DHS Proposes Rules Implementing REAL ID Act

March 1, 2007. The Department of Homeland Security (DHS) released a notice [162 pages in DF] to be published in the Federal Register, that announces and describes a notice of proposed rulemaking regarding rules implementing the REAL ID Act, a bill that federalized state identification systems.

Summary. The notice is long. It offers extensions of the compliance deadline. However, it leaves key implementation issues unresolved.

The DHS notice states that "This rule proposes standards to meet the minimum requirements of the REAL ID Act of 2005, including: information and security features that must be incorporated into each card; application information to establish the identity and immigration status of an applicant before a card can be issued; and physical security standards for locations where driver’s licenses and applicable identification cards are issued."

Michael Chertoff, Secretary of Homeland Security, stated a a news conference on March 1, 2007, that this "proposes specific minimum standards for state issued driver's licenses and identification cards to be accepted for federal purposes such as air travel." See, transcript.

The REAL ID Act relies upon states for its implementation. However, some states are resisting. See for example, story titled "Maine Rejects REAL ID Act" in TLJ Daily E-Mail Alert No. 1,528, January 29, 2007.

Chertoff said that the DHS would allow a two year extension of time for states to come into compliance.

He also said that the DHS would "pitch in and help the states with some of the costs". He added that "up to 20 percent of the total state homeland security program funding available for this fiscal year, which totals about $100 million in total, will be available for states to implement Real ID".

In contrast, the National Conference of State Legislatures (NCSL) and the National Governor's Association (NGA) have estimated that the program will cost over $11 Billion in the first five years. See, NCSL/NGA report [60 pages in PDF] titled "The Real ID Act: National Impact Analysis".

Moreover, there is some support in the Congress for repealing the REAL ID Act. For example, on February 28, 2007, Sen. Daniel Akaka (D-HI), Sen. John Sununu (R-NH), Sen. Patrick Leahy (D-VT), and Sen. Jon Tester (D-MT) introduced S 717, a bill to repeal Title II of the REAL ID Act. Title II contains the provisions pertaining to federalization of state identification systems. Also, on February 14, 2007, Rep. Thomas Allen (D-ME) and others introduced HR 1117, the "REAL ID Repeal and Identification Security Enhancement Act of 2007", which would also repeal Title II of the Act.

See also, letter [4 pages in PDF] to Sen. Daniel Akaka (D-HI) and Sen. John Sununu (R-NH) supporting repeal of the REAL ID Act. It is endorsed by the Center for Democracy and Technology (CDT), Privacy Rights Clearinghouse, Center for Financial Privacy and Human Rights, ACLU, People for the American Way, and former Rep. Bob Barr's Patriots to Restore Checks and Balances, and other groups that have addressed technology policy. However, most of the groups endorsing the letter have not historically focused on issues involving technology or privacy. They include the Leadership Conference on Civil Rights, NAACP, United Automobile Workers, National Organization for Women, and Common Cause.

Also, many of the groups endorsing the letter focus on immigration policy. While Secretary Chertoff discusses the REAL ID Act in the context of fighting terrorism, one of the primary purposes of the bill is enhanced enforceability of immigration laws. More specifically, one of its underlying purposes is to facilitate the ability of employers to verify eligibility of job applicants for employment based upon immigration status. The current availability of counterfeit documents has the effect of causing many employers to hire without regard to actual immigration status.

The federal government, which has great difficulty enforcing immigrations laws, either on the borders, or within the U.S., has mandated in the REAL ID Act that the states operate a network of state identifications systems based upon accessible electronic databases. In addition, the federal government, which has historically had difficulty in making immigration status determinations, would deputize the 51 state and District of Columbia DMVs, many of which are minimally competent to administer parallel parking tests, to make complex immigration status legal determinations. In turn, these interconnected state identification systems, and the cards issued by these states, will in theory enable the federal government to deputize employers to enforce immigration laws.

The DHS and the federal government will obtain access to new identification tools, at little cost to them. They will be able to claim credit for fighting terrorism and illegal immigration, and performing other yet to be identified missions. The financial costs of creating and maintaining the state identification systems will be borne by the states, and their taxpayers. The political costs of funding the program will be borne by the state officials who must divert state tax revenues from other state programs to fund this federal mandate. The business costs of implementing immigration status based employment screening will be borne by employers. The personal costs associated with unauthorized access to these electronic databases and machine readable cards, including misuse, fraud, and identity theft, will be borne by the individual victims of fraud and identity theft.

REAL ID Act. The original version of HR 418 (109th Congress), the "REAL ID Act of 2005", was introduced by Rep. James Sensenbrenner (R-WI) on January 26, 2005. The House amended and approved one version of HR 418 as a stand alone bill on February 10, 2005.

The House also approved it as an appendage to HR 1268 (109th Congress), on May 11, 2005. HR 1268 was a supplemental appropriations bill, the main purposes of which were defense and anti-terrorism funding, and additional funding for the FBI, DEA, and other agencies.

President Bush signed HR 1268 (109th) on May 11, 2005. It is now Public Law 109-13. Hence, the REAL ID Act was enacted as Division B of HR 1268. This Title B contains many provisions. Those related to the federalization of state identification systems are found at Title II of Title B, titled "Improved Security for Drivers' Licenses and Personal Identification Cards. It is Sections 201-207 of Title B.

Section 201 contains definitions. Section 202, titled "Minimum Document Requirements and Issuance Standards for Federal Recognition", contains language that has prompted opposition.

This section sets minimum standards regarding the contents of state identification documents, including machine readability, and issuance standards.

It requires that states maintain electronic databases that include "all data fields printed on drivers' licenses and identification cards issued by the State".

It also requires states to "Employ technology to capture digital images of identity source documents so that the images can be retained in electronic storage in a transferable format". It further requires that states "Provide electronic access to all other States to information contained in the motor vehicle database of the State".

The Act contains language to compel the states to implement the requirements set forth in the Act. For example, it provides that "a Federal agency may not accept, for any official purpose, a driver's license or identification card issued by a State to any person unless the State is meeting the requirements of this section".

DHS's Proposed Rules. The DHS's notice states that it "proposes to issue REAL ID regulations that create minimum standards for State driver’s licenses and identification cards that Federal agencies can accept for official purposes on or after May 11, 2008. Under this proposal, States must certify that they are in compliance with these requirements, and DHS must concur, before the driver’s licenses and identification cards that the States issue may be accepted by Federal agencies for official purposes on or after May 11, 2008. Because DHS recognizes that not all driver’s licenses and identification cards can be reissued by May 11, 2008, the proposal provides a five-year phase-in period for driver’s license or identification card renewals."

It adds that "States would be required to provide electronic access to specific information contained in the motor vehicle database of the State to all other States."

The Act provides that the federal government will not accept state issued identification for an "official purpose" that does not comply with the Act. The Act defines "official purpose" as "accessing Federal facilities, boarding Federally-regulated commercial aircraft" and "any other purposes that the Secretary shall determine". The DHS notice evades this issue. It does not identify "any other purposes", but adds that the DHS "may expand this definition in the future".

However, the notice does expand the scope of the program beyond an "official purpose" to certain private sector activities. It construes the term "official purpose" to mean that the requirements would apply "when nongovernmental entities require identification for the scope of activities considered ``official purposes´´".

The DHS notice states little about the mandatory access to state electronic databases of information by other states. It states that the DHS "intends to "work closely" in the future with the states on this issue. It states that it does not state what platform or service will be used to enable this access. Nor does it define privacy protections. Rather, it states that in the future the federal government "will collaborate with states on the privacy protections and access provisions".

The Act mandates state electronic databases. The notice "proposes that each State submit as part of the REAL ID Act certification process a written, comprehensive, security plan" for protecting the electronic databases mandated by the Act from such threats as unauthorized access, misuse, fraud, and identity theft. The notice requests comments on this.

The Act mandates a machine readable technology for identification cards. The notice asks how to make this machine readable data readable by the government, but not by others. The notice suggests encryption. It requests comments on this.

As of Monday, March 5, 2007, the DHS had not yet published its notice in the Federal Register. This notice will set the comment deadline, which will be sixty days after such publication.

Reaction. Rep. Allen, the sponsor of a REAL ID Act repeal bill, stated in a release that "Secretary Chertoff’s decision to issue regulations that delay full implementation of the REAL ID Act reinforces my concern that this law is burdensome as written. But delay will not resolve the law’s fundamental flaws. A delay gives Congress time to repeal REAL ID and replace it with a policy that does not put the liberties and private information of law-abiding Americans at risk and that doesn’t impose an enormous financial burden on state taxpayers. I will continue to work with my colleagues in Congress, states and groups that work to protect Americans’ freedoms and privacy to establish national standards that will protect both national security and the privacy of American citizens."

The Center for Democracy and Technology (CDT) wrote in its web site that "Given the Act's fundamental flaws, CDT has joined other civil liberties groups in supporting legislation introduced in recent days in the House and Senate to repeal the hastily-enacted 2005 law and return to the driver's license reform process begun by the previous Congress. CDT is especially concerned that the Act would result in the creation of a linked network of government databases of personal information, without standards or limits on access and use."