Electronic Privacy Information Center  

National ID Cards and REAL ID Act

History | REAL ID Act | News Items | Resources | Reports | State Legislation Rejecting REAL ID | Previous Top News

View EPIC's Press Release: Homeland Security Department Announces
Deeply Flawed Regulations For National ID System (January 11, 2008)

Coming Soon: EPIC's Analysis of REAL ID Final Rule

View EPIC Comments on REAL ID Draft Regulations (May 8, 2007)

RECENT CAMPAIGN



Stop REAL ID: Reject National Identification

Latest News/Events

History of National Identification Cards

National ID cards have long been advocated as a means to enhance national security, unmask potential terrorists, and guard against illegal immigrants. They are in use in many countries around the world including most European countries, Hong Kong, Malaysia, Singapore and Thailand. Currently, the United States and the United Kingdom have continued to debate the merits of adopting national ID cards. The types of card, their functions, and privacy safeguards vary widely.

Americans have rejected the idea of a national ID card. When the Social Security Number (SSN) was created in 1936, it was meant to be used only as an account number associated with the administration of the Social Security system. Though use of the SSN has expanded considerably, it is not a universal identifier and efforts to make it one have been consistently rejected. In 1971, the Social Security Administration task force on the SSN rejected the extension of the Social Security Number to the status of an ID card. In 1973, the Health, Education and Welfare Secretary's Advisory Committee on Automated Personal Data Systems concluded that a national identifier was not desirable. In 1976, the Federal Advisory Committee on False Identification rejected the idea of an identifier.

In 1977, the Carter Administration reiterated that the SSN was not to become an identifier, and in 1981 the Reagan Administration stated that it was "explicitly opposed" to the creation of a national ID card. The Clinton administration advocated a "Health Security Card" in 1993 and assured the public that the card, issued to every American, would have "full protection for privacy and confidentiality." Still, the idea was rejected and the health security card was never created. In 1999 Congress repealed a controversial provision in the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 which gave authorization to include Social Security Numbers on driver's licenses.

In response to the tragic events of Sept. 11, 2001, there has been renewed interest in the creation of national ID cards. Soon after the attacks, Larry Ellison, head of California-based software company Oracle Corporation, called for the development of a national identification system and offered to donate the technology to make this possible. He proposed ID cards with embedded digitized thumbprints and photographs of all legal residents in the U.S. There was much public debate about the issue, and Congressional hearings were held. Former House Speaker Newt Gingrich testified that he "would not institute a national ID card because you do get into civil liberties issues." When it created the Department of Homeland Security, Congress made clear in the enabling legislation that the agency could not create a national ID system. In September 2004, then-DHS Secretary Tom Ridge reiterated, "[t]he legislation that created the Department of Homeland Security was very specific on the question of a national ID card. They said there will be no national ID card."

The public continues to debate the issue, and there have been many other proposals for the creation of a national identification system, some through the standardization of state driver's licenses. The debate remains in the international spotlight -- several nations are considering implementing such systems. The U.S. Congress has passed the REAL ID Act of 2005, which mandates federal requirements for driver's licenses. Critics argue that it would make driver's licenses into de facto national IDs. EPIC and others have called for the repeal of this ill-conceived national identification law.

The REAL ID Act of 2005

Summary

The REAL ID Act of 2005 creates a de facto national identification card. Ostensibly voluntary, it would become mandatory as those without the card would face suspicion and increased scrutiny. It is a law imposing federal technological standards and verification procedures on state driver's licenses and identification cards, many of which are beyond the current capacity of the federal government, and mandating state compliance by May 2008. In fact, REAL ID turns state DMV workers into federal immigration officials, as they must verify the citizenship status of all those who want a REAL ID-approved state driver's license or identification cards. State DMVs would far move away from their core mission -- to license drivers.

REAL ID was appended to a bill providing tsunami relief and military appropriations, and passed with little debate and no hearings. The REAL ID Act repealed provisions in the Intelligence Reform and Terrorism Prevention Act of 2004, which contained "carefully crafted language -- bipartisan language -- to establish standards for States issuing driver's licenses," according to Sen. Richard Durbin. After more than two years, the Department of Homeland Security issued draft regulations for state compliance on March 1, 2007.

