorder's office. Applicants must also show a Social Security card or another legal document containing a Social Security number. 

Second, Real ID requires states to create massive, interoperable databases that hold personal information. This means that under the act, the department of motor vehicles (DMV) in one state could access the information of every license holder in the country. This database system is being decried as a virtual bonanza for identity thieves. 

Third -- and most troubling for states -- the Real ID Act is an unfunded mandate. The National Governors Association (NGA) estimated that Real ID's implementation costs for states would be more than $11 billion. Before it was enacted, the Congressional Budget Office estimated Real ID's cost at around $100 million. 

"If you take a look at the regulations, they have a very detailed cost estimate in there, and it's interesting because we came out and said the five-year cost [would be] $11.2 billion," said David Quam, director of federal relations at the NGA. 

But Quam said the DHS's March announcement included an even bigger estimate -- $14.6 billion. And with the cost to individuals, Real ID's price tag may be as much as $23.1 billion.

In the end, it was the states that underestimated how much Real ID implementation would set them back. So far, the federal government has appropriated $40 million in fiscal 2006 to assist states in rolling out Real ID -- or about 0.0027 percent of the DHS's estimated cost to states.

"A lot of the objections you're hearing from states are not just Washington creating a one-size-fits-all driver's license, but then not offering to pay the tab," Quam said. "So a lot of those objections, I believe, are not going to go away. States are going to still see it as an unfunded mandate."


The Catch
The extension granted by the DHS takes some pressure off states. The trouble, explained Quam, is that only the rollout date was extended, not the deadline for total compliance, which remains May 11, 2013.

"The good news is, in some of the regulations, it appears that the Department of Homeland Security has listened to states," Quam said. "They understand how complicated these systems are and that there is going to need to be some flexibility if we're going to comply. The problem is they also gave us a five-year window to enroll everybody, and that clock starts ticking on May 11, 2008.

"You've got a deadline on the front side to start filling them up, and you have a deadline on the backside for when you have to finish," he continued. "They're giving us more time on the front end, but no more time on

the back end. And that means since you have to re-enroll everybody in the state, if you take extra time, your window of opportunity is going to be squeezed. That's going to make it very difficult for some states to comply."

In terms of paying the Real ID bill, the DHS said states could use as much as 20 percent of their Homeland Security Grant Program funding to help offset costs. For fiscal 2007, the DHS's total grant budget, which includes five programs, is $1.7 billion -- 20 percent of that is $330 million. 

According to the DHS, this makes substantial funds available to states beginning this year. But most of that money already has been allocated to existing needs, Quam said. 

States are now in an awkward position -- they have a better picture of what Real ID will require of them and a better notion of just how much it will cost, but there's no substantial federal assistance on the horizon. 

So if the federal government isn't going to pay for Real ID and states can't afford it, who'll get stuck with the tab? 

"It's pretty clear from reading the regs [regulations] that DHS is envisioning this as a fee-based system," Quam said. "That means they're envisioning states are going to pass this [cost] along to license holders." 

In another scenario, taxpayers footing the bill may have ended the story. But something unexpected is taking place. The Real ID Act seems to be striking a chord on both sides of the aisle -- and it's resonating across the country.


Strange Bedfellows
With the prospect of a billion-dollar tab, a giant database prone to hacker attacks and the fact that every American driver's license holder will have to renew or obtain a new license in person -- meaning lines of epic proportions at the DMV --  many states and their representatives are starting to question whether they want to be a part of this whole Real ID thing after all. 

Legislators from dozens of states have begun mulling, proposing and even passing resolutions and legislation that run the gamut from opposing Real ID to opting out of the system entirely. And although Real ID was written and passed by Republicans, many Republicans are now joining Democrats in opposing the act. 

Sen. Lamar Alexander, R-Tenn., was among a number of U.S. senators who cosponsored an amendment to delay and modify the Real ID Act. The bill remains in committee where it will likely die, as the DHS already has granted an extension similar to what the bill proposed. Alexander said Real ID is an example of the kind of legislation Republicans are supposed to be defeating. 

"The first major problem is it is a massive unfunded mandate on states," he said. "It's an egregious example of somebody in Washington coming up with a big idea and taking credit for it, and then sending the bill to the governors. A Republican who promised to end unfunded mandates should be embarrassed at having pushed this through. 

"I think the bill could only have been passed by a congressman who has never walked inside a driver's license examining station in a state," Alexander continued. "I can just imagine the 3 or 4 million Tennesseans lining up, going around blocks in our state, and then being told they have to have their birth certificate, which they lost 10 years ago, and another proof of their citizenship." 

