Security

Is PASS ID Better Than REAL ID? (Analysis)

The proposed PASS ID could be a suitable stand-in for the controversial bill, or it might be REAL ID-lite.

by / August 14, 2009 0

Photo: U.S. Department of Homeland Security Secretary Janet Napolitano

The deadline for REAL ID implementation is fast approaching. Under current rules, states participating in REAL ID must begin issuing compliant drivers' licenses by December 31, 2009. That is, unless, these states have applied for an extension to May 11, 2011. Of course, there are also 23 states that have passed legislation partially or completely prohibiting participation in the REAL ID program.

The REAL ID Act of 2005, which was written in response to the 9/11 Commission's findings that 18 of the 19 hijackers had obtained fraudulent state drivers' licenses, has always been controversial. The act requires states to issue drivers' licenses that conform to federally mandated security standards - with no federal money to do so. Almost immediately the act was decried by organizations at all points on the political spectrum as a gross invasion of privacy as well as a national identification card in disguise.

The 2011 extension is just the latest setback for REAL ID advocates. Signed into law May 11, 2005, the act was supposed to take effect in May 2008. But an unprecedented revolt in the states has kept kicking the REAL ID can farther down the road. The current timeline calls for full implementation to take effect by 2017. However, with nearly half the states refusing to cooperate, REAL ID's future is uncertain. In fact, Department of Homeland Security (DHS) Secretary Janet Napolitano recently declared REAL ID "DOA" -- dead on arrival.

Napolitano is the former governor of Arizona, one of the states that opted not to comply with REAL ID. She also served as chairwoman for the National Governors Association, an organization that has fought hard against REAL ID. Her track record opposing REAL ID and her declaration that the legislation is dead would seem to put the issue to rest. Unfortunately Napolitano has only complicated matters, ironically, by advocating a new bill called PASS ID.

In June, the PASS ID bill was introduced in the Senate. Many are calling it "REAL ID-lite." S.1261, the Providing Additional Security in States' Identification Act of 2009, a.k.a. PASS ID, is supposed to streamline REAL ID by removing the most contentious components while granting some federal funding to help states comply. Of the many problematic rules prescribed by REAL ID, perhaps none were as vociferously objected to as the requirement that states build interoperable databases for storing sensitive citizen data. This data would be accessible by government agencies, like departments of motor vehicles and law enforcement, and would facilitate interstate data sharing. Furthermore, REAL ID made no concessions for protecting the data of police officers, judges or victims of domestic abuse. PASS ID does away with this element but keeps in place most of the other REAL ID cornerstones.

PASS Relaxes Security Requirements

Under PASS ID, states would still be required to implement drivers' licenses that feature digital photographs, digital signatures and a common machine-readable technology, such as a bar code. According to realnightmare.org -- which opposes REAL ID and is linked to the American Civil Liberties Union -- PASS ID would also downgrade the standard for machine-readable technology to include insecure features like radio frequency identification, commonly known as RFID. PASS ID also still mandates a database of digital source documents, such as birth certificates, that prove an individual's identity. Though these databases would not need to interoperate among states, privacy groups like the ACLU and the Electronic Frontier Foundation still claim this would be a hacker's dream come true.

A PASS ID would also still be required for any citizen who wishes to board an airplane or enter a federal facility. However, this clause would not go into effect until five years after PASS ID is implemented, presumably to allow time

for states to get on board with the program.

For the existing flaws critics cite, PASS ID has won some support. The National Governors Association, for example, now backs PASS ID, citing it as "a more feasible, cost effective solution that will make everyone more secure while maintaining state flexibility." And there's bipartisan support in the Senate, including Sen. Daniel Akaka, D-Hawaii, and Sen. George Voinovich, R-Ohio -- the two legislators who introduced the bill. Interestingly two Senate co-sponsors, Montana Sens. Max Baucus and Jon Tester, both Democrats, also support PASS ID. Montana's Democratic governor, Brian Schweitzer, was an outspoken critic of REAL ID, and Montana was among the first states to opt out.

There's a long slog through the legislative grindhouse for PASS ID and there are fundamental questions that remain: Is a stripped down version of the REAL ID Act the right way to ensure better security? Or is REAL ID so inherently flawed that it would be better to scrap it entirely and start over? There are more than a few observers who argue that nothing at all should be done; states are continually modernizing licenses on their own and legislation like REAL ID and PASS ID is intrusive and unnecessary.

In the wake of REAL ID and the new drama that is PASS ID, there's only one constant: Total security is an illusion, and no amount of legislation can change that.

 

Chad Vander Veen

Chad Vander Veen previously served as the editor of FutureStructure, and the associate editor of Government Technology and Public CIO magazines.