The PASS ID Act: Rolling Back Security Standards for Driver's Licenses

Members of the Senate Committee on Homeland Security and Governmental Affairs introduced the Providing for Additional Security in States' Identification (PASS ID) Act of 2009 on June 15, 2009. This act would repeal substantive provisions of the REAL ID Act of 2005,[1] which aimed at ensuring that all states meet minimum security standards for issuing driver's licenses in order to enhance national security, increase driver safety, combat drug running, and better safeguard against identity theft and fraud.

While no state is compelled to comply, approximately 30 states are actively moving to meet REAL ID's minimum standards, which will help to make America less vulnerable. Opponents of REAL ID have painted the law as an affront to privacy and states' rights, but the reality is that REAL ID is an appropriate means for maintaining liberty and security. Congress should preserve REAL ID, fund it adequately, and take steps to ensure its full implementation.

A 9/11 Commission Recommendation

REAL ID was enacted in 2005 in direct response to recommendations of the 9/11 Commission that the federal government set secure standards for identifications, such as driver's licenses. The commission found that 18 of the 19 hijackers on September 11, 2001, obtained 17 driver's licenses and 13 state IDs, including at least seven obtained by fraud in Virginia. Six of these IDs were used to help the hijackers board planes on the morning of 9/11.[2] Of the legally obtained IDs, many were duplicates, with some states issuing the same hijacker multiple licenses over a period of several months. In its report, the 9/11 Commission recommended:

Secure identification should begin in the United States. The federal government should set standards for the issuance of birth certificates and sources of information, such as drivers licenses.[3]

Most of the REAL ID provisions were adopted from a secure ID framework drafted by the American Association of Motor Vehicle Administrators (AAMVA) and published in a lengthy report in response to the 9/11 Commission's investigation.[4] The standards emphasized that identity documents must be secure in their content, physical features, and issuance process. Without identity security at the base of identity document issuance processes, the AAMVA concluded that driver's license issuing standards would not produce secure licenses.

The Need for Standards

The need for more stringent standards dates back to before 9/11. Identity has always been the cornerstone of a free society, and for decades the key form of identification in the United States has been the driver's license. In its 2004 Security Framework, the AAMVA identified clear security parameters:

The license is now readily accepted as an official identification document for both licensed drivers, and, in most jurisdictions, for non-drivers. The Motor Vehicle Administrations (MVAs) who issue these documents have unique, continuous and long-lasting contact with most of their constituents from the individual's teenage years onward.

Most MVAs allow driver's license reciprocity with other MVAs; therefore a common security protocol among MVAs is necessary. This document provides minimum standards of security, interoperability and reciprocity agreed upon by all North American MVAs regarding driver's license/identification card (DL/ID) issuance. Each MVA shall:

Licenses have often been copied or manipulated and are subject to vast amounts of identity theft and fraud. For example, a woman in Florida pleaded guilty to obtaining a fake driver's license in someone else's name and using it to draw on the victim's bank account and to obtain credit cards, charging about $4,000 on those cards.[6] Driver's license fraud rings have been prosecuted nationwide, including well-known cases in Michigan, Pennsylvania, New Jersey, New York, and Ohio.[7] The Castorena Family Organization operated franchises in every major city in the United States for over a decade, reaping millions of dollars annually from counterfeited and stolen IDs.[8]

To address the 9/11 Commission's and AAMVA's recommendations and growing media attention on the issue of driver's license fraud, Congress enacted the REAL ID Act in 2005. The act includes the following compliance requirements:

• Identity verification. Each driver's license or identity card will be required to contain a person's full legal name, signature, date of birth, gender, driver's license or identification number, photograph, and the address of the person's principal place of residence.
• Document authentication. States are required to digitize birth records (another key 9/11 Commission recommendation) and review the authenticity of the information provided to obtain a license, such as Social Security information, immigration or lawful presence documentation, and other proof of identity, such as principal place of residence.
• Card security. REAL ID requires a certain level of physical security features to ensure more tamper-proof cards.
• Security plans. To ensure states meet security and privacy standards and to hold them accountable, REAL ID requires states to submit detailed security plans.
• One driver, one license. REAL ID requires creation of a network of state databases to enable states to verify that applicants do not hold multiple licenses in multiple states, something states already do voluntarily for commercial licenses and "bad" drivers. They are also exchanging digital images of drivers outside of REAL ID requirements.
• "Official purposes" requirement. REAL IDs will be required to board a commercial aircraft or enter a federal building and other areas deemed for "official purposes."[9]

Concerns Mitigated

Some controversy began soon after REAL ID was enacted. States were unhappy about paying to upgrade their licensing systems to meet the REAL ID standards.[10] Privacy advocates feared the onset of a national identification card and creation of national databases.[11] Even before the proposed regulations were released in 2008, state legislatures began to make assumptions about REAL ID, which led to significant misinformation about the program's execution.

By January 2008, when the Department of Homeland Security (DHS) rolled out the REAL ID regulations, the states' substantive concerns had been assuaged. To ease their cost and logistical concerns, compliance times were extended to reduce the cost of issuing REAL ID licenses. Originally, REAL ID would have required states to produce compliant IDs for all driver's licenses--including new applicants, those renewing their licenses, and those simply wanting to board a plane whose licenses would not expire until 2013. The DHS reduced this cost burden by including phase-in requirements that allow states to become compliant first with licenses of those under 50 years old by 2014 and then with those over 50 years old by 2017.[12] An internal DHS economic impact assessment of the new phase-in deadlines concluded that implementing REAL ID would cost about $8 per person.[13] In addition, under the REAL ID grant program, about $149 million in appropriated funds was distributed in 2008 to help states to implement REAL ID.[14]

In an effort to implement the one-driver-one-license program, DHS designated Mississippi as the "lead hub" state, with Florida and Wisconsin as two partner states, and appropriated $17 million to help states begin meeting the information sharing and state-based database requirements of REAL ID.[15] In addition, Kentucky was awarded $3 million to prepare for the nationwide deployment of electronic birth record verification to support REAL ID identity verification, otherwise known as Electronic Verification of Vital Events (EVVE).[16] To date, 13 states have digitized their birth records, and North Dakota, South Dakota, and Iowa have a verification network for checking driver's license applications.[17]

The Benefits of REAL ID

Given the ongoing debate, it is important to lay out what REAL ID actually is and is not. The basic premise of REAL ID is to set minimum standards for issuing driver's licenses and IDs.[18] It does not limit states on how many IDs they can issue or to whom they may issue them. Nor does the law bind states to its provisions. Rather, REAL ID simply makes clear that noncompliant driver's licenses and noncompliant state-issued ID cards cannot be used as identification for any federal purpose. In this way, REAL ID makes Americans safer and deals with several issues.

Making Americans Safer. REAL ID fulfills a key 9/11 Commission recommendation. The commission's recommendations have frequently received bipartisan support as important guidelines that should be implemented to help to prevent acts of terrorism against America.[19] Congress has passed numerous bills to implement the 9/11 Commission's recommendations, including the Intelligence Reform and Terrorism Prevention Act of 2004[20] and Implementing the Recommendations of 9/11 Commission Act of 2007.[21]

The driver's license provisions of the REAL ID law are no different. The 9/11 Commission recommended requiring all states to meet minimum security standards for issuance of and identification for driver's licenses. Given that six hijackers had used fraudulently obtained Virginia IDs to board planes on the morning of 9/11, REAL ID went further by requiring REAL IDs (or secure equivalents) to board commercial aircraft or enter critical government facilities such as nuclear power plants.[22]

Illegal Immigration. REAL ID permits states to issue driver's licenses and IDs to whomever they choose, but only those who can demonstrate that they are lawfully present in the United States may obtain REAL IDs. More specifically, REAL ID requires not only lawful presence, but also that the duration of the license or ID match the individual's legal length of stay in the U.S. In other words, once a person is no longer lawfully present in the United States, their driver's license should expire. This provision is necessary to prevent individuals who enter the U.S. legally and overstay their visas from using their driver's licenses or IDs to access federal areas with "official purposes." This will prevent individuals illegally in the U.S. from using false driver's licenses to obtain government services fraudulently.[23]

Privacy. REAL ID requires those handling database information and producing IDs to undergo more rigorous background checks and screening than is currently required. Furthermore, facilities that create and store IDs are required to maintain a minimum level of physical security on their premises. This means that information is better protected, not less. Furthermore, REAL ID does not give information to the federal government, but instead ensures that states remain in charge of this information, in the same way that they did prior to REAL ID. In addition, states must submit certification plans and meet privacy standards to demonstrate that they comply with REAL ID standards.

