Thread: Support H.R.220 - Common Sense About Identity Theft & RE

Perspective: Real ID is bad? Compared to what?

CoreStreet founder Phil Libin says the absence of a meaningful debate has hindered a serious discussion about the implications of a controversial new technology.

By Phil Libin

Published: April 5, 2007, 4:00 AM PDT
See all Perspectives
TalkBack E-mail Print del.icio.us Digg this

perspective The Department of Homeland Security has published the proposed details of the Real ID act, and criticism is starting to pour in from all sides. The Real ID act is supposed to standardize driver's licenses issued by the states. Supporters say that this is necessary to improve security. Critics usually focus on the weakening of privacy protections. The arguments and counterarguments usually don't bother to address each other and, lofted on volume rather than substance, quickly grow heated and dim.

There's a way to have a meaningful debate on this. Any new security proposal must be compared to the status quo on four dimensions: Security, privacy, convenience and cost. If the new proposal is clearly better at all four, then it's a no-brainer. If the new program is worse on all four, then, well, it has no brains. What if the new program is better on some dimensions but not on others? Should we weigh the relative merits and compromise? Yes, eventually, but not right away! Since the new proposal enjoys the airy freedom of not actually existing yet, we should go back and rework the proposal until it is overwhelmingly better than the status quo.

If we just throw our hands up and refuse to engage Real ID, we'll get the lousy law we deserve.

What is the status quo that Real ID is aiming to replace? Basically, each state has its own standards for driver's licenses, which differ on many of the important details. This is pretty bad across all four dimensions.

If we just throw our hands up and refuse to engage Real ID, we'll get the lousy law we deserve. Security is a mess under the current systems. Methods of collecting, verifying and storing background data differ from state to state, as do the physical protections on the cards themselves and the qualifications of the people that handle your licenses. It's not terribly difficult to get a fraudulent driver's license in any state, and it's easier in some states than others. This kind of setup is structurally likely to worsen over time as people "shopping" for a fake license disproportionately target states known to have weak security. The argument that monoculture and homogenization of systems are generally bad for security doesn't apply here; all the state systems don't have to fail for a terrorist to get a fake license--it only takes one.

At the security line at Chicago O'Hare Airport, a New York driver's license is functionally equivalent to a California license. Since the federal government has to treat all the licenses as equal, it's perfectly reasonable to ask that they all be equal. And not just equal, but at least passably secure. Real ID can improve this.

Privacy with the status quo isn't much better. All of your personal data is already stored on your license and can be read electronically by anyone with a simple 2D bar code scanner. DMV databases are susceptible to data theft, and there are no consistent regulations for what you're allowed to do with a driver's data. With the bar set so low, Real ID should be able to provide a significant privacy upgrade, so it's disappointing that the initial proposed language is mostly mute on privacy. If passed today, Real ID would probably do no net harm to our already meager privacy, but this isn't good enough. Let's work explicit privacy protections into the plan. Real ID should be about real privacy and real security.

Now on News.com:
Rewriting ethics rules for the new media
Google makes map mashups simple
Newsmaker: Wikipedia today, Citizendium tomorrow
Extra: U.S. denies destroying Russian satellite
Video: Mashups for all
Convenience, usually the single most important factor in the successful adoption of new security programs, is pretty much a wash here. The quality of the worst licenses will go up and more attention to training should even out the experience of dealing with DMV staff, but most people won't notice a difference in convenience. My friend who routinely gets extra special airport security treatment because his official DC license is so poorly printed that it looks completely fake, will feel better, but most people won't care.

Cost is tricky as well. Initial adoption of a new driver's license standard will certainly be more expensive in the short term, but the efficiencies of scale and standardization may save money over time. Is this wishful thinking? Probably.

So how do we judge Real ID? We are already living with a national-scale identity system, except it's an accidental system that sucks for security and privacy and is lackluster in convenience and cost.

Is Real ID overwhelmingly better? Not yet, but it can be made so. Let's.


Biography
Phil Libin is president ofCoreStreet, an ID management and access control company in Cambridge, Mass. His regular thoughts can be found at Vastly Important Notes.

###


<sarcasim>No he doesnt have any intrest in pushing the real National NAU ID</sarcasim>

Thursday, April 5, 2007
N.H. House backs REAL ID ban

By NORMA LOVE
Associated Press Writer


CONCORD, N.H. (AP) _ The New Hampshire House voted overwhelmingly Thursday to reject the federal REAL ID Act as amounting to the creation of a national ID card.

The House voted 268-8 to send the bill to the Senate that would bar the state from complying with the federal act that sets standards for driver's licenses.

