Real ID: States chase moving target

Real ID, a federal law intended to give states a minimum standard for issuing driver’s licences and identity cards, was supposed to be technology’s answer to the political hot potato known as the national identity card.

But technology, like politics, contains its own conflicts and cross purposes. Ongoing uncertainties surrounding the four-year-old Real ID Act are making it hard for many states to reach the law’s goal of launching new technologies by the end of 2009 to secure driver's licenses against fraud and terrorist activities.

In North Dakota, for instance, the state's Department of Transportation has twice lobbied the legislature for funding to replace a 35-year-old mainframe-based system with a modern license-issuing application, which some estimates peg at $12 million.

“When DOT requested the funds two years ago, the legislators held it up because they said we don’t know what the final Real ID guidelines would be,” said Lisa Feldner, North Dakota's chief information officer. Her department manages the existing system.

The modernization effort didn't fare any better in this year’s session, for much the same reason. “They said, 'The mainframe isn’t going to die, so we're not going to fund the new system at this time. But we promise that next session we will fund it, when you have guidelines,'” she said.

The North Dakota legislature meets only once every two years, which means the state will be at least two years behind the law’s target implementation date. And there's no guarantee that lawmakers there — or anywhere else, for that matter — will be comfortable writing checks for Real ID anytime soon, especially in light of a U.S. Senate proposal last month that would scale back the controversial program — and change requirements yet again.

“Just trying to keep the ball rolling on commitments to education, health and transportation is a challenge far exceeding the attention that Real ID is going to get” during the economic downturn, said Michael Bird, senior federal affairs counsel at the National Conference of State Legislatures (NCSL), a research organization for state policy-makers.

Now with states facing historic budget shortfalls, officials believe they cannot risk implementation mistakes caused by shifting guidelines, even with Real ID deadlines set for the end of this year.

Officials know they are in a bind. States must apply for an extension of the year-end Real ID deadline by Oct. 11 and make progress on 18 milestones that the Homeland Security Department has set — or their residents might have trouble conducting official business with federal agencies or traveling beyond U.S. borders.

The cost of compliance

Creating more secure identity documents has been a federal objective since the 2001 terrorist attacks. Given the objections posed by both conservatives and liberals against a national identity card, Real ID was intended to be the next best thing. However, its success depends on the cooperation of the states, each of which maintains its own driver’s license program.

The lack of strong direction — and federal funding — for Real ID has left the program in perpetual limbo.

Early estimates put the Real ID price tag for U.S. states and territories at more than $11 billion over five years, which prompted DHS to extend the deadline for full enrollment to 2017. But the investments for states remain significant, if still unknown.

“Until we know what the actual requirements will be and have some certainty as to an implementation date, an accurate cost assessment is not possible,” said Patrick Fernan, operations manager at the Wisconsin Division of Motor Vehicles.

The uncertainty grew when the Obama administration chose Janet Napolitano to be homeland security secretary. As governor of Arizona, she was an outspoken critic of the act, calling it an unfunded mandate by the federal government. Arizona is among 20 states that have adopted legislation barring compliance with the act, according to NCSL.

As DHS secretary, Napolitano has voiced her support for the Real ID replacement program introduced last month in the Senate. The Providing for Additional Security in States' Identification (PASS ID) Act would be “a cost-effective, common-sense solution that balances critical security requirements with the input and practical needs of state governments,” she said.

State officials contacted for this story declined to comment on the new legislation, saying they haven’t had sufficient time to study it. But they might soon find themselves forced to devise strategies flexible enough to accommodate two possible approaches with fundamental philosophical differences, said Chris Dixon, manager of state and local industry analysis at market research firm Input.

What officials are wondering now is whether the new requirements will call for an identity verification or an identity validation process, Dixon said.

Verification requires states to determine the legitimacy of license applicants’ identity documents. Validation means states merely request documents to confirm identities but don't investigate their authenticity.

Real ID calls for a verification approach in which states would create and share databases and use an electronic system to verify certain official records and whether applicants are already licensed by other states. However, many of those electronic systems still do not exist. In addition, some federal databases require states to pay a fee for each transaction, Bird said.

“Real ID was moving down the verification path, and the early scuttlebutt is that PASS ID will move more down the document validation path,” Dixon said.

Moving forward

Lingering questions about the federal program have left some states walking a fine line between compliance and avoiding investments that could prove wasteful if security mandates continue to change.

