Drivers often secure multiple drivers' licenses to conceal out-of-state criminal convictions and traffic violations. And since four of the hijackers in the Sept. 11 terrorist attacks easily obtained fraudulent drivers' licenses, securing the credential has become a must.
So now what?
The American Association of Motor Vehicle Administrators (AAMVA) assembled a task force to create a consensus on how states should prevent or detect fraudulent use of the credential. Congress has introduced a number of bills proposing stronger federal requirements for drivers' licenses, but a federal solution may not be imminent.
In the interim, states are taking steps they hope will align with whatever guidelines are developed.
AAMVA has convened more than a dozen working groups that include representatives from the National Governors Association (NGA), the National Council of State Legislatures, the Council of State Governments and biometric technology vendors. The groups expect to nail down some guidelines by mid-2003.
"We're addressing a lot of the things we can address first before we hop on that biometric train," said Betty Serian, chair of AAMVA's Task Force on ID Security. "We want to bring about uniformity, but do that so jurisdictions have time to consider the uniform standards and implement them."
But the Task Force on ID Security is too cautious, according to Shane Ham, senior policy analyst with the Progressive Policy Institute (PPI). "Really what they're doing is expanding into a nationwide level something the states have been doing rather piecemeal with the magnetic stripes and the 2-D barcodes," he said.
It's AAMVA's reluctance to embrace biometrics that has PPI's dander up. "They are doing some stuff that is exactly the right thing to do," Ham said. "But in general, they are sort of boldly rushing into the 20th century."
States Forge Ahead
As both working groups and the feds try to decide on specifications for driver's license security, most states are moving toward a more secure credential on their own, perhaps setting the standards as they go.
Twenty-one states enacted new laws, and more than 20 others have introduced legislation making it more difficult to obtain a license. The few states that didn't previously require digital images on drivers' licenses began doing so in late 2002.
When discussing minimum standards, requiring a digital photo on each license tops the list. "That is probably the minimum threshold everyone has or is getting," Serian said.
With digital photos comes the capability of scanning the images with facial recognition software to check for duplicates, and later, the ability to trade information with other states. That's already on the drawing board in some areas, said Thom Rubel, director of state information technology policy for NGA, who added that Pennsylvania and neighboring states have talked about sharing digital photos.
"What you're going to want to consider is long-term sharing," Rubel said. "Really, right now, just the digitized photo is where most of them have gone just so they can share that."
Biometric Technology
Experts say states inevitably will employ biometric technology for searching and verification purposes ? and some already have.
Some of the biometric solutions being considered are face recognition, fingerprinting, iris scanning, digital signatures and hand geometry. The two most likely candidates for identification and verification on this level are fingerprinting and face recognition, since photos and fingerprints already are available in great numbers.
An estimated 250 million to 300 million facial images exist already, having been collected by motor vehicle agencies around the country. Between 50 million and 100 million fingerprints collected by law enforcement and on applications for entitlement programs are available now.
"Why would you start picking something else that you have no installed sets of data, when you've got these hundreds of millions of images and fingerprints out there you can use already?" said Cameron Queeno, vice president of marketing at Viisage, which works with several states on biometric implementations.
In late 2002, Colorado announced the implementation of facial recognition technology, joining Illinois, West Virginia and the District of Columbia.
Colorado's implementation uses facial scanning to eliminate the issuance of duplicate drivers' licenses. As an applicant's digital photo is taken for the license, the photo is immediately searched against the database of other facial images. The technology creates a template of the face and measures the distances between different "landmarks." This template becomes a mathematical formula, unique to each face.
Similar technology in West Virginia has prevented the issuance of thousands of duplicate or fraudulent credentials, said David Bolyard, director of driver services for the West Virginia DMV. "We've caught several people trying to commit fraud, and a lot of people have run out of the offices before they could be accosted."
Bolyard said the technology has helped the state prevent "several thousand" fraudulent applications from going through, but in the end humans still must determine if an applicant is lying.
When renewing a West Virginia license, applicants sign in and are photographed. As photos are taken, the system confirms or denies people's identities by comparing them to their original photos in the database. If the system can't confirm an applicant, a supervisor is called to determine that applicant's identity.
In Illinois, officials use facial recognition technology to search the state's database for duplicate licenses. They found tens of thousands of duplicates. Some individuals had as many as a dozen licenses.
Whereas most facial recognition applications prevent the issuance of fraudulent cards, fingerprint technology is usually implemented, such as in Texas, to prevent cards already in circulation from fraudulent use. Several other states, including California and Georgia, also are collecting fingerprints. Down the road, the trend may be to use both facial recognition and fingerprint technology in tandem.
"The first thing we're doing is preventing you from getting a false ID," said Frances Zelazny, director of corporate communications for Identix, another biometric technology vendor used in the public sector. "The second thing is making sure the ID actually belongs to you."
Fingerprint biometrics is more difficult to implement, in part because of the limited number of prints available. The technology also requires investment in fingerprint readers. On the other hand, facial recognition technology works with a software algorithm installed on the back end of the system, and it's easy to use.
Centralizing Production
Georgia recently awarded a $20 million contract to Viisage to produce drivers' licenses for the state's Department of Motor Vehicle Safety over the next six years. Under the agreement, Georgia will switch from over-the-counter production of drivers' licenses to producing all state drivers' licenses at a central location.
"All the data will be stored on the state's servers in a secure environment, and the production of the credentials will be highly controlled in that central location," said Viisage's Queeno. "That makes it much more difficult to get your hands on the security materials."
For security, Georgia won't rely on centralized production alone. The state insisted the contract allow for deployment of numerous biometric and safety features on the card itself, although those features aren't specified yet.
"Many states are taking the initiative now and saying, 'Look, I want a solution that has the capability to do this and this and this, so that if the [federal] government does mandate one or two of these things, I'm covered,'" Queeno said.
AAMVA aims for an interoperable system where states can, in some way, cross check information. But the organization says the system will cost hundreds of millions of dollars and require federal assistance.
"I think every state is continuing to improve their drivers' licenses," said AAMVA's Serian. "That's the good news. The concern is that we want to share with one another, and we want to work to a degree of interoperability. That's why we're being cautious and incremental in how we approach things."
AAMVA would like to see more research on the accuracy of biometrics, Serian added. "It might be easy to get a match on an office complex where you might have 200 people," she said. "But a biometric match on 1 [million] to 200 million, perhaps in terms of the number of drivers in the country, that's difficult. I think you'll find just as many people who would say it would work as those who'd say it wouldn't work."
Facial recognition technology received a lot of attention when a Florida jurisdiction placed facial recognition cameras in public areas to pick out faces and compare them to a database of known felons. The accuracy of such an implementation was roundly questioned. But biometrics in a controlled environment is a different story, some say.
"When you have no cooperation and no capability to make sure you're getting a frontal shot of a person under decent lighting, it can affect the accuracy tremendously," Queeno said. "If you have cooperation ? somebody wants to get in the door, somebody wants to get on a plane ? you have a controlled environment where the lighting is consistent."
Others agree, noting improvements in biometric identification techniques.
"The technology has gotten a lot stronger," said PPI's Ham. "Especially if they'd done what we had proposed, which is to use smart chips in the cards, which has all kinds of advantages outside of the driver's license itself."
There are other issues to consider as well, including privacy. How much personal data would be collected and stored? How secure would the information be? Who would have access to the data?
"At the end of the day, it boils down to the fact that biometric data is a form of personal information, and you have to protect it," said Identix's Zelazny. "If somebody sells credit card information, it's illegal, and they can go to jail. It's the same way with this. If somebody misuses biometric information, they should be penalized."