Gov. John Lynch has said he will sign the bill if it reaches his desk.

Ban supporters said New Hampshire needs to send a clear statement that the federal government strayed too far.

''It is probably the worst piece of blackmail to come out of the federal government. This is pure, unadulterated blackmail,'' said. Rep. Sherman Packard, R-Londonderry.

Last year, New Hampshire led the way in opposing the law _ a move now being considered by other states.

''If we are the first state to opt out, so be it,'' said Packard.

President Bush recently bowed to pressure from the nation's governors and Congress and granted states until Dec. 31, 2009, to comply. Two years ago, Congress set a deadline for states to comply with uniform licensing standards by May 2008.

The law passed in response to the Sept. 11, 2001, terrorist attacks. It requires all states to bring their driver's licenses under a national standard and to link their record-keeping systems. States must verify identification used to obtain a driver's license, such as birth certificates, Social Security numbers and passports.

Driver's licenses not meeting the standard won't be accepted as identification to board a plane and enter federal buildings.

Critics complain the law is too intrusive and costly to states to implement. They also say creating a national database of drivers' information will be a target for thieves looking to steal identities.

In January, Maine lawmakers adopted a nonbinding resolution opposing the law.

Rep. Neal Kurk, R-Weare, the prime sponsor of New Hampshire's bill, says 26 states have either legislation or resolutions in the works opposing REAL ID. He said 11 states have legislation facilitating compliance _ some of which also have measures opposing the act.

Last year, New Hampshire's House voted against participating and Lynch said he would sign the bill, but the Senate rejected it. New Hampshire also was one of two states picked to pilot the program, but Lynch and the Executive Council did not approve the $3 million grant.

Earlier this year, Lynch reiterated his concerns that too many questions remained about the cost, privacy and turning motor vehicle workers into de facto agents of Homeland Security. He said implementing the federal identity system could cost New Hampshire tens of millions of dollars.


http://www.fosters.com/apps/pbcs.dll/ar ... 1/70405048

''It is probably the worst piece of blackmail to come out of the federal government. This is pure, unadulterated blackmail,'' said. Rep. Sherman Packard, R-Londonderry.

Last year, New Hampshire led the way in opposing the law _ a move now being considered by other states.

Way to Go, NH!

More great news today.

Originally Posted by 2ndamendsis

''It is probably the worst piece of blackmail to come out of the federal government. This is pure, unadulterated blackmail,'' said. Rep. Sherman Packard, R-Londonderry.

Last year, New Hampshire led the way in opposing the law _ a move now being considered by other states.

Way to Go, NH!

More great news today.

I am pushing for my state legislator to do the same, but he doesnt seem to anxious to do anything about it. perhaps, I will have to post his info so others can "encourage him" to put an end to this nonsense.

SC Senate Says 'No' to Federal REAL ID Act


VIDEO: SC Senate Says 'No' to Federal REAL ID Act - Robert Kittle reports
http://www.wltx.com/video/newsPlay.aspx?aid=32323&bw=




(Columbia) - The South Carolina Senate has a message for Congress: no money, no REAL ID.
Congress passed the REAL ID Act of 2005 as a way to improve homeland security by standardizing states' driver's licenses and ID cards. The cards themselves would be more secure, and getting them would take more scrutiny, like verifying all forms of identification used to get a license.

But Congress is not giving states the money they need to implement the act. It's estimated to cost at least $28 million to start the program in South Carolina, then at least $10 million a year after that. The money is to create new databases and computer systems to be able to share information nationwide so states can verify identification. The new licenses would be made a different way, which requires a new system. DMV workers would also have go through FBI background checks and get training on the new system.

DMV director Marcia Adams says putting REAL ID in place would mean wait times at the DMV would go back to an hour or more, like they were five years ago when the state switched to a new computer system at the DMV.

"What the REAL ID act requires is people to come in person to re-enroll, to bring their documents so that we can look at those documents and electronically verify them. It really does away with any web renewals and any mail renewals," she says.

The license would also cost you more. Instead of $25, she estimates it would cost $60-$85.
Idaho and Maine have already passed resolutions saying they won't take part in REAL ID, and South Carolina is the sixth state with a bill pending to do the same.

But the act says you'll need a REAL ID to board a commercial airplane or enter a federal building. What happens to South Carolinians if the state doesn't comply with the law?

Sen. Larry Martin, R-Pickens, main sponsor of the bill to opt out, says, "That is within the province of members of Congress to determine. I really think that, with South Carolina and some other states that have looked at this and have said, 'Look, we just can't do it,' it really puts the ball back in their courts to do something more reasonable."