“There are things in Real ID that states have been trying to do for years to improve the process and make it more secure,” said David Beary, senior systems analyst at the Iowa Department of Transportation. “Those are the things that we’ve been trying to work toward without waiting on Real ID. It’s a matter of [designing] your system so that, with minor adjustments, you could make it fit into everything that gets legislated.”

Some states have chosen to embrace the spirit but not the letter of the Real ID Act. For example, Iowa, Vermont and others have hardened security by centralizing the issuing of licenses. Local DMV offices in those states collect paperwork, take photos and conduct driving tests, but they don’t issue driver's licenses.

“The process is exactly the same except you don't walk out with the hard plastic,” said Barbara West, field manager at the Iowa Office of Driver’s Services. “You walk out with a temporary driver’s license, and your actual license is mailed to you.” She expects Iowa to meet this year’s Real ID milestones and request an extension beyond the end of the year for achieving full compliance.

Centralization increases security by protecting license materials from theft and forgery at multiple local offices.

“Consistent processing and security help keep card stock from going out the back door to a counterfeiting operation,” Dixon said.

Digital photography — now a standard feature at many licensing facilities — allows states to more easily manage and analyze images for possible fraud. Some states, including Wisconsin and Iowa, have added facial-recognition software to compare newly captured digital head shots against databases of existing photos to flag applicants who use false names.

States are also shooting digital photos at the start of the licensing process as an added tool for stopping fraud, said Michael Charter, a DMV project specialist for Vermont, which is also trying to qualify for a Real ID extension.

If the applicant is denied a license or quits before completing the process, law enforcement officials have a photo to scan for follow-up facial-recognition screening, he said.

“In states where the picture is taken later in the process, you may have a situation where the applicant becomes nervous about being caught and decides to flee,” Charter said. “In that case, you have the application with presumably fictitious information and no photo to help apprehend the applicant.”

Other measures

Some states are moving to toughen the security of driver's licenses by meeting the Western Hemisphere Travel Initiative's standards for enhanced driver's licenses (EDLs). The initiative is a result of the Intelligence Reform and Terrorism Prevention Act of 2004, which requires travelers to present a passport or other document, such as an EDL, that denotes identity and citizenship when entering the United States.

EDLs require background checks of applicants and certain DMV employees and the addition of tamper-resistant capabilities. They also use embedded radio frequency identification chips to help border authorities quickly verify cardholders’ identities as they cross international boundaries.

RFID goes beyond the latest Real ID mandates, and some privacy advocates have objected to the sensors because unauthorized people could potentially scan private information from cards. But EDL issuers said RFID’s threats to privacy are minimal.

“The RFID technology does not contain any personal information — only a unique number that allows border officials to retrieve information off their system,” said Kelly Chesney, communications director at the Michigan Department of State. Michigan is one of a handful of states that offer EDLs.

Vermont, which began offering EDLs this spring, had to upgrade its licensing application with new hardware and software that came primarily from the company that supplied its existing licensing application.

“Vermont is in the final stages of an overall upgrade to all internal systems,” Charter said. “Had that not already been in progress, it is likely we would have required far more upgrades in order to issue the EDL.”

Because EDLs are produced off-site and mailed to customers, Vermont had to install a new secure network connection to the card-producing facility and one to DHS for the identity checks required for EDLs.

Charter said the state will eventually link to the new federal Electronic Verification of Vital Events system to verify birth certificates with issuing agencies nationwide. And Vermont's EDLs will evolve into Real ID compliance, he added.

But some states are hitting roadblocks with the new licenses. Canada’s Manitoba province has pressured North Dakota officials to implement EDLs to save citizens on both sides of the border the expense of obtaining passports. And even though EDL guidelines are clearer than those for Real ID and might dovetail with the final rulings, funding problems have stalled the effort.

“That ended up in the same place as the replacement driver’s license system,” Feldner said.

States are also balking at investing significant sums of money to connect with central databases for interstate verification of identity documents or performing background checks against federal anti-terrorism watch lists, as mandated by Real ID, Dixon said.

“On the technology side, there’s always that worry that five years down the road, when the [federal government] finally does decide to roll out the databases, the processes you implemented aren’t going to work,” he said. “So they are basically doing the veneer of compliance now and waiting for the [federal government] to build the infrastructure behind it. And that’s a scary position for the states to be in.”