States move warily on Real ID

Having aired their concerns about cost and policy implications, many state officials now seem resigned to the Real ID Act, which requires states to issue driver’s licenses that conform to new federal standards. Many states are preparing for the new requirements and hiring systems integrators rather than waiting for the Homeland Security Department to release final technical standards.

Nevada’s Department of Motor Vehicles, for example, is investigating facial recognition and various methods for sharing driver’s license information with other states and the federal government, even though it can only go so far without more detailed guidance from DHS, said Tom Jacobs, public information officer at Nevada’s DMV.

“At this point, we have no vision of a complete solution because we still don’t know what Real ID completely is,” Jacobs said.

He added that paying for a program that hasn’t been fully defined is not popular with state leaders. The national price tag for the Real ID program — estimated to be $11 billion — worries state officials, who are expecting DHS to pick up only about 20 percent of the cost in the form of state grants.

“We see cost and technology issues tied for first place,” Jacobs said. “We’re struggling with the lack of money, the lack of time and the lack of flexibility that characterize the Real ID Act as we know it today.”

DHS wants states to act
DHS officials say they are sympathetic to states’ concerns. “The implementation could be burdensome for some states,” said Darrell Williams, DHS’ director of Real ID programs.

In March, DHS extended the original deadline for states to start fielding Real ID programs from 2008 to Dec. 31, 2009. In the meantime, Williams said DHS is doing everything it can to help states comply with the new law, including reviewing a variety of mature technologies that could assist states in complying with the act.

“Although we have yet to determine what the solution might look like, we continue to move forward with that process,” Williams said.

DHS expects to issue final standards directives soon, and those directives must provide solid answers for states, said Erin Kenneally, a member of the National Association of State Chief Information Officers’ Real ID Working Group.

The program’s success will depend on having standard data models to support interoperability among diverse systems in the states, Kenneally said. States could verify data via a federated architecture of independently operated databases without creating a federally managed national database of driver information, she added.

Techniques for collecting and sharing data dominate most Real ID policy discussions, said Peter Laberee, chairman of the Homeland and Premises Security Group at the law firm Fox Rothschild. He said many people are concerned about Real ID’s implications for data privacy and states’ independence.

And the privacy debates aren’t likely to end even if the states develop a federated model for exchanging data, Kenneally said. People have concerns about the new driver’s licenses being used for purposes other than registering and validating drivers’ identities.

“Because of the advantages Real ID cards might have over current driver’s licenses and ID cards, it is likely that Real ID will be used beyond its original purpose,” Kenneally said.

“There is no real reason to believe history won’t repeat itself,” she said. “Witness how the Social Security number has become the de facto national identifier when its original purpose was to track retirement benefits.”

Stick to the basics
Even as Real ID looms, most states are focused on upgrading their DMV systems and are only beginning to think about interoperability with other states, said Gregg Kreizman, research director for security issues at Gartner. “Even if Real ID did not exist, states have a natural requirement to maintain and upgrade systems.”

Many state officials are beginning to fret about the condition of those systems. “The databases running DMV systems are 20 to 30 years old and will not be able to support the Real ID requirements,” said Harold Kocken, manager of BearingPoint’s National Motor Vehicle Group.

Faced with such basic problems, many states are scurrying for immediate fixes. “We see states now looking at easy wins and going for solutions such as document scanning and authentication equipment,” Kocken said.

The hunt for industry partners will accelerate rapidly as more states begin adding the infrastructure and system components they will need for Real ID. They will be looking for help with system replacement or upgrades, managed services, project management, and feasibility studies, he said.

“There was much buzz around whether the card would include biometric or smart-chip technology, but that won’t happen unless DHS changes the rules after reviewing comments,” Kreizman said.

DHS has imposed only minimal requirements for the cards’ physical attributes. Real ID cards must have digital photos and present data in a machine-readable format using an industry-standard, unencrypted 2-D bar code. That type of bar code is easy and inexpensive to use but not data-rich or secure, Laberee said. 

Some states might opt to go beyond the requirements and add encryption, biometrics or radio frequency identification technology. Many experts say DHS has missed an opportunity to push for adoption of those technologies.

“One of the frustrating things about Real ID is that it is not currently requiring improvements to the physical security of the card, even though this would be easy to do and would provide real benefit,” said Paul Kocher, president and chief scientist at Cryptography Research, a data security company.

Ultimately, however, it isn’t the Real ID card standard or even the privacy issues that most concern state officials. It’s the funding, said Janice Kephart, president of consulting firm 9/11 Security Solutions.

“While the cost for a Real ID driver’s license in the next 10 years will be about $20 per person, over the short haul there will be significant expenditures,” she said. “The states can’t and shouldn’t have to do all that heavy financial lifting themselves.”

McAdams is a freelance writer based in Vienna, Va.