Congress is already looking at changing the REAL ID Act because of all the complaints from the states. Sen. Martin says he doesn't think Congress would shut down air travel or federal buildings if the state doesn't comply because of the impact that would have on commerce.


http://www.wltx.com/news/story.aspx?storyid=48499

But Congress is not giving states the money they need to implement the act.

If the only impediment to this nonsense is federal funding, God help us. Congress will be more than happy to spend more of our money to enslave us.

Originally Posted by CrocketsGhost

But Congress is not giving states the money they need to implement the act.

If the only impediment to this nonsense is federal funding, God help us. Congress will be more than happy to spend more of our money to enslave us.

You are correct, congress has no problem with wasting our tax dollars on us.

Delay of Real ID through houses

JENNIFER BYRD
The Associated Press

A measure that delays Washington's implementation of the federal Real ID Act, a 2005 law signed by President Bush requiring strict national standards for state-issued driver's licenses, is headed to Gov. Chris Gregoire's desk.

Her office said she is expected to sign the bill, which passed the state House 95-2 on Thursday. The Senate passed an identical bill earlier this session.

The measure directs the state not to spend money to implement the act unless privacy and security protections have been met, the implementation doesn't place unreasonable costs or record-keeping burdens on citizens, and the state has received federal money to put the act's requirements into effect.

The bill also allows the state attorney general, with the approval of the governor, to challenge the legality or constitutionality of the act.

The Bush administration agreed earlier this year to grant states an extra 1 1/2 years to comply with the law. The original law set a May 11, 2008, deadline, but no funding had been provided. The new deadline is Dec. 31, 2009.

The state Department of Licensing had estimated it would cost $96.7 million over the next two years and $93.4 million in 2009-2011 to implement the act.

According to the American Civil Liberties Union, Washington is the fourth state to pass legislation opposing the law, joining Maine, Idaho, and Arkansas.

"Real ID has been controversial since it was first started," said House Transportation Chairwoman Judy Clibborn, D-Mercer Island. "It's definitely an unfunded mandate."

Clibborn said that because Washington state is developing "enhanced" driver's licenses - which will include proof of citizenship, residency and other information - a Real ID is not needed.

"We have the enhanced license, which is possibly going to be the prototype for the rest of the nation," she said.

The optional Washington enhanced driver's license, to be available in January, has been approved by the U.S. Department of Homeland Security for testing as a secure border-crossing document. It will also allow scanners to tell if the person is on a watchlist or has a criminal record.

"The overwhelming margin of today's vote shows how truly bipartisan is the opposition to REAL ID," Jennifer Shaw, ACLU of Washington legislative director, said in a statement. "It would threaten personal privacy, as well as create a bureaucratic nightmare to implement."

http://www.theolympian.com/125/story/77465.html

Representatives okay Real ID ban
After 268-8 vote, bill heads to the Senate


By NORMA LOVE
The Associated Press


--------------------------------------------------------------------------------
April 06. 2007 8:00AM


The New Hampshire House voted overwhelmingly yesterday to reject the federal Real ID Act as amounting to the creation of a national ID card.

The House voted 268-8 to send the bill to the Senate. The legislation would bar the state from complying with a federal act that sets standards for driver's licenses.

Gov. John Lynch has said he will sign the bill if it reaches his desk.

Supporters of the ban said New Hampshire needs to send a clear statement that the federal government strayed too far.

"It is probably the worst piece of blackmail to come out of the federal government. This is pure, unadulterated blackmail," said. Rep. Sherman Packard, a Republican from Londonderry.

---ADVERTISEMENT---

Last year, New Hampshire led the way in opposing the law - a move now being considered by other states.
"If we are the first state to opt out, so be it," Packard said.

President Bush recently bowed to pressure from the nation's governors and Congress and granted states until Dec. 31, 2009, to comply. Two years ago, Congress set a deadline for states to comply with uniform licensing standards by May 2008.

The law passed in response to the Sept. 11, 2001, terrorist attacks. It requires all states to bring their driver's licenses under a national standard and to link their record-keeping systems.

States must verify identification used to obtain a driver's license, such as birth certificates, Social Security numbers and passports.

Driver's licenses not meeting the standard won't be accepted as identification to board a plane and enter federal buildings.

Critics complain that the law is too intrusive and is costly for states to implement. They also say creating a national database of drivers' information will be a target for thieves looking to steal identities.

In January, Maine lawmakers adopted a nonbinding resolution opposing the law.