The National Conference of State Legislatures estimates (pdf) that that the cost to the states will be more than $11 billion over five years. This is more than 100 times the $100 million cost that Congress initially estimated. For 2006, $40 million was allocated for start-up costs. No more funding has been allocated, and it is likely that the cost will be shouldered by the public. The Department of Homeland Security has estimated that REAL ID will cost $23.1 billion over 10 years.

EPIC and 24 experts in privacy and technology have submitted detailed comments (pdf) explaining the many privacy and security threats raised by the REAL ID Act. The fundamentally flawed national identification system is unworkable and the REAL ID Act must be repealed. In particular, the group admonishes DHS for its failure to include adequate privacy and security safeguards for this massive national identification database. DHS's own Data Privacy and Integrity Advisory Committee has refused (pdf) to endorse the agency's plan. "The Committee feels it is important that the following comments do not constitute an endorsement of REAL ID or the regulations as workable or appropriate."

How will the REAL ID Act affect state driver's licenses and identification cards (DL/ID)?

If the Department of Homeland Security Secretary doesn't grant a state an extension to meet the certification requirements, then by May 11, 2008 (three years after passage of the REAL ID Act), states must meet the following standards to be accepted for federal use (entrance into a courthouse, onto a plane; receiving federal benefits, such as Social Security or Medicare). After more than two years, the Department of Homeland Security issued draft regulations on March 1, 2007, explaining how the states can meet these standards. The EPIC analysis of the potential privacy and security implications follows the enumeration of the each set of standards.

The Department of Homeland Security draft regulations would (1) impose more difficult standards for acceptable identification documents that could limit the ability of individuals to get a state drivers license; (2) compel data verification procedures that the Federal government itself is not capable of following; (3) mandate minimum data elements required on the face of and in the machine readable zone of the card; (4) require changes to the design of licenses and identification cards (5) expand schedules and procedures for retention and distribution of identification documents and other personal data; and (6) dictate security standards for the card, state motor vehicle facilities, and the personal data and documents collected in state motor vehicle databases. These regulations create a de facto national identification system.

Minimum document requirements, §202(b):

"To meet the requirements of this section, a State shall include, at a minimum, the following information and features on each driver's license and identification card issued to a person by the State:

      (1) The person's full legal name.

      (2) The person's date of birth.

      (3) The person's gender.

      (4) The person's driver's license or identification card number.

      (5) A digital photograph of the person.

      (6) The person's address of principle residence.

      (7) The person's signature.

      (8) Physical security features designed to prevent tampering, counterfeiting, or duplication of the document for fraudulent purposes.

      (9) A common machine-readable technology, with defined minimum data elements."

EPIC analysis:

The residential address requirements set out in the draft regulations endanger the ability of victims of domestic violence, sexual assault, and other crimes to hide from their abusers. Currently, many States allow domestic violence victims and others to protect the confidentiality of their residential addresses. States have created formal Address Confidentiality Programs and States have also provided general measures of residential address privacy. The proposed regulations override these substantial protections, and the overrides must be removed from the final regulations. The government must not make it easier for abusers to find their victims. For more information, see EPIC's REAL ID and Domestic Violence page.

Under the draft regulations, the REAL ID card would include a 2D barcode as its machine readable technology. To protect privacy and improve security, this machine readable technology must either include encryption, which is recommended (pdf) by the DHS Privacy Office, or access must be limited in some other form. Leaving the machine readable zone open would allow unfettered third-party access to the data and leave 245 million license and cardholders nationwide at risk for individual tracking. In its Privacy Impact Assessment of the draft regulations, the Privacy Office supported encryption "because 2D bar code readers are extremely common, the data could be captured from the driver's licenses and identification cards and accessed by unauthorized third parties by simply reading the 2D bar code on the credential" if the data is left unencrypted.

