Is it safer to fly or drive? (and why you can't do one without the other)
Kevin Bowers is a Research Scientist at RSA Laboratories. Here are his views on the controversy surrounding REAL ID. What do you think?
I’m getting married this summer and my family will be traveling to the wedding. In order to make the trip, my parents recently renewed their passports. Not because I’m getting married at an exotic destination, but because they live in Montana and have to fly to the wedding. Like several other states, Montana has refused to comply with the requirements of the REAL ID Act of 2005. The Department of Homeland Security (DHS) had threatened to prevent residents from those states from using their state-issued driver’s licenses as identification at airport security, effective May 11th.
As it happens, the DHS recently granted all states an extension to the May 11th deadline, allowing them additional time to become REAL ID compliant. As a result, driver’s licenses will continue to be accepted as valid identification to board a plane and enter federal buildings until December 31, 2009. Although REAL ID was designed to improve the security of driver’s licenses, several states, including Montana, have drafted legislation prohibiting the implementation of REAL ID.
There are several reasons why states are upset about REAL ID, the first being the lack of funding provided to implement a very costly change. It is estimated that implementing REAL ID will require $11 billion over the next five years, while the federal government has only promised $90 million to assist in the effort. Additionally, many states feel the government is overstepping its bounds by mandating a minimum set of requirements for state-issued IDs. There are also several security concerns being raised about the license requirements.
One such concern is that REAL ID effectively creates a national database of personal information, including full legal names, dates of birth, places of residence and digital photographs. While REAL ID does not create a centralized database of all this information under the control of the federal government, it does require states to tie their databases together, essentially creating a distributed national database. This is being mandated in an effort to prevent individuals from obtaining multiple licenses from different states and also to facilitate the authentication of documents (such as birth certificates) issued by external states. Unfortunately, as a result, any DMV worker in any state will have access to your personal information.
Another concern with the new IDs is a requirement for a common machine-readable technology. The initial implementation will be a standardized barcode without the use of encryption. DHS argues that encryption key management would be extremely difficult and that the need for immediate access to information stored on the card by law enforcement outweighs the potential privacy concerns. Unfortunately, if the information is stored unencrypted, there is nothing to prevent your personal information from being read and stored by anyone who asks to see your license. This includes staff in bars and restaurants — and any place that requires proof of identity or age to enter.
Many state-issued IDs already have barcodes on them, but several states do not. The requirement for a barcode as well as its standardization across states will make ID scanning easier and prompt more businesses to do so. While this may result in a decrease in underage drinking, for example, it will likely also cause an increase in identity theft. As the number of businesses that scan IDs increases, so will the probability that one of them will sell or misuse the information they gather. Even if the states are able to secure their shared databases of personal information, what guarantees are there that businesses will do the same?
Of further concern is the fact that barcodes may be replaced by RFID chips in future versions of REAL IDs. Several border states are creating Enhanced Driver’s Licenses that incorporate RFID in compliance with the Western Hemisphere Travel Initiative, an issue that has already been discussed in this blog entry. The desire to merge these two forms of ID will create a strong push for RFID to be the common machine-readable technology of the future REAL ID.
As you might expect, several groups are opposed to the law, including the American Civil Liberties Union, the American Association of Motor Vehicle Administrators, the National Council of State Legislatures and the National Governors Association. Currently, 18 states have proposed legislation preventing the implementation of REAL ID with laws having already been passed in Maine and Idaho. Many argue that REAL ID would not have prevented 9/11 (the hijackers were all legal residents with proper identification), and will — at best — prevent illegal aliens from obtaining a driver’s license while costing legitimate residents both time and money to get their (mandatory) replacement license.
Thankfully, the DHS extension has relieved immediate travel concerns. REAL ID will now not be enforced until after the November elections and a new administration takes office. With any luck the newly-elected administration will bring with them a better understanding of both national security and personal privacy, and REAL ID will be repealed before it becomes a real issue. If not, we might all have to get passports to fly in our own country.