Rep. Neal Kurk, a Republican from Weare and the prime sponsor of New Hampshire's bill, says 26 states have either legislation or resolutions in the works opposing Real ID. He said 11 have legislation facilitating compliance - some of which also have measures opposing the act.

Last year, New Hampshire's House voted against participating. Lynch said he would sign the bill, but the Senate rejected it. New Hampshire also was one of two states picked to pilot the program, but Lynch and the Executive Council did not approve the $3 million grant.

Earlier this year, Lynch reiterated his concerns that too many questions remained about costs and privacy. The act would turn motor vehicle workers into de facto agents of Homeland Security, he said.

The governor said implementing the federal identity system could cost New Hampshire tens of millions of dollars.

------ End of article

By NORMA LOVE

The Associated Press


http://www.concordmonitor.com

State, federal privacy issues arise
Reprints By Robert Gellman, Consultant
April 6th, 2007
--------------------------------------------------------------------------------

The new legislative sessions that began in January have already produced two major but incomplete privacy stories. One story comes from a number of states, including Maine and Idaho. The other story comes from Washington.

The state story involves the Real ID Act, a federal law enacted in 2005. The law establishes strict federal standards for drivers’ licenses. Unless state license procedures meet those standards, the federal government will not accept the state’s licenses as identification.

There has been outrage about Real ID, and many other advocacy organizations from right to left also oppose the law. Some of the consequences for privacy arise from the requirement that states keep copies of all identification documentation provided by license seekers, as well as from the enhancement of the machine readability of the new licenses.

At the end of January, the Maine legislature approved a resolution saying the state refuses to implement the Real ID Act. The resolution cited four reasons. First, the federal law imposed an unfunded mandate. Second, the cost for Maine would be $185 million. Third, the resulting database will invite identity theft and invasion of privacy. Finally, the costs and inconveniences offer no benefits such as terrorism prevention.

What we have here seems to be a genuine state rebellion of a sort perhaps not seen since the 1800s. Further, Maine is not alone. Idaho followed suit in March. Other states are still working on similar action.

The chief sponsor of the Real ID Act is the former chair of the House Judiciary Committee. Since his party lost control of the House, he has lost his ability to control the issue. The rebellion plus the lack of a firm policy foundation for Real ID could force major changes, if not a total repeal.

What’s happened already is something of a privacy success, but the story isn’t over. The Bush Administration is going ahead with regulations, and the final outcome is far from clear. What is clear, however, is that the privacy argument must share the stage with the cost argument. Had Congress fully funded the law, then the state rebellion would likely have fizzled.

The second story begins with the pledge of House Democrats to implement all recommendations of the 9/11 Commission. The legislation to accomplish this pledge is H.R. 1, and the bill number tells you of the importance of the matter to the new House leadership.

The Commission recommended that there be a board within the executive branch to “oversee adherence to the guidelines we recommend and the commitment the government makes to defend our civil liberties.” The Intelligence Reform Act, passed in 2004 when the Republicans ran the Congress, established a civil liberties board. However, as H.R. 1 observes, that board does not have the authority necessary to protect civil liberties. The board is seen by some as too powerless and too subject to presidential control.

Title VII of H.R. 1 would replace the existing board with a Privacy and Civil Liberties Oversight Board as an independent agency within the executive branch. Board members would serve fixed terms, be from both political parties and not be under the President’s thumb. The board would also have subpoena power, a tool that could have great force and effect.

The bill would also establish privacy and civil liberties officers in federal agencies that have major functions related to national security and intelligence. Several privacy and civil liberties officers already exist, but other officers would be newly created. The privacy and civil liberties officers would have a broad portfolio and the authority to report directly to the head of the agency and to the board as well.

My favorite feature of the bill is the independence of the board. I have advocated an independent privacy board for a long time. However, the board’s focus is a bit too narrow. It is understandable that the 9/11 Commission focused on terrorism and the board’s responsibilities reflect that. I would like to see the board have some broader privacy responsibilities but no regulatory powers.

Regardless of the details, the major point is that for the first time since 1974, a bill to establish a privacy agency passed a House of Congress. A similar agency is also in a companion bill that passed the Senate.

The conclusion to both of these privacy stories has yet to be written. There could be more developments at any time.

Robert Gellman is a Washington-based privacy and information policy consultant and former chief counsel to the House subcommittee on information, justice, transportation and agriculture. His e-mail address is bob@bobgellman.com
Next Article in Legal/Privacy
Trackbacks
Trackback URL: http://www.dmnews.com/cms/trackback/40662-1