Tag: homeland security

Arizona to Feds: No “Enhanced” Drivers License

Last week, the governor of Arizona signed H.B. 2426, which bars the state from implementing the “enhanced” drivers license (EDL) program.

If the federal REAL ID revival bill (PASS ID) becomes law, it will give congressional approval to EDLs, which up to now have been simply a creation of the federal security and state driver licensing bureaucracies.

As governor of Arizona, the current Secretary of Homeland Security signed a memorandum of understanding with the DHS to implement EDLs, and she backs PASS ID even though she signed an anti-REAL ID bill as governor. As I said before, Secretary Napolitano seems to be taking the national ID tar baby in a loving embrace.

Fun With DHS Press Releases!

Let’s fisk a DHS press release! It’s the “Statement by DHS Press Secretary Sara Kuban on Markup of the Pass ID Bill by the Senate Homeland Security and Government Affairs Committee.” Here goes:

On the same day that Secretary Napolitano highlighted the Department’s efforts to combat terrorism and keep our country safe during a speech in New York City,

This part is true: Secretary Napolitano was in New York speaking about terrorism.

Congress took a major step forward on the PASS ID secure identification legislation.

There was a markup of PASS ID in the Homeland Security and Governmental Affairs Committee. It’s a step – not sure how major.

PASS ID is critical national security legislation

People who have studied identity-based security know that knowing people’s identities doesn’t secure against serious threats, so this is exaggeration.

that will break a long-standing stalemate with state governments

Thirteen states have barred themselves by law from implementing REAL ID, the national ID law. DHS hopes that changing the name and offering them money will change their minds.

that has prevented the implementation of a critical 9/11 recommendation to establish national standards for driver’s licenses.

The 9/11 Commission devoted three-quarters of a page to identity security – out of 400+ substantive pages. That’s more of a throwaway recommendation or afterthought. False identification wasn’t a modus operandi in the 9/11 attacks, and the 9/11 Commission didn’t explain how identity would defeat future attacks. (Also, using “critical” twice in the same sentence is a stylistic no-no.)

As the 9/11 Commission report noted, fraudulent identification documents are dangerous weapons for terrorists,

No, it said “travel documents are as important as weapons.” It was talking about passports and visas, not drivers’ licenses. Oh – and it was exaggerating.

but progress has stalled towards securing identification documents under the top-down, proscriptive approach of the REAL ID Act

True, rather than following top-down prescription, states have set their own policies to increase driver’s license security. It’s not necessarily needed, but if they want to they can, and they don’t need federal conscription of their DMVs to do it.

– an approach that has led thirteen states to enact legislation prohibiting compliance with the Act.

“… which is why we’re trying to get it passed again with a different name!”

Rather than a continuing stalemate with the states,

Non-compliant states stared Secretary Chertoff down when he threatened to disrupt their residents’ air travel, and they can do the same to Secretary Napolitano.

PASS ID provides crucial security gains now by establishing common security standards for driver’s licenses

Weak security gains, possibly in five years. In computer science – to which identification and credentialing is akin – monoculture is regarded as a source of vulnerability.

and a path forward for ensuring that states can electronically verify source documents, including birth certificates.

We’re on the way to that cradle-to-grave biometric tracking system that will give government so much power over every single citizen and resident.

See? That was fun!

Does the PASS ID Act Protect Privacy?

I’ve written about PASS ID here a couple of times before - first on whether or not it’s a national ID and, second, on the politics of this REAL ID revival bill. Now I’ll take a look at whether it fixes the privacy issues with REAL ID. Privacy is complicated. Buckle up.

The day the bill was introduced, the Center for Democracy and Technology issued a press release giving it a privacy stamp of approval.

“The PASS ID Act addresses most of the major privacy and security concerns with REAL ID,” said Ari Schwartz, Vice-President of CDT. The release cited four ