By Andy Williams, Contributing Editor
Operating under a “hurry up and wait” scenario, states have been scrambling since last year to determine how they’re going to comply with the Real ID Act passed in May 2005. The act is broad enough that states aren’t really sure what will be required of them to make their driver licenses and ID cards Real ID Act-compliant. But if their residents don’t have such licenses, they could be denied entry to federal facilities and commercial aircraft.
The act gave states until May 11, 2008 to comply. But comply with what? A year has passed since the act’s adoption and the overseeing federal agency, the Department of Homeland Security, has yet to develop rules that would spell out those compliance measures. For example, what kind of ID card will be required? Will it have to have an RFID chip? And, most importantly, when will the rules for complying with Real ID even be issued?
According to Jarrod Agen, DHS spokesman, the first draft of the regulations won’t even be published in the Federal Register until the second half of 2006. Then, there must follow public hearings and public input, so final rules aren’t likely until early next year, he added. That would give states just a little more than a year to meet the guidelines.
In April, the National Governors Association (NGA), the National Conference of State Legislatures (NCSL) and the American Association of Motor Vehicle Administrators (AAMVA) sent a five-page document to DHS pointing out their Real ID Act concerns.
Around the same time, the Document Security Alliance (DSA), a public/private partnership of government agencies and private industry created to improve the security of critical documents, provided its own set of Real ID recommendations to DHS. Those suggestions covered the archiving of applicant data, card materials, DMV security, machine-readable features, and database cross-checking.
The DSA suggestions addressed some of the same issues mentioned by AAMVA, governors, and state legislators, who, in a prepared statement, said that the Real ID Act, “in its current form will have a wide-reaching impact on citizens and states” and called for “reasonable and workable regulations to implement the objectives of Real ID.”
Drilling down to “the three-foot level”
Jason King, spokesman for AAMVA, probably put it best: “We’re kind of at the 30,000-foot level right now. We need to drill down to the three-foot level.”
That’s an awful lot of drilling and, even if the specifications were in place today, not a lot of time in which to do it.
As to each state’s cost to comply, estimates have varied dramatically. “It is very difficult to do an accurate cost analysis before we have any feedback from DHS,” said Mr. King.
California Governor Arnold Schwarzenegger, in his proposed budget released in mid-May, asked for $18.8 million “to begin the planning and programming necessary” to implement Real ID requirements. A press release from his office said the act would “require 24 million licensed drivers and identification card holders … to return to the state Department of Motor Vehicles offices to establish identity and obtain compliant cards … It will have significant workload and cost implications.”
At least one state tried to pass a law earlier this year rejecting the Real ID Act. The New Hampshire House passed the bill but it was narrowly defeated in the Senate. Regardless, it hints to the frustration regarding what many states consider an unfunded mandate.
Said Mr. King: “AAMVA, as an association representing the technical experts, have reached out to DHS. We’re still hoping for a workable and fully-funded solution.”
One of the changes AAMVA members would like to see is a time extension, but he admits that would probably take an amendment to the law, something only Congress can accomplish.
He said the three organizations – AAMVA, state legislatures, and governors – have informed DHS “of the impact at the state level of meeting the deadlines. We’re hopeful DHS will take our recommendations and consider funding and timeline extensions.”
But he also doesn’t want Congress to think AAMVA members will deliberately balk at enforcing the new law. “As the technical experts in driver licensing, we are committed to doing the best we can at meeting the guidelines as set forth in the Real ID Act,” he said.
What do the States fear from Read ID?
The five page document issued by the three groups and submitted to DHS in late April, calls for “reasonable and workable regulations” and outlines specific state concerns with Real ID that include:
- A potential 75% increase annually in visits to motor vehicle agencies.
- The need for additional staff, facilities, training and equipment.
- Only flexible regulations can ensure compliance.
- Even if the regulations were in place now, there still isn’t enough time to implement the requirements as defined by the statute. “The absence of timely regulations, systems and resources will ultimately overwhelm all good intentions,” the document notes.
- Implementation costs will be significant … States are in the process of conducting a fiscal impact survey to accurately define the level of resources needed to meet federal standards.
Another concern … what is meant in the law by “official purpose,” the term for when and where a Real ID-compliant document will be required for admission to federal facilities, commercial aircraft, etc. The law doesn’t define “official purpose” which “could significantly affect the scope of the statute. For example, individuals who do not drive and choose not to obtain an ID card could be prohibited from access to federal buildings, access to post offices, social security offices, or even voting in federal elections depending upon the definition of what constitutes an ‘official purpose.'”
Both the technology and the process raise still-unanswered questions
Then there is the card design and what information it will contain. For example, the organizations note, “a majority of states and the federal government have laws that protect the identity and security of certain classes of individuals, e.g., victims of domestic violence, judges, witness protection, law enforcement personnel. To address these concerns, states recommend minimum card design specifications…”
They also want machine-readable technology requirements to be defined as an unencrypted two-dimensional bar code. States should also be allowed to propose interim methods of tracking address changes without the need to reissue a replacement credential. States need to be able to renew Real ID-compliant licenses and IDs through mail or the Internet. “In addition, an individual should be allowed to change their address during the license validity period without being required to obtain a new credential,” the organizations add in their DHS recommendations.
Another issue is the requirement to capture digital images of ID source documents, such as a birth certificate. This will be “very costly,” the three organizations point out. This requirement could also run afoul of many state record retention laws, so states “must be given sufficient time to change conflicting record retention laws,” the groups recommend.
The DSA recommends “practical and holistic” approach
The DSA, in its recommendations to Homeland Security, one of its members, took what it called a “practical and holistic approach” taking into consideration the legacy systems in operation today at state DMV offices. In the introduction to the recommendations, DSA notes that the regulations “will have a significant impact on our society from a business practice point of view as well as affecting the daily lives of our citizens,” Realizing that “significant improvements must be made in terms of technology, machine-readability, visual security options, ongoing training and ultimately, genesis (breeder) documents. DSA feels strongly that whenever possible the benefits associated with deeply embedded existing systems and infrastructures be incorporated into any redesign … this will help meet the requirements in the time frame set forth in the Act, allowing DHS to develop acceptable standards.”
Reed Stager, Chair of the Government Affairs Committee for DSA and an executive with Digimarc Corporation, said DSA had originally provided a set of recommendations to Congress prior to passage of the Real ID Act. “I can’t say specifically how the framers used the information we provided,” he said.
“As broad a change as may be required, two years is not very long (for compliance),” he added. “Many states may require passage of legislation to make them compliant.”
The DSA approach “has been to identify elements that can improve ID security and methods that can help make states compliant with ID legislation,” said Mr. Stager. These recommendations could help states “implement (the Real ID Act) on a short time frame, and include 2d barcodes; use of the Social Security online database and electronic capture and archiving of breeder documents, those documents people use to establish their identification. We recommend those be captured and archived.”
Regarding 2D barcodes, Mr. Stager said that made sense since “the existing infrastructure of states (45 of them anyway)” already have that technology in place. One of the fears, and what caused a furor earlier this year was that DHS might require a costly RFID chip to be included on driver’s licenses.
“We also recommend enhancements and audits of the physical security offices which are issuing IDs and at the central issuing factories, throughout the supply chain,” said Mr. Stager. “The security features that go on the credentials, the stock (used to make the licenses) and the credentials themselves need to be protected throughout the manufacturing process.”
To access the complete DSA document online, click here.