Fraud and Identity Theft. Billions of dollars are lost each year in identity theft, fraudulently obtained government services, and other criminal activities. Standards that take security for granted simply make no sense in the 21st century. Efforts to implement the 9/11 Commission's recommendations on identity verification, lawful presence, and the digitization of documents, such as birth and death records, have already substantially reduced fraud. Furthermore, those states that have not fully complied with REAL ID, such as Maryland, have felt the strain that driver's license fraud places on their state budgets.[24] Since the passage of REAL ID, nearly every state has begun checking Social Security numbers and lawful status. Twice as many states require lawful presence today than two years ago. Furthermore, REAL ID's one-driver-one-license rule enables states to prevent bad drivers from obtaining new licenses in other states and to stop criminals from evading the law by using multiple identities in one or more states.

Myths About REAL ID

Despite these benefits, REAL ID is subject to criticisms,[25] but these criticisms are based on widely perpetuated myths.

Myth #1: REAL ID invades privacy.

Fact: REAL ID protects privacy by ensuring that people are who they say they are.

The information contained on the machine-readable strip on the back of a REAL ID license is the same that most states require on the face of the license, such as a digital photo, name, permanent address, age, height, and weight. Thus, this information does not implicate privacy concerns. REAL ID licenses are not required to contain RFID (radio frequency identification) technology, biometric fingerprint information, or Social Security numbers, which could raise privacy concerns.

Myth #2: REAL ID will create a national ID card and a hackable, national database.

Fact: REAL ID does not collect personal data in a centralized federal database.[26]

REAL ID calls for the states to operate and access secure databases that are queried by authorized parties (such as MVAs and law enforcement). No databases are created to serve REAL ID. It only directs states to bring together pre-existing databases into a broader, secure network that will allow states to talk to one another and prevent fraud. Moreover, the federal government cannot and will not have access to any applicant's information. There is nothing "national" about the process. If anything, REAL ID can be said to obviate any need for a national ID.

Myth #3: REAL ID is a federal mandate that eliminates the right of states to issue driver's licenses and identification.

Fact: Each state can still issue many varieties of IDs, including IDs and driver's licenses that do not comply with REAL ID.

The driver's license is the most common form of ID used in the U.S. today. A driver's license is accepted for everything from opening a bank account to boarding a plane to picking up movie tickets purchased with a credit card. Securing this widely used credential makes sense on the state level, but not on the national level. Furthermore, the right to do this, even under REAL ID, still resides with the individual state. Each state can still issue many varieties of REAL ID-compliant cards and can continue to issue noncompliant IDs. The law remains completely voluntary, and states are not required to comply. Finally, REAL ID does not infringe on the right of states to decide who is eligible for a driver's license or ID.

PASS ID Act: The Wrong Strategy

PASS ID advocates portray the bill as a means of maintaining 9/11 Commission recommendations in a more flexible manner than offered by REAL ID. In reality, the PASS ID Act repeals outright substantive provisions of REAL ID, stripping away provisions that are already making driver's license issuance more secure. In short, PASS ID would set the same standards for driver's licenses as was recommended by the Commission, but the standards will not ensure security.

The primary supporters of PASS ID have made their opposition to REAL ID clear and the PASS ID language demonstrates that their goal is to freeze standards as they are today instead of continuing to strengthen licensing under REAL ID. Specifically, PASS ID would:

