Home » Identity & Access » Identity Management

In Brief

REAL Bad Idea

Privacy advocates and some states are pledging to fight the adoption of Real ID

By CSO Contributor

July 19, 2007 — CSO —

Privacy advocates and some states are pledging to fight the adoption of Real ID

REAL ID may be more than just a real pain: It may have serious privacy implications as well.

The 2005 act was passed in response to the 9/11 Commissions recommendation that the government better ensure the validity of U.S. IDs. Real ID would require states to save digital copies of source documents such as birth certificates for drivers licenses and require states to share information in their drivers license databases. In theory, the new ID cards, which would include digital photographs and personal information in a machine-readable chip, would better verify the identity of people carrying the cards. But the legislation has raised the eyebrows of privacy advocates. In addition to the prohibitively expensive cost of implementation (estimates range between $11 billion and $23 billion) and the lack of compliance guidelines from the Department of Homeland Security, detractors argue that the creation of a national database poses inherent security risks, such as identity theft and counterfeiting. In May, 43 privacy, civil rights and consumer organizations launched a campaign to raise awareness and stop Real ID.

There are 245 million identification cardholders nationwide. If youre linking 50 states together and providing multiple access points to multiple DMVs, thats a huge security risk, says Melissa Ngo, director of the Identification and Surveillance Project at the Electronic Privacy Information Center (EPIC). Furthermore, the current guidelines do not establish how the data would be secured. There are background check requirements for the DMV workers who will be accessing the data, but the information itself is unprotected, says Ngo. Its fundamentally flawed.

After the December 2009 compliance deadline, federal agencies will not accept licenses or ID cards from people unless the issuing state is meeting Real ID requirements. Noncomplying ID will not be valid for residents who want to fly on a plane or open a bank account. Its not really voluntary because there are immediate punishments for not complying, says Ngo.

DHS pushed back the original implementation deadline by two years in response to criticism about the cost and lack of guidance from the federal government. In the meantime, states have to prove their intent to comply with the act. Maine, Idaho, Arkansas, Washington state and Montana have already rejected participation. Other states, including California, are planning and preparing.

Bernard Soriano, CIO at the California Department of Motor Vehicles, says his team has already started working on integrating verification systems (such as Systematic Alien Verification for Entitlements and Social Security Online Verification), upgrading equipment and adding storage capacity to computer systems in order to retain documents related to Real ID. Although the requirement doesnt come as a surprise to Soriano, he says that doesnt mean compliance isnt a daunting task. However, states dont have to feel completely helpless. A Gartner report released in March outlines recommendations for states to prepare for Real ID: