The false promise of Real ID

Thanks to the efforts of the federal government, it may soon be quite a bit harder to forge a driver’s license. But that doesn’t necessarily mean we’ll be any less vulnerable to terrorist attacks, particularly not the kind carried out on Sept. 11, 2001.

Earlier this month, the Bush administration issued its final rules for implementing the Real ID Act, a controversial provision of an emergency spending bill that Congress passed three years ago. Real ID required states to develop a new generation of driver’s license with anti-counterfeiting technology. The license could be issued only to citizens and legal residents with a birth certificate or some other verifiable proof of identity and address. The law also required the federal government to develop a system that states could use to prevent people from obtaining multiple licenses, or to prevent multiple people from obtaining licenses based on the same documents.

The rules by the Department of Homeland Security answered complaints by several states and consumer advocates about the projected cost of the program. An earlier version of the rules would have cost an estimated $14.6 billion to $23 billion, or roughly $40 to $50 per license, largely because states would have been compelled to issue new licenses quickly to tens of millions of drivers. The new approach does not require new licenses to be issued until Dec. 1, 2014, and then only for drivers younger than 50. Older drivers won’t have to obtain Real ID-compliant, counterfeit-resistant licenses for three additional years. In the interim, states would be required merely to upgrade their procedures for issuing licenses to deter people — in particular, illegal immigrants — from obtaining licenses under fake names or addresses. The delay is projected to cut the estimated cost to $3.9 billion, or $8 to $10 per license.

Still, critics of the rules say the changes haven’t, and can’t, fix the underlying flaws in the measure. The biggest of those flaws is the tenuous link between identity verification and security. As security expert Bruce Schneier told the Senate Judiciary Committee last year, “A reliance on ID cards is based on a dangerous security myth: the idea that if only we knew who everyone was, we could pick the bad guys out of the crowd.” Even if you could be absolutely sure that the ID card correctly identified the person carrying it, that’s no guarantee that said person hasn’t been recruited to a new life of terrorism or crime. (Schneier points to Timothy McVeigh and the subway bombers in London as examples of those whose records would not have betrayed their intentions.) A perfectly effective identification program merely shifts who the terrorists choose to carry out an attack.

Of course, the chance of creating a perfectly effective ID program is precious close to nil. The Real ID program shifts the point of vulnerability from the license itself to the documents that support it and the people involved in their issuance. The law tries to address these issues by requiring states and the federal government to develop an electronic system that Department of Motor Vehicles staff can use to verify the birth certificates, passports and Social Security numbers cited by applicants. It also would require DMV employees to undergo background checks. Still, by making the new licenses more expensive to produce and harder to forge, the law also makes credible fakes more valuable — and raises the incentive for forgers to make them. Significantly increasing the price of a fake driver’s license could very well lead to fewer alcohol sales to underage buyers. It might also reduce the number of illegal immigrants with U.S. licenses, making it that much harder for them to obtain jobs at trucking firms. But state laws already have prevented many illegal immigrants from obtaining licenses, which hasn’t taken them off the roads or stopped them from finding work.

Another fundamental flaw with the Real ID approach is that it could have the perverse effect of making personal information more vulnerable to theft and misuse. Responding to comments on its initial proposal, the Department of Homeland Security took at least two steps in the right direction on this issue. It did not require an RFID chip in the licenses, eliminating a risk of the information on the license being captured wirelessly without the owner’s knowledge. And it does not plan to create a central database of license information, which would be well-nigh irresistible to hackers and identity thieves. Instead, it will try to set up a decentralized system that states could use to check each others’ databases of licenses, birth certificates and other information.

Still, as with many states’ current licenses, the new generation must include the owner’s full name and verified address within a standardized bar code. Homeland Security Secretary Michael Chertoff defended the decision not to encrypt that data, saying there was no point in doing so when the same information could be gleaned just by reading the front of the license. But , an attorney with the Center for Democracy and Technology, said the bar code makes it a snap for businesses to create databases on the people passing through their doors. “When information is digitized, it’s so much easier to collect, store and share,” she said.

What’s worse, a supposedly authenticated identification card would almost certainly become the foundation for others to build their databases around. The new “secure” driver’s license number would quickly be used to identify its owner for a host of other purposes, such as club membership, employment, library usage, even health and credit information. The goal of the law may be to regulate who gets on commercial aircraft, walks into federal buildings or enters nuclear plants. But the new licenses would invariably ripple out into many other areas where identity matters.

Such centralization only increases the public’s vulnerability to errors and misdeeds. That’s one reason states such as California have barred companies from displaying Social Security numbers on documents, such as health insurance cards. But even California doesn’t bar states from collecting and using Social Security numbers in their databases. The Homeland Security Department recognized this issue in its final rules, but then gave what amounts to an administrative shrug. “The REAL ID Act ... does not provide authority for DHS to issue restrictions on who may or may not use REAL ID cards. DHS can only define those ‘official purposes’ for which a REAL ID credential must be used in lieu of other state-issued drivers’ licenses,” the department said in a summary of the rules. “If cardholders experience specific abuses regarding third-party misuse of these cards, Congress and the states can determine whether and how to address such abuses.” How reassuring.

Rather than restricting the use of Real ID cards, state lawmakers are fomenting a rebellion against the act itself. At least 17 state legislatures have voiced some kind of protest, starting with Maine, which passed a resolution last year refusing to comply with the law and calling on Congress to reverse course. By pushing back the implementation date for the law, the Homeland Security Department has done more than cut the measure’s cost. It’s increased the likelihood that opponents in the states will stop the misguided law from ever going into effect.

Jon Healey is a Times editorial writer; he runs the BitPlayer blog.

Send us your thoughts at [email protected].