• Weaken identity verification. Two areas are key: ensuring that people are who they say they are (identity verification) and digitization of birth records to safeguard driver's license issuance. PASS ID returns identity verification to identity validation, the pre-9/11 standard, in which the state could simply rubber-stamp documents, such as birth certificates, principal residency documents, electronic verification of Social Security numbers, and passports. This was the same process that five 9/11 hijackers used to secure fake documents (principal residence affidavits) in Virginia, which enabled them to obtain IDs in early August 2001. REAL ID combats this problem by adding passport verification and birth record digitization as additional layers of security.[27]
• Lawful presence checks are only effective if identity verification and document authentication (ensuring that documents used are valid and trustworthy) are sufficient. Absent sufficient verification, an applicant would only need to steal, borrow, or buy a legal immigrant's or U.S. citizen's identity, use it to validate submitted paperwork, and then undergo a lawful presence screening, which is largely ineffective without the identity verification step. In essence, these requirements would further enable identity theft, instead of combating it like the requirements of REAL ID.
• Give states money without accountability or fiscal responsibility. PASS ID gives grant money to states without any accountability or any requirement to comply with the PASS ID requirements. In fact, PASS ID would not apply if a state law preempts the legislation. The bill would push back the compliance deadline another four years until 2017 (currently states would be required to be in compliance for those younger than 50 by 2014). Finally, even though most states already exceed PASS ID standards, it would not require states to demonstrate progress toward achieving the standards in exchange for the federal grants, which translates into essentially free money for states to use at their discretion. At a cost to U.S. taxpayers, the act also requires the federal government to provide free access to states for lawful status databases checks, including checking Social Security number information.
• Weaken airport security. Given that at least six hijackers used state-issued IDs or driver's licenses at airport check-in counters on the morning of 9/11, REAL ID requires passengers to present a secure ID before boarding a commercial airplane. PASS ID eliminates this provision, allowing anyone to board a commercial aircraft, whether or not they have a secure ID.
• Eliminate information sharing among states. The 9/11 Commission also found that the 9/11 hijackers held multiple driver's licenses and IDs from multiple states, similar to bad drivers, drug runners, counterfeiters, and others trying to circumvent the law. While REAL ID grants have been given to the states to create an information-sharing system to ensure that applicants no longer hold driver's licenses from other states, PASS ID would end that program, replacing it with a demonstration project that would likely never produce a useable system.

What the U.S. Should Do Instead

Since 2005, opponents have made several attempts to chip away at REAL ID Act requirements, and PASS ID is the latest such effort. Given the progress that has been made on REAL ID, Congress should:

• Keep REAL ID. The REAL ID standards can be implemented in a manner that respects constitutionally guaranteed liberties and the principle of federalism, makes economic sense, better protects the individual liberties and privacies of U.S. persons, and contributes to national security and public safety.[28] Postponing or modifying implementation confuses the work already in process and detracts from the underlying purpose of REAL ID: enhancing security of both the individual and the nation.
• Appropriate necessary funds to finish implementing REAL ID. To date, states have been allocated $129 million in grants. However, approximately $50 million of the funds appropriated for fiscal year (FY) 2009 remain unspent.[29] Even though Congress doubled funding for FY 2009 to $100 million, it is generally recognized that these sums will not cover the costs of implementing REAL ID. Rather than repeal REAL ID, Congress should support the states by appropriating sufficient funding and spending the remaining funds as originally intended.
• Move interested states into the REAL ID system. The supporters of the PASS ID Act have claimed that states are uninterested in REAL ID and that PASS ID represents a more palatable option. However, about 15 states have publicly supported REAL ID and are working toward achieving the first round of 18 material compliance benchmarks set by REAL ID regulations by the January 1, 2010, deadline.[30] Other states continue to make progress towards REAL ID goals. These benchmarks indicate progress toward REAL ID goals and include target goals, such as mandatory facial image capture, requiring applicants to sign applications under penalty of perjury, ensuring physical security of the ID cards, ensuring the security of personally identifiable information, verifying Social Security numbers and lawful status with federal database queries, and conducting background checks on covered MVA employees. Alabama, Colorado, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Mississippi, Nevada, New Jersey, North Carolina, Ohio, Rhode Island, Texas, and Wisconsin should be deemed in material compliance as soon as practicable. Their successes will encourage other states to follow suit.[31]
• Add flexibility to the state grant program. Some states have chosen to increase the security of their IDs through enhanced driver's license (EDL) memorandums of agreement with the DHS.[32] This program enables states to add additional information to driver's licenses to comply with the Western Hemisphere Travel Initiative (WHTI), which rolled out in full on June 1, 2009. WHTI requires a passport or "biometric equivalent" for any person, including U.S. citizens, to cross into the U.S. from Bermuda, the Caribbean, Mexico, or Canada. Several states have successfully implemented EDLs, including Washington, New York, Vermont, and Michigan (as of late April 2009).[33] Texas lawmakers have authorized the state government to begin issuing EDLs, but the governor has held back the process.[34] The DHS should enable states that choose to implement an EDL program that complies with REAL ID standards to use REAL ID grants for EDLs in addition to REAL IDs, producing a dual benefit.

Secure IDs for a Safer America

When a state issues a driver's license or ID, both the state and the individual should be confident that the license is a secure, authenticated credential. The DHS issued final regulations for REAL ID in January 2008, based on thousands of comments from states and other interested parties. Many states have already made significant progress toward this end. States are working toward implementation, spending millions of dollars to improve their driver's license issuing systems.

Stopping those efforts now would simply waste money, confuse processes that took four years to put in place, and delay what most Americans want: secure IDs and a safer America.

Janice L. Kephart is a former counsel to the September 11 Commission and is National Security Policy Director for the Center for Immigration Studies. Jena Baker McNeill is Policy Analyst for Homeland Security in the Douglas and Sarah Allison Center for Foreign Policy Studies, a division of the Kathryn and Shelby Cullom Davis Institute for International Studies, at The Heritage Foundation.

AppendixState Participation in REAL ID

Alabama. Citizens take computerized tests. Their records are captured electronically, and their digital photos are stored in a searchable database. Their names are automatically checked against national databases to confirm their identities and to ensure that they are legally entitled to licenses.[35]

Colorado.[36]Colorado remains a leader in identify theft prevention.

Delaware.[37]Delaware is examining ways in which the state can move forward with REAL ID implementation.

Florida. Florida received $1.2 million to partner with Mississippi, the lead hub state for pilot implementation and verification testing.[38]

Indiana. Indiana received $1.2 million to partner with the lead hub state for pilot implementation and verification testing. "BMV Commissioner Ron Stiver said the new licenses will result in a total cost savings of $2.5 million during the six-year contract period."[39]

Iowa.[40]Iowa is planning to comply with REAL ID and is actively taking steps toward this goal.

Kentucky."FEMA awarded Kentucky an additional $4 million to help state Department of Motor Vehicle Departments connect to state Vital Records Offices (VRO). The Commonwealth of Kentucky will enable state VROs to access the Electronic Verification of Vital Events hub (a web based portal) to verify birth and death record information of individuals applying for REAL ID driver's licenses and identification cards. Kentucky will also use these funds to expand the scope of its REAL ID Pilot Project by comparing U.S. foreign born citizens applying for a REAL ID driver's license with the U.S. Department of State's foreign born citizen birth record information."[41]

Maine. On June 3, 2009, Maine Governor John Baldacci vetoed a bill that would have stopped Maine from complying with REAL ID. He cited the fact that "Maine had become a target for unscrupulous individuals looking to circumvent legal presence requirements in other states," as one of the reasons behind the veto.

Maryland. Governor Martin O'Malley signed a bill to comply with REAL ID on May 8, 2009.

Mississippi.Mississippireceived $17 million to become the lead state for verification hub requirements and development.

Nevada. Nevada received $1.2 million to partner with the lead hub state for pilot implementation and verification testing. "Nevada citizens will have the option of obtaining a Real ID compliant driver's license or identification card, or a standard Nevada driver's license as issued today."[42]

Ohio.Ohio was the first state to request and receive an extension. "Ohio has no plans to oppose Real ID. At this time, we are going to have to review the final rules to make a determination, but we have been moving full steam ahead with the intent of implementing Real ID in Ohio." [43]

Oregon. In 2007, Oregon Governor Ted Kulongonski issued an Executive Order which called for stricter driver's license and identification card issuance standards.[44]

Rhode Island."Governor Carcieri has indicated that he supports REAL ID implementation in Rhode Island."[45]

Wisconsin. Wisconsin received $1.2 million to partner with the lead hub state for pilot implementation and verification testing. "Under the 2007-2008 biennial budget provisions Wisconsin [will be] in full compliance with the federal Real ID law."[46]