EPIC - National ID and the REAL ID Act
Commentary: Under Real ID, privacy will be nonexistent. ... Senate takes step away from Real ID. CNet News.com, June 27, 2007 ...... "DHS has the obligation to protect the privacy of citizens affected by this system and must do .... Controversy continues to surround the national ID scheme, and the public is invited ...
Latest News/Events
- Worker Biometric ID Under Consideration in US: Senators Charles Schumer and Lindsey Graham have proposed a new national identity card. The Senators would require that "all U.S. citizens and legal immigrants who want jobs" obtain a "high-tech, fraud-proof Social Security card" with a unique biometric identifier. The card, they say, would not contain private information, medical information, or tracking techniques, and the biometric identifiers would not be stored in a government database. EPIC has testified in Congress and commented to federal agencies on the privacy and security risks associated with national identification systems and biometric identifiers. For more information, see EPIC: National ID and the REAL ID Act, EPIC: Biometric Identifiers, and the Privacy Coalition’s Campaign Against REAL ID. (Mar. 24, 2010)
- EPIC Report: "REAL ID Implementation Review: Few Benefits, Staggering Costs." At a REAL ID workshop at the Berkman Center, EPIC today released a new report on the Department of Homeland Security’s national identification proposal, the REAL ID system. "May 11, 2008 is the statutory deadline for implementation of the REAL ID system. Yet on this date, not one State is in compliance with the federal law creating a national identification system. In fact, 19 States have passed resolutions or laws rejecting the national ID program. The Department of Homeland Security has faced so many obstacles with the REAL ID system that the agency now plans an implementation deadline of 2017." See EPIC Report: "REAL ID Implementation Review: Few Benefits, Staggering Costs" and EPIC Comments on the Draft Regulations. (May 13)
- Alaska Joins Other States in Rejecting REAL ID System. Just two weeks after DHS granted all 56 states and territories extensions that would allow state licenses and ID cards to remain “valid for federal purposes” past May 11, 2008, Alaska has passed legislation against the REAL ID national identification scheme. SB 202 (pdf) states, "A state agency may not expend funds solely for the purpose of implementing or aiding in the implementation of, the requirements of the federal Real ID Act of 2005." DHS has said it “made extensions available for states that needed additional time to come into compliance, or to complete ongoing security measures,” implying that states that received extensions had agreed to implement the national identification system. However, Alaska is just the latest in a number of states that have declared unequivocally that it will not implement the REAL ID scheme. (April 11)
- Idaho Rejects REAL ID System; State Rebellion Spreads. Idaho has enacted legislation to reject the REAL ID national identification scheme. HB 606 (pdf) prohibits the Idaho transportation board and department from implementing the national ID system and "to report to the governor and to the constitutional defense council [...] any attempt by agencies or agents of the U.S. department of homeland security to secure implementation of the REAL ID act of 2005, through the operations of that department." Last year, the Idaho Legislature passed a joint memorial (pdf) opposing REAL ID, but that bill had no force of law. Idaho joins several states in rejecting the national ID system even though they have all received extensions from the Department of Homeland Security allowing their state licenses and ID cards to remain “valid for federal purposes” past May 11, 2008. (April 9)
- DHS Caves, Gives Extensions to All States Though Some Reject REAL ID. Several states are rejecting the Department of Homeland Security’s REAL ID program, which would create a national identification system, but DHS granted all states extensions that would allow state licenses and ID cards to remain “valid for federal purposes” past May 11, 2008. Four states (Maine, Montana, New Hampshire and South Carolina) have expressly rejected the system and none asked for an extension. The Department of Homeland Security said it “made extensions available for states that needed additional time to come into compliance, or to complete ongoing security measures,” implying that states that received extensions had agreed to implement the REAL ID national identification system. However, a number of states have said that these extensions do not constitute an agreement to implement this national ID scheme, including California (pdf). (April 3)
History of National Identification Cards
National ID cards have long been advocated as a means to enhance national security, unmask potential terrorists, and guard against illegal immigrants. They are in use in many countries around the world including most European countries, Hong Kong, Malaysia, Singapore and Thailand. Currently, the United States and the United Kingdom have continued to debate the merits of adopting national ID cards. The types of card, their functions, and privacy safeguards vary widely.
Americans have rejected the idea of a national ID card. When the Social Security Number (SSN) was created in 1936, it was meant to be used only as an account number associated with the administration of the Social Security system. Though use of the SSN has expanded considerably, it is not a universal identifier and efforts to make it one have been consistently rejected. In 1971, the Social Security Administration task force on the SSN rejected the extension of the Social Security Number to the status of an ID card. In 1973, the Health, Education and Welfare Secretary's Advisory Committee on Automated Personal Data Systems concluded that a national identifier was not desirable. In 1976, the Federal Advisory Committee on False Identification rejected the idea of an identifier.
In 1977, the Carter Administration reiterated that the SSN was not to become an identifier, and in 1981 the Reagan Administration stated that it was "explicitly opposed" to the creation of a national ID card. The Clinton administration advocated a "Health Security Card" in 1993 and assured the public that the card, issued to every American, would have "full protection for privacy and confidentiality." Still, the idea was rejected and the health security card was never created. In 1999 Congress repealed a controversial provision in the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 which gave authorization to include Social Security Numbers on driver's licenses.
