Tag: real id

REAL ID Continues Its Long, Slow Failure

REAL ID continues its long, slow failure. The federal government’s national ID plans continue to bash against the shoals of state and popular opposition.

Late last month, the governor of Utah signed H.B. 234 into law. The bill prohibits the Utah driver license division from implementing REAL ID. That brings to 25 the number of states rejecting the national ID law, according to the Tenth Amendment Center.

And the State of Nevada, one of the few states that had been working to get in front of REAL ID, is reconsidering. With wait times at Las Vegas DMVs reaching two to four hours, the legislature may soon allow a temporary REAL ID implementation measure signed last year to lapse—this according to the Ely (NV) News.

Congress has attempted to circumvent the growing state opposition to REAL ID with the now-stalled PASS ID legislation. It basically would rename REAL ID so as to nullify the many state resolutions and laws barring implementation of the national ID law because they refer to the May 2005 “REAL ID” law specifically. But PASS ID is the same national ID, it has all the privacy issues of REAL ID, and its costs would be as great or greater than REAL ID.

That doesn’t mean national ID supporters in Congress won’t try to sneak the REAL ID revival bill into law sometime later this year, of course …

(No) Surprise! REAL ID Deadline Extended Again

In a classic example of the 5:00 Friday news drop, the Department of Homeland Security has announced that it is extending the REAL ID compliance deadline. Forty-six of 56 jurisdictions, it reports, were not able to implement even the interim measures it proposed requiring by December 31st when it last extended the deadline in May of 2008.

The DHS statement insists that a full compliance deadline on May 10, 2011 remains in effect. What that really means is that there will be another false crisis as that deadline approaches, and the DHS will extend the deadline yet again.

The better alternative is to repeal the national ID law and the worthless, expensive pseudo-security it represents. It is not to revive REAL ID under its alternative name “PASS ID.”

Latest REAL ID Deadline Will Pass Without a Blip

Via the ACLU blog, there’s no chance that the Department of Homeland Security will interfere with Americans’ travel when its latest deadline for REAL ID compliance passes at the end of this month. As happened with the original deadline for states to implement the national ID, DHS will give out waivers to recalcitrant states instead of carrying out the threat of refusing to accept travelers’ IDs at airports.

States were required by Tuesday to request a waiver from DHS showing that they had met certain milestones for REAL ID compliance. But according to NextGov, Arkansas, Idaho, Kansas, Missouri, Montana, New Jersey, Oklahoma, South Carolina, and three U.S. territories have not asked for a waiver.

Supporters of a REAL ID revival bill called “PASS ID” want to use this end-of-year impasse to hustle their bill through Congress (the way REAL ID was originally passed). But the impasse is fake, and states can do what they want.

“Should Congress not act before it adjourns this year, DHS has planned for contingencies related to REAL ID implementation, including extending the deadline as a last resort,” said a DHS spokesman.

Will a False Crisis Revive REAL ID?

I’ve written here before about how the National Governors Association is seeking to peddle state power over driver licensing and identification to the federal government in order to cement its role as a supplicant for states in Washington, D.C.

NGA is currently seeking to drum up a false, end-of-year driver license crisis to convince Congress to pass a new version of REAL ID called PASS ID, moving the national ID project forward.

The letter says that states must be “materially compliant” with the REAL ID Act by the end of the year or their citizens will not be able to use their driver’s licenses as identification to board commercial aircraft. This is technically true, in one sense, but it omits some important information.

The statutory deadline for REAL ID compliance was actually a year and a half ago, May of 2008. No state was in compliance then, and the Department of Homeland Security gave out deadline extensions wholesale—even to states that didn’t ask for them.

If Congress takes no action by the end of the year, the DHS will simply do this again. There is no end-of-year driver license crisis.

And it’s no harm, no foul—nobody who has studied identity-based security believes that the national ID law would cost-effectively protect the country. Ignoring or repealing REAL ID are the best paths forward.

The NGA, of course, believes that states will be better off with its preferred version of REAL ID. Some of the sharpest corners are taken off REAL ID in the new ”PASS ID“ version, but states are kidding themselves if they think PASS ID is good for their bottom lines.

As I wrote beforetwice!—PASS ID is likely to cost states as much or more than REAL ID. Its requirements are essentially the same, and its implementation deadline—one of the biggest cost drivers—is tighter in some respects than REAL ID.

Will Congress slip PASS ID into law by the end of the year the way REAL ID was slipped into law four-plus years ago? It’ll be interesting to see…

‘Has Any of This Made Us Safer?’

