Some Myth‐Busting Is Quite Revealing
After DHS Secretary Chertoff's testimony to the Senate Judiciary Committee this week (at which he was apparently rebuked for "bullying" states on REAL ID compliance) he sat down with a group of bloggers to discuss things.
Congratulations are due the Secretary for making himself available in an open forum like this, especially because it allows us some insight into his thinking. It makes more clear why he and his colleague Stewart Baker feel a need to engage in so much REAL ID "myth-busting." Though I have assumed their comprehension of the problems with REAL ID, perhaps I have been mistaken, as Secretary Chertoff does not exhibit a good sense of information technology or the information economy.
Here's the myth that Secretary Chertoff purports to bust:
I had someone say to me today, "Well, when you have these REAL ID licenses with a machine-readable zone . . . it's gonna be used to track people. People can skim it. And they can steal it. And then they can use it to follow you around." Now this is a fantasy. This is just not true.
The Secretary overstates the argument and so shades into attacking a straw man, but the context is conversational. So let's look at what the real argument is, and then at the Secretary's responses. I touched on the question of tracking in my testimony to the Senate Homeland Security and Governmental Affairs Committee:
There are machine-readable components like magnetic strips and bar codes on many licenses today. Their types, locations, designs, and the information they carry differs from state to state. For this reason, they are not used very often. If all identification cards and licenses were the same, there would be economies of scale in producing card readers, software, and databases to capture and use this information. Americans would inevitably be asked more and more often to produce a REAL ID card, and share the data from it, when they engaged in various governmental and commercial transactions.
In turn, others will capitalize on the information collected in state databases and harvested using REAL ID cards. Speaking to the Department of Homeland Security’s Data Privacy and Integrity Advisory Committee last week, Anne Collins, the Registrar of Motor Vehicles for the Commonwealth of Massachusetts said, "If you build it they will come." Massed personal information will be an irresistible attraction to the Department of Homeland Security and many other governmental entities, who will dip into data about us for an endless variety of purposes.
This is not an argument that the currently proposed REAL ID license would be read surreptitiously, as might happen with an RFID-chipped card. (The Secretary says that REAL ID currently does not require RFID, but neglects to mention that the "Enhanced Driver's License," which satisfies REAL ID, has one.) The argument is that a great deal more data about us will be collected.
This will include "meta-data" - information about the collection of information, such as time, place, purpose, collecting entity, and so on. Combined identity data and meta-data form footprints about our comings and goings. These footprints, collected in interoperable databases, combine to form tracks.
Perhaps it's a complicated argument, but it's a coherent one: REAL ID would lead to tracking of law-abiding Americans.
Nothing the Secretary says conveys that he's aware of meta-data or actual data collection processes. He says that the machine-readable zone (or MRZ) is "nothing more than the information on the face of the license. I already have a reader for the license - it's called my eye - and I can read what's on your license. So therefore there's nothing I'm going to get out of the MRZ that I can't get from the face of the license."
Alas, even this isn't quite true. The regulation prescribes certain minimum data elements for the MRZ, but doesn't restrict the use of others, and it doesn't require states to restrict the content of the MRZ to only what is on the face of the license. The MRZ could lead to tracking of people and their activities based on their race, for example, a data element many states currently include in their MRZs. Despite receiving comments concerned with this during the rulemaking process - oh, and in congressional testimony - DHS declined to prohibit including race in the MRZ of REAL IDs.
Card readers are not just little electric eyeballs. They record information in digital form. This means that identical copies of these records are easy to store, easy to compile, easy to transfer, and easy to reuse. Collecting information in digital form is materially different from collecting information in analog form. Most people who work with technology know that implicitly. To be credible on identification technology issues, one must know this and acknowledge its significance.
Finally, the Secretary says that the DHS is not going to create a lot of databases using REAL ID. That may be his intention, but he's in office for about ten more months. And whether DHS creates them or not, databases of information harvested using REAL ID would likely be available to DHS.
It is very hard to design information technology systems that do not collect and retain information. The current secretary's personal opinion about databases just isn't good evidence of whether or not there will be databases of information about the comings and goings of law-abiding Americans. Chances are very good if REAL ID is implemented that there will be.