DHS contemplates using the REAL ID system as part of its Federal border security program and requested comments on how States could incorporate long-range radio frequency identification ("RFID") technology into the REAL ID card so that it could be used as part of the Western Hemisphere Travel Initiative. Many groups have urged against the use of RFID technology in identification documents. There are significant privacy and security risks associated with the use of RFID-enabled identification cards, particularly if individuals are not able to control the disclosure of identifying information. The Department of State recognized these security and privacy threats and changed its E-Passport proposal because of them; the Department of Homeland Security has just abandoned a plan to include RFID chips in border identification documents because the pilot test was a failure; and both the Department of Homeland Security's Data Privacy and Integrity Advisory Committee (pdf) and the Government Accountability Office (pdf) recently cautioned against the use of RFID technology in identification documents.

This wireless technology has significant security risks, including those of surreptitious gathering of personal data by unauthorized individuals and clandestine tracking of cardholders. EPIC has consistently recommended the use of contact technology, such as the stripes on the backs of credit cards, in identification documents. Contact cards are more secure; they do not contain the risk of data theft through wireless transmission and allow cardholders to have control over who sees their data. See EPIC's RFID page for more information on the dangers of using RFID in identification documents.

Minimum driver's license and identification card issuance standards, general, §202(c)(1):

"(1) In general. -- To meet the requirements of this section, a State shall require, at a minimum, presentation and verification of the following information before issuing a driver's license or identification card to a person:

      (A) A photo identity document, except that a non-photo identity document is acceptable if it includes both the person's full legal name and date of birth.

      (B) Documentation showing the person's date of birth.

      (C) Proof of the person's social security account number or verification that the person is not eligible for a social security account number.

      (D) Documentation showing the person's name and address of principal residence."

Minimum driver's license and identification card issuance standards, special requirements §202(c)(2):

"(2) Special requirements. --

      (A) In general. -- To meet the requirements of this section, a State shall comply with the minimum standards of this paragraph.

      (B) Evidence of lawful status. -- A State shall require, before issuing a driver's license or identification card to a person, valid documentary evidence that the person --

              (i) is a citizen or national of the United States;

              (ii) is an alien lawfully admitted for permanent or temporary residence in the United  States;

              (iii) has conditional permanent resident status in the United States;

              (iv) has an approved application for asylum in the United States or has entered into the United States in refugee status;

              (v) has a valid, unexpired nonimmigrant visa or nonimmigrant visa status for entry into the United States;

              (vi) has a pending application for asylum in the United States;  

              (vii) has a pending or approved application for temporary protected status in the United States;

              (viii) has approved deferred action status; or

              (ix) has a pending application for adjustment of status to that of an alien lawfully admitted for permanent residence in the United States or conditional permanent resident status in the United States."

Verification of documents, §202(c)(3):

"(3) Verification of documents. -- To meet the requirements of this section, a State shall implement the following procedures:

      (A) Before issuing a driver's license or identification card to a person, the State shall verify, with the issuing agency, the issuance, validity, and completeness of each document required to be presented by the person under paragraph (1) or (2).

      (B) The State shall not accept any foreign document, other than an official passport, to satisfy a requirement of paragraph (1) or (2).

      (C) <<NOTE: Deadline. Memorandum.>> Not later than September 11, 2005, the State shall enter into a  memorandum of understanding with the Secretary of Homeland Security to routinely utilize the automated system known as Systematic Alien Verification for Entitlements, as provided for by section 404 of the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 (110 Stat. 3009-664), to verify the legal presence status of a person, other than a United States citizen, applying for a driver's license or identification card.

EPIC analysis:

The data verification procedures mandated by the draft regulations are based on faulty premises: DHS relies on non-existing, unavailable or incomplete databases and the mistaken belief that DMV workers can or should be turned into Federal immigration officers. Each assumption creates more problems in the Department of Homeland Security's attempt to create a fundamentally flawed national identification system. Under REAL ID, the states must verify applicant documents and data with the issuing agency. DHS states that, "[f]or individual States to verify information and documentation provided by applicants, each State must have electronic access to multiple databases and systems . . . . Secure and timely access to trusted data sources is a prerequisite for effective verification of applicant data." Yet, beyond the national identification system created by the State-to-State data exchange, two of four verification systems required are not available on a nationwide basis and third does not even exist. The State Department system to verify passports and some reports of births has not even been created, but DHS bases its mandates on the assumption that the system "is eventually developed."

Under the regulations, State DMV employees would need to authenticate license and identification card applicants' source documents, which means the employees would be required to physically inspect the documents and "verify[] that the source document presented under these regulations is genuine and has not been altered." State DMV employees would be required to verify these documents (listed above), including Federal immigration documents, though they have no training to do so. DHS contemplates this problem and seeks to solve it by requiring that DMV employees handling source documents undergo 12 hours of "fraudulent document recognition" training. A review of the Social Security Administration found that staff had difficulty recognizing counterfeit documents, though it is their primary job to verify these documents before issuing SSN. For example, the Government Accountability Office review (pdf) reported difficulty with detection of fraudulent birth certificates. In one case, a fake in-state birth certificate was detected, but "SSA staff acknowledged that if a counterfeit out-of-state birth certificate had been used, SSA would likely have issued the SSN because of staff unfamiliarity with the specific features of numerous state birth certificates." It is questionable how well State DMV employees would be able to spot fraudulent documents, especially documents as rarely seen as consular reports of birth abroad, with merely 12 hours of training when it is difficult for counterfeit documents to be spotted by federal employees whose primary job is verification of source documents. Also, if a State DMV employee determines that an applicant's source documents are fraudulent, where could the applicant turn? No redress procedure has been created.

Other requirements, §202(d):

"(d) Other Requirements. -- To meet the requirements of this section, a State shall adopt the following practices in the issuance of drivers' licenses and identification cards:

(1) Employ technology to capture digital images of identity source documents so that the images can be retained in electronic storage in a transferable format.

(2) Retain paper copies of source documents for a minimum of 7 years or images of source documents presented for a minimum of 10 years.

(3) Subject each person applying for a driver's license or identification card to mandatory facial image capture.

(4) Establish an effective procedure to confirm or verify a renewing applicant's information.

(5) Confirm with the Social Security Administration a social security account number presented by a person using the full social security account number. In the event that a social security account number is already registered to or associated with another person to which any State has issued a driver's license or identification card, the State shall resolve the discrepancy and take appropriate action.

(6) Refuse to issue a driver's license or identification card to a person holding a driver's license issued by another State without confirmation that the person is terminating or has terminated the driver's license.

(7) Ensure the physical security of locations where drivers' licenses and identification cards are produced and the security of document materials and papers from which drivers' licenses and identification cards are produced.

(8) Subject all persons authorized to manufacture or produce drivers' licenses and identification card security clearance requirements.

(9) Establish fraudulent document recognition training programs for appropriate employees engaged in the issuance of drivers' licenses and identification cards.

(10) Limit the period of validity of all driver's licenses and identification cards that are not temporary to a period that does not exceed 8 years.

(11) In any case in which the State issues a driver's license or identification card that does not satisfy the requirements of this section, ensure that such license or identification card --

      (A) clearly states on its face that it may not be accepted by any Federal agency for federal identification or any other official purpose; and

      (B) uses a unique design or color indicator to alert Federal agency and other law enforcement personnel that it may not be accepted for any such purpose.

(12) Provide electronic access to all other States to information contained in the motor vehicle database of the State.

(13) Maintain a State motor vehicle database that contains, at a minimum -

      (A) all data fields printed on drivers' licenses and identification cards issued by the State; and

      (B) motor vehicle drivers' histories, including motor vehicle violations, suspensions, and points on licenses."

EPIC analysis:

Under REAL ID, the government would have easy access to an incredible amount of personal data stored in one national database (or, according to the DHS description, 56 State and Territory databases, each of which can access all of the others). The agency makes two claims about the expanded data retention under REAL ID that we dispute: (1) "Most States already include this [extensive, personal] information in a machine readable technology," and (2) "neither the Real ID Act nor these proposed regulations gives the Federal Government any greater access to information than it had before." Each claim is false: DHS is mandating the increase of both the type of documents that need to be retained and the length of data retention, and the agency will give both State and Federal governments greater access to the personal data.

With the REAL ID national identification system, DHS imposes new requirements on State motor vehicle agencies. Each of the 56 interconnected databases must contain all data fields printed on driver's licenses and ID cards, and driver's histories, including motor vehicle violations, suspensions, and points on licenses. The States are compelled to begin maintaining paper copies or digital images of important identity documents, such as birth certificates or naturalized citizenship papers, for seven to 10 years. This is a significant expansion of the personal data previously reviewed or stored by State motor vehicle agencies.

Currently these identification documents are kept in a variety of places -- the Social Security system, the immigration system, local courthouses -- and it takes considerable effort to gather them all together. Under REAL ID, all of these identification documents -- concerning, among other things, births, marriages, deaths, immigration, social services -- are consolidated into one national database, accessible to at least tens of thousands of government employees nationwide, which would give the Federal and State governments greater access than before.

Security expert Bruce Schneier, EPIC and others have explained that it decreases security to have one ID card for many purposes, as there will be a substantial amount of harm when the card is compromised. There is also the threat that REAL ID is ostensibly trying to protect against: forged identification cards. Investing so much trust into one card means that criminals will only have to forge one identification card. "No matter how unforgeable we make it, it will be forged. We can raise the price of forgery, but we can't make it impossible. Real IDs will be forged," Schneier said. A national database full of identification documents, images and data would entice many kinds of criminals, including terrorists who seek to steal the identity of a "trusted" individual.

A national identification system would divide the United States into two groups: (1) "trusted good guys" who have the national ID card, and (2) "untrusted bad guys" who do not. But, Schneier has pointed out that there is a third category that appears -- bad guys who fit the good guy profile. Upon the release of the draft regulations, Schneier said, "The REAL ID regulations do not solve problems of the national ID card, which will fail when used by someone intent on subverting that system. Evildoers will be able steal the identity -- and profile -- of an honest person, doing an end-run around the REAL ID system." This national identification system inherently contains significant threats to individual privacy and national security.

The 56 State and Territory databases would become on large database under REAL ID. And one presumes that each DMV would have access to these databases at the very least to confirm that the applicant does not have a REAL ID license or ID card in another state. If a criminal could break the security of any one of the tens of thousands of entrance points, then the criminal would have access to the personal data, including Social Security numbers, of every single person in the United State with a REAL ID license or ID card. This would put hundreds of millions of people at risk for identity theft.

The Department of Homeland Security contemplates a universal design for compliant and non-compliant REAL ID cards. A universal design, especially for a card including citizenship status, would cause irreparable harm, as it would foster suspicion of those who do not wish to carry the REAL ID card. Uniform design for a national identification card would also create an enormous security risk.

The agency is considering a uniform REAL ID card design, asking for comments on "[w]hether DHS should standardize the unique design or color required for non-REAL ID under the REAL ID Act for ease of nationwide recognition, and whether DHS should also implement a standardized design or color for REAL ID licenses." Mandating distinct designs or colors for both REAL ID and regular licenses and identification cards and requiring non-REAL ID driver's licenses or ID cards to have explicit "invalid for federal purposes" designations turns this "voluntary" card into a mandatory national ID card. It would divide the country into two -- people with the REAL ID card and those without -- and anyone with a different license or ID card would be instantly suspicious. Significant delay, complication and possibly harassment or discrimination would fall upon those who choose not to carry a REAL ID card.

In the agency's economic analysis (pdf) of the draft regulations, reducing ID theft is listed as one of the potential ancillary benefits of the national identification system. However, the agency says that the potential benefit would depend on a vast expansion of REAL ID uses from the three official purposes required in the draft regulations; DHS suggests what is needed is "incidental and required use of REAL ID documents in everyday transactions." DHS envisions that employers, social service agencies (including Medicare, Medicaid and student financial aid), firearm sellers and licensors, and election workers will all use this national identification system. The official and unofficial uses of REAL ID must not be broadened. Such expansion would harm national security. Using a single card for many identification purposes would be the same as using one key for every lock. Using a single national ID card is a foolish, ineffective, and easily circumvented attempt at security.

News Items