In the November 6th Washington Post, Petula Dvorak lamented the effect of REAL ID compliance on women who have changed their names. The Department of Homeland Security is about to give out blanket waivers to states across the country who have not complied with REAL ID requirements — again. But some states have been making it harder to get licenses because of the national ID standards they still think are coming.

“I doubt the most notorious terrorists of our time — the Sept. 11 hijackers, Timothy McVeigh — would have been stopped by these new DMV requirements,” Dvorak writes. ”All these laws have done is make us more harried, more paranoid and more red-faced than ever.”

Startling Incompetence at ANSI Standards Group

I have always regarded standard-setting organizations as serious players who take care to keep slightly boring the work of establishing uniformity in products and protocols. But a press release from the American National Standards Institute (ANSI) may cause me to reassess.

IDSP Issues Report Calling for National Identity Verification Standard” is the release, and it’s bristling with error and malformed policy assertions. IDSP is the “Identity Theft Prevention and Identity Management Standards Panel,” an ANSI subgroup.

Take this doozy:

[T]he Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) and the REAL ID Act of 2005 require verification of identity prior to the issuance of birth certificates and driver’s licenses / ID cards, respectively. However, the IRTPA regulations have not yet been released even in draft form and the REAL ID regulations do not provide practical guidance on how to corroborate a claim of identity under different circumstances.

Folks, REAL ID repealed the identity security provisions in the Intelligence Reform and Terrorism Prevention Act. (It’s a good bet that regulations for a repealed law aren’t going to move out of draft form for a very long time, eh?) And REAL ID does not require verification of identity prior to issuance of birth certificates. What could that even mean?! “Hey you—little baby—let me see some ID before I issue you your birth certificate.”

The release repeats the tired mantra that 9/11 terrorists got U.S. identity documents—“some by fraud.” The 9/11 Commission dedicated three-quarters of a page to its identity recommendations—out of 400 substantive pages—and neither the commission nor anyone since has shown how denying people U.S. identity documents would prevent terrorism.

Are there needs for identity standards? Of course. And there are a lot of projects in a lot of places working on that. If an organization doesn’t know the law, and doesn’t know how the subject matter it’s dealing with functions in society, I don’t know how it could possibly be relied on to set appropriate standards.

ANSI should take a look at this subgroup and see if its work is actually competent. Judging by this press release, it’s not.

Recapping the Costs of the REAL ID Revival Bill

In late July, the Senate Homeland Security and Governmental Affairs Committee passed a new version of PASS ID, the REAL ID revival bill. I’ve posted about various dimensions of it: the national ID question, the politics of PASS ID, whether PASS ID protects privacy, a run-down of the Senate hearing on it, and the inexplicable support of the Center for Democracy and Technology for this national ID law.

Three months later, the committee still has not reported the bill, meaning that the public doesn’t get access to the version the committee passed. (A resolution in the House would require committees there to publish amendments to bills within 24 hours.) But the Congressional Budget Office scored the bill this week. That is often a signal that legislation is on the move.

So it’s a good time to look at costs again. The National Governors Association and the National Conference of State Legislatures both premised their support for PASS ID on the idea that it would reduce costs to states to just $2 billion.

But in July I examined the likely costs of PASS ID and NGA’s cost calculations. To save you a burdensome click, here are some highlights:

But there is reason to doubt [the NGA’s $2 billion] figure. PASS ID is a lot more like REAL ID — the original REAL ID — in the way that most affects costs: the implementation schedule.

Under PASS ID, the DHS would have to come up with regulations in just nine months. States would then have just one year to begin complying. All drivers’ licenses would have to be replaced in the five years after that. That’s a total of six years to review the documents of every driver and ID holder, and issue them new cards.

How did the NGA come up with $2 billion? Maybe they took the extended, watered-down, 75%-over-ten-years estimate and subtracted some for reduced IT costs. (The NGA is free to publish its methodology, of course.)

But the costs of implementing PASS ID to states are more likely to be closer to $11 billion than the $2 billion figure that the NGA puts forward. In just six years, PASS ID would send some 245 million people into DMV offices around the country demanding new cards. States will have to hire and train new employees to handle the workload. They will have to acquire new computer systems, documents scanners, data storage facilities, and so on.

The NGA’s claim of savings from PASS ID is weak. Did the new CBO score change anything?

First, let’s review what a CBO score is. When CBO scores a bill, it reports how a bill will change costs to the federal government. Other CBO reports may include overall costs for federal programs, but when CBO scores a bill, it just reports the difference between current federal spending and spending if a new proposal should pass. CBO sometimes mentions mandates on states and private-sector costs in their bill-scores, but those are rarely if ever thoroughly reported. CBO’s wheelhouse is federal spending, and that’s what it reports.