The senator also expressed his displeasure with the way the bill was passed. 

"It was stuffed into a supplemental appropriations bill and rammed down the throats of the Senate. We never held a hearing. We never gave it a thought and had no opportunity really to vote against it," he said. "I just think

it was a lousy way to make a law, and because of that, it doesn't solve whatever problem it was attempting to solve." 

Alexander is far from alone. In fact, the amendment he cosponsored, originally proposed by Susan Collins, R-Maine, had significant bipartisan support. Other cosponsors include Tom Carper, D-Del.; Olympia Snowe, R-Maine; Maria Cantwell, D-Wash.; Saxby Chambliss, R-Ga.; Lisa Murkowski, R-Ala.; and Barbara Mikulski, D-Md. 


States of Denial
At the state level, lawmakers recently passed legislation refusing to comply with Real ID. Idaho, Maine and Montana are leading what some would call a Real ID rebellion, passing laws rejecting Real ID. Other states are starting to follow suit, with similar legislation being considered in nearly 40 states. 

In Arizona, Sen. Karen Johnson, R-Mesa, is passionate about states' rights and sees Real ID as an affront to the idea of American government. Recently the Arizona Senate passed a bill that Johnson wrote, directing the state to reject implementation of the Real ID Act. 

At only two sentences long, Johnson's SB 1152 is short and to the point. 

"... this state shall not participate in the implementation of the Real ID Act of 2005. The department shall not implement the Real ID Act of 2005 and shall report to the governor and the legislature any attempt by agencies or agents of the United States Department of Homeland Security to secure the implementation of the Real ID Act of 2005 through the operations of the United States Department of Homeland Security," according to the bill. 

The opposition to Real ID is manifesting itself in a number of ways. Some, like Alexander, want more time to discuss the issue and come up with a better plan. Johnson and others like her want Real ID eliminated. 

"In my opinion it should be done away with completely," she said. "I do not like people sticking their nose into my business. I think that's what America is about, individual responsibility and freedom, not putting us into databases. And I'm very resentful of that." 

Johnson said Real ID has helped her forge coalitions that, under other circumstances, would seem ludicrous. In this case, the senator has teamed up with the American Civil Liberties Union (ACLU) to help keep Arizona from complying with Real ID. 

"It's been interesting because the ACLU is not a group that I normally work very closely with," she said. "But I'm happy to have their help, and I'm happy they're against this. They certainly urged the bulk of their Democrats to vote for this." 

The senator also blasted Real ID as a half-hearted approach to security. The real security problem, she said, is being largely ignored by the DHS. 

"When you say, 'security,' I just have to laugh," she said, "because our borders are wide open." 

Thousand of miles to the east, a Democrat is trying to keep Real ID out of Maryland. State Sen. Jennie Forehand of Rockville is opposed to the federal government sticking states with the bill. Like Johnson, Forehand argues that Real ID will do little to solve the nation's security problems. 

Forehand sponsored a joint resolution that tells Congress her district is opposed to Real ID. The nonbinding resolution also sets the stage for Maryland to join other states that have already declared their intent to reject Real ID altogether. 

"I think it's a waste of money," she said. "I don't think it's the way to bolster security. I think [Real ID Act author Jim] Sensenbrenner's idea was that it would weed out all the illegal immigrants. But you know anybody can get a false ID. If I thought it was going to protect us, I wouldn't be trying to oppose this. But it's a pipe

dream. If they really wanted to do that, they could have everybody get a passport." 

The Real ID Act has been widely panned for creating the potential for identity theft. Government officials interviewed for this story expressed concern that a national database full of every license holders' personal information is a disaster waiting to happen. 

Alexander said he might introduce new legislation that would begin the process of creating a more secure Social Security card in lieu of Real ID. "I believe a secure Social Security card would have been a much better idea. We have a tremendous identity theft problem with Social Security. I can't imagine the Real ID card going into effect the way the law is now written. It will create lines in the street, pandemonium and millions of outraged voters." 

Johnson called Real ID a "gold mine for identity theft." Forehand said the Real ID information databases would offer "identity thieves a picnic." Quam said there are still many questions on the details regarding the databases and how they will operate long term. 

Although some things have been cleared up, much of the Real ID Act is still shrouded in confusion. But one thing is certain -- Real ID is inspiring a bipartisan coalition in opposition of it. Why is this particular piece of legislation stirring such a negative response? Is the Real ID Act inherently flawed, or is it just in need of a tune-up? 

Alexander's explanation is probably as accurate as it is concise: "This was not thought through carefully."
Chad Vander Veen

Chad Vander Veen is the former editor of FutureStructure.