In response to the tragic events of Sept. 11, 2001, there has been renewed interest in the creation of national ID cards. Soon after the attacks, Larry Ellison, head of California-based software company Oracle Corporation, called for the development of a national identification system and offered to donate the technology to make this possible. He proposed ID cards with embedded digitized thumbprints and photographs of all legal residents in the U.S. There was much public debate about the issue, and Congressional hearings were held. Former House Speaker Newt Gingrich testified that he "would not institute a national ID card because you do get into civil liberties issues." When it created the Department of Homeland Security, Congress made clear in the enabling legislation that the agency could not create a national ID system. In September 2004, then-DHS Secretary Tom Ridge reiterated, "[t]he legislation that created the Department of Homeland Security was very specific on the question of a national ID card. They said there will be no national ID card."
The public continues to debate the issue, and there have been many other proposals for the creation of a national identification system, some through the standardization of state driver's licenses. The debate remains in the international spotlight -- several nations are considering implementing such systems. The U.S. Congress has passed the REAL ID Act of 2005, which mandates federal requirements for driver's licenses. Critics argue that it would make driver's licenses into de facto national IDs. EPIC and others have called for the repeal of this ill-conceived national identification law.
The REAL ID Act of 2005
History
The REAL ID Act of 2005 creates a de facto national identification card. Ostensibly voluntary, it would become mandatory as those without the card would face suspicion and increased scrutiny. It is a law imposing federal technological standards and verification procedures on state driver's licenses and identification cards, many of which are beyond the current capacity of the federal government, and mandating state compliance by May 2008. In fact, REAL ID turns state DMV workers into federal immigration officials, as they must verify the citizenship status of all those who want a REAL ID-approved state driver's license or identification cards. State DMVs would far move away from their core mission -- to license drivers.
REAL ID was appended to a bill providing tsunami relief and military appropriations, and passed with little debate and no hearings. The REAL ID Act repealed provisions in the Intelligence Reform and Terrorism Prevention Act of 2004, which contained "carefully crafted language -- bipartisan language -- to establish standards for States issuing driver's licenses," according to Sen. Richard Durbin. After more than two years, the Department of Homeland Security issued draft regulations for state compliance on March 1, 2007.
The National Conference of State Legislatures estimates (pdf) that the cost to the states will be more than $11 billion over five years. This is more than 100 times the $100 million cost that Congress initially estimated. For 2006, $40 million was allocated for start-up costs. It is likely that the cost will be shouldered by the public. The Department of Homeland Security originally estimated that REAL ID will cost $23.1 billion over 10 years. But, when the agency released the final rule in January 2008, it made dubious assumptions and claimed that the national ID system would only cost $9.9 billion.
EPIC and 24 experts in privacy and technology submitted detailed comments (pdf) in May 2007 on the draft regulations explaining the many privacy and security threats raised by the REAL ID Act. The fundamentally flawed national identification system is unworkable and the REAL ID Act must be repealed. In particular, the group admonishes DHS for its failure to include adequate privacy and security safeguards for this massive national identification database. DHS's own Data Privacy and Integrity Advisory Committee has refused (pdf) to endorse the agency's plan. "The Committee feels it is important that the following comments do not constitute an endorsement of REAL ID or the regulations as workable or appropriate."
DHS's Final Rule to Implement REAL ID
Department of Homeland Security Secretary Michael Chertoff released the agency's final regulations for REAL ID on January 11, 2008. The Secretary scaled back some of the requirements, reduced the cost, and extended the deadline for state compliance. However, Secretary Chertoff also indicated that the REAL ID card would be used for a wide variety of purposes, unrelated to the law that authorized the system, including employment verification and immigration determination. He also indicated that the agency would not prevent the use of the card by private parties for non-government purposes. As part of the cost-saving effort, Homeland Security has decided not to encrypt the data that will be stored on the card.
In an opinion column written by Secretary Chertoff after the publication of the final rule, he said, "embracing REAL ID" would mean it would be used to "cash a check, hire a baby sitter, board a plane or engage in countless other activities." This is a description of a national identification system, which is illegal in the United States. When it created the Department of Homeland Security, Congress made clear in the enabling legislation that the agency could not create a national ID system. In September 2004, then-DHS Secretary Tom Ridge reiterated, "[t]he legislation that created the Department of Homeland Security was very specific on the question of a national ID card. They said there will be no national ID card."
EPIC Analysis of Final Rule to Implement REAL ID
In a detailed analysis (pdf) of the final rule, EPIC explained that the Department of Homeland Security's REAL ID system includes few protections for individual privacy and security in its massive national identification database. It harms national security by creating yet another "trusted" credential for criminals to exploit. The Department of Homeland Security has faced so many obstacles with the REAL ID system that the agency now plans an implementation deadline of 2017 -- nine years later than the 2008 statutory deadline. It is an unfunded mandate that would cost billions, with the burden ultimately being placed on the individual taxpayer.
Technical experts familiar with the challenges of privacy protection and identification presented the Department of Homeland Security with a variety of recommendations that would have minimized the risks of the REAL ID system. The DHS made some modifications, but left the essential system in place. As REAL ID currently stands, the costs are many and the benefits are few. EPIC also detailed the State rebellion against REAL ID.
EPIC urged the alternative model of a system of decentralized identification. This reduces the risks associated with security breaches and the misuse of personal information. Technological innovation can enable the development of context-dependent identifiers. A decentralized approach to identification is consistent with our commonsense understanding of identification. If you are banking, you should have a bank account number. If go to the library, you should have a library card number. If you rent videos from a store, you should have a video rental store card number. Utility bills, telephone bills, insurance, the list goes on. These context-dependent usernames and passwords enable authentication without the risk of a universal identification system. That way, if one number is compromised, all of the numbers are not spoiled and identity thieves cannot access all of your accounts. All of your accounts can become compartmentalized, enhancing their security. View the full report: Marc Rotenberg & Melissa Ngo, EPIC, REAL ID Implementation Review: Few Benefits, Staggering Costs (pdf) (May 2008).
