About The Blog

Debate at the intersection of business, technology and culture in the world of digital identity, both commercial and government, a blog born from the Digital Identity Forum in London and sponsored by Consult Hyperion

Advertisers

Technorati

  • Add to
Technorati Favorites

License

  • Creative Commons

    Attribution Non-Commercial Share Alike

    This work is licensed under a Creative Commons Attribution - Noncommercial - Share Alike 2.0 UK: England & Wales License.

    Please note that by replying in this Forum you agree to license your comments in the same way. Your comments may be edited and used but will always be attributed.

« If you don't know your RSS from your elbow | Main | Unwelcome VISITors »

REALly bad idea

By davebirch posted Mar 26 2007 at 3:02 PM

[Dave Birch] Critics of the US ID card initiative have long said that it actually makes individuals less secure by putting all their eggs in one basket and leaving them more vulnerable to data breaches and insider abuse.  The legislation behind it, the Read ID Act, requires the departments of motor vehicles in all 50 states to demand and keep on file sensitive documents such as birth certificates, social security cards, utility bills and the like. People who don’t have an ID card will be barred from boarding airplanes and from entering federal buildings such as courthouses, so it looks as if most Americans will have to get one.

Technorati Tags: , , ,

People are complaining that the guidelines prepared by the Department of Homeland Security (DHS) will turn state-issued identification cards into de facto internal passports and question whether the estimated $23 billion cost over the next decade will make any difference to security.  Both civil libertarians and security experts have called on Congress to repeal the 2005 law known as the Real ID Act that mandates the changes. These critics say that the bill increases government access to data on individuals and increases the risk of identity theft, without providing significant security benefits.  An ACLU spokesman said that "Real ID creates the largest single database about U.S. people that has ever been created...  This is the people who brought you long lines at the DMV marrying the people at DHS who brought us Katrina. It's a marriage we need to break up."

DHS officials point to the 9/11 hijackers' ability to get driver's licenses in Virginia using false information as justification.  Clearly, it would be useful to stop terrorists from obtaining fake identity documents, or as in this case obtain real identity documents using fake "feeder" documents.  This is why the UK Identity & Passport Service (IPS) wants to start interviewing new passport applications.  So how will Real ID stop bad guys from getting driving licences (which are, in essence, ID cards in the US) ?

Well, the proposed rules (all 162 pages of them) require:

  • Applicants must present a valid passport, certified birth certificate, green card or other valid visa documents to get a license and states must check all other states' databases to ensure the person doesn't have a license from another state.
  • States must use a card stock that glows under ultraviolet light, and check digits, hologramlike images and secret markers.
  • Identity documents must expire before eight years and must include legal name, date of birth, gender, digital photo, home address and a signature. States can propose ways to let judges, police officers and victims of domestic violence keep their addresses off the cards. There are no religious exemptions for veils or scarves for photos.
  • States must keep copies of all documents, such as birth certificates, Social Security cards and utility bills, for seven to 10 years.

However, many difficult questions, such as how state databases will be linked or how people without an address can get identity documents, are left unanswered.

It seems that people from states that don't abide by the guidelines will not be able to enter federal courthouses or use their identity cards to board a commercial flight.  So it's pretty important.  But as Sophia Cope from the Center for Democracy and Technology notes, "The Real ID Act does not include language that lets DHS prescribe privacy requirements, so there are no privacy regulations related to exchange of personal information between the states, none about skimming of the data on the magnetic stripe, and no limits on use of information by the feds."  So much for privacy by design.

The Real ID Act, slipped into an emergency federal funding bill without hearings, originally required states to begin issuing the ID documents by May 2008. The proposed rules allow states to ask for an extension until Jan. 1, 2010, but it's still not clear how exactly the act will be applied.  Who will pay, for instance.  The DHS had proposed that states use as much as 20 percent of their Homeland Security Grant Program money to cover the costs of setting up an infrastructure for Real ID and printing new licenses and cards.  But the National Governors Association estimated that states could spend up to $11 billion in their share of the costs to meet the original deadline and the grant program simply isn't enough.

The thing that's most worrying, from a security point of view, is that the people complaining that something like Real ID may in fact make identity theft much worse look to be correct.  The idea that Americans should feel comfortable about giving birth certificates and so forth to the DMV is fundamentally flawed.  If the states go down this route then they will just make the DMV, in this example, the weak link in the chain.  And it's pretty weak, as this story about serious identity thieves ramming a car through the back wall of a DMV near Las Vegas and stealing computer equipment containing personal information on more than 8,900 people shows.  Note also that police periodically arrest DMV employees in various states for selling fake drivers licences anyway, and for not that much money.  I just don't see Real ID as being either a pioneer or a model for a 21st-century digital ID scheme.

My opinions are my own (I think) and are presented solely in my capacity as an interested member of the general public.
[posted with ecto]

TrackBack

TrackBack URL for this entry:
https://www.typepad.com/services/trackback/6a00d8341c4fd753ef00d834fc595953ef

Listed below are links to weblogs that reference REALly bad idea:

Comments

As a conservative, I'm against the REAL ID Act.

It is indeed a national identification card as Lamar Alexander was honest enough to admit recently (Floor Remarks of U.S. Senator Lamar Alexander, February 28th, 2007). He is wrong in thinking that we need a national identification card, but at least he's willing to call a spade a spade.

Freedom is lost in theory long before it is lost in practice. REAL ID is a paradigm shift in America's thinking and heritage.

Here is why I'm against it:

1. The 2-D barcode required in the current standards still doesn't protect us from being forced to use biometrics in the future. I'm glad we're not forced to use biometrics for now, but we're creating a platform for such use with REAL ID. Anyway, from what I understand, 2D can still store or reference biometric information. Once all Americans are "booked" in such a way, that very personal information is no longer in the control of the person from whose body it was taken.

2. Linked Databases: It is double-speak to say that REAL ID is not a national database. It will be a network of databases completely linked to each other and accessable to government workers with an internet connection. How far and wide can one's personal info go on the internet?

3. REAL ID does an end-run around the 4th Amendment. If a citizen needs to be investigated (tracked, monitered, pinged, data-mined, etc.), let the government get a search warrant. REAL ID undermines the presumption of innocence in our society--a presumption that is a major cornerstone of freedom. We're creating an atmosphere of "Suspicious Until Properly Identified" instead of "Innocent Until Proven Guilty." REAL ID, and its future additions, will make life subject to the good-will of the government in a software maze of “red light, green light.” This is not freedom.

4. The burden of proof is on the promoters of REAL ID to clearly show how the program IS NOT A THREAT TO FREEDOM. It is not on the shoulders of opponents to show that it is. The history of Social Security Numbers clearly shows that these programs are never static. They take on a life and growth of their own. SSN's were promised not to be used for identification when they first came out.

5. REAL ID reduces God-given rights of the individual to a string of digits, subject to the good-will of software and/or bureaucrats. It makes Americans get “permission” to live and move in the basic functions of society. Without REAL ID, we won't be able to bank, fly, enter federal buildings--such as the Capitol etc. These are buildings we pay taxes to maintain. We shouldn’t have to ask permission to be functioning citizens within our own country.

6. REAL ID promotes the strength and presence of the federal government in our lives. This in and of itself is an encroachment on freedom. It is not hard to imagine the arbitrary rules liberal policy makers can enforce with REAL ID technology. We've got to look beyond our noses.

Some folks say we already have a national id--Social Security. But if REAL ID is only a lateral move, why are we doing it? We are doing it because it is indeed an increase in the government’s ability to track its citizens.

Conservative who promote REAL ID are promoting Big Government. I thought conservatives believed otherwise. This conservative does. Conservatives love all 10 of the Bill of Rights.

7. Hypocrisy: The government does virtually nothing to stop illegal immigration, yet it wants to come and tag me. It must be a lot easier this way, but the truly difficult decisions to be made at the border are left undone.

8. Capitulation: With the REAL ID, we are conceding that freedom cannot stand in an age of terror.

I think that if we’re on the wrong road, the soonest way to progress is to turn around.

The comments to this entry are closed.