Now, let’s look at how CBO has done with estimating the costs to states from implementing federal national ID standards.

Its first cut at scoring national ID standards was when it looked at H.R. 10 in the latter stages of the 108th Congress. (This was before REAL ID — H.R. 10 was an early version of the bill that became law as the Intelligence Reform and Terrorism Prevention Act.) When CBO scored H.R. 10 in late 2004, it lumped national ID standards along with several other policies and programs in a category called ”Mandates With no Significant Costs.”

Four months later, in early 2005, CBO scored the REAL ID Act, which had been introduced early in the new Congress. It found then that the national ID standards Congress had put into law in December had changed from a mandate with “no significant costs” to a mandate costing more than $100 million.

CBO thought REAL ID would only cost $20 million more than that, an amount below the reporting threshold of the Unfunded Mandates Reform Act, so CBO did not do a thorough analysis.

Then the folks actually faced with implementing it took a look at REAL ID. More realistic estimates of costs to states in the $10+ billion range came forward, including an estimate from the National Governors Association, as I discussed in my previous post on costs.

With that background we’re ready to look at the CBO score for PASS ID. CBO makes no precise estimate of costs to states. Its specialty, again, is federal spending. But it makes a few observations about such costs:

  • “The bill would require states to issue public notices about their security and privacy policies that include information about how personally identifiable information is used, stored, accessed, and shared.”

This, all should agree, is a complex problem but a small cost.

  • “The bill also would require states to have a process that would allow individuals to access, amend, and correct their information. Information from groups representing state governments [NGA and NCSL, most likely] indicates that most states currently have such policies and procedures, though some may need to be revised.”

No. They. Do. Not.

As I said in my post on the privacy consequences of PASS ID:

This is a new and different security/identity fraud challenge not found in REAL ID, and the states have no idea what they’re getting themselves into if they try to implement such a thing. A May 2000 report from a panel of experts convened by the Federal Trade Commission was bowled over by the complexity of trying to secure information while giving people access to it. Nowhere is that tension more acute than in giving the public access to basic identity information.

No state has opened its driver databases for review and correction by the public. That would be an all-you-can-eat buffet for identity fraudsters. The CBO has been bamboozled about state policies.

But the language of PASS ID finesses this, doesn’t it? It says that opening up identity data and giving the public correction rights would be done “as determined appropriate by the State.” So states wouldn’t really have to do anything, right? Right!

Except that the Department of Homeland Security gets to interpret what that language means, and a court will defer to any reasonable DHS interpretation. That’s the Supreme Court’s Chevron doctrine. (It’s an unfortunate abdication of power to administrative agencies, but it’s the law today.)

If the NGA and NCSL have told their clients that they will have the last word on how PASS IS is implemented, they are wrong. It’s DHS’ call — not states’. There may be huge costs to states — hidden at first, but growing and growing — if they stick their heads into the jaws of the federal lion.

Returning to the CBO’s assessment of state costs:

  • “The bill would repeal the requirements of the REAL ID Act and replace them with more flexible requirements for issuing compliant driver’s licenses and identification cards.”

This is true in some respects, and not in others. As I noted before, PASS ID is on a tighter implementation schedule which is the main driver of costs.

  • “The bill also would authorize appropriations that could be used to pay for those requirements, and it would prohibit the federal government from charging fees to states to access the SAVE and SSOLV data systems.”

Because it’s federal, this is something that CBO actually knows about, and its assessment is that PASS ID would dole out a total of $123 million to states over the next five years. Washington, D.C.’s highest spending year would be fiscal 2013, in which it would spend $39 million, less than $1 million per state.

And those savings when the federal government doesn’t charge states for using its databases? Just $2 million each year in fiscal 2010 and 2011.

Nothing in the CBO estimate changes the conclusion that implementing a national ID would cost states over $10 billion dollars, as they hired new staff, acquired new equipment and systems, and marched 250 million Americans through their DMVs. The federal government is promising to dole out $123 million and offer states a whopping $4 million in savings on data access.

The National Governors Association’s argument that PASS ID reduces costs to states is ludicrous. And the paltry funds Congress might share with states is a drop in the bucket. The homeland security appropriations bill for fiscal 2010 cuts funding for REAL ID by $40 million from its 2009 funding level. PASS ID would fare no better.

State governors and legislatures that have fallen for the PASS ID cost estimates of the National Governors Association and National Conference of State Legislatures should fire these financial advisors. NGA and NCSL are trying to grow federal power at the expense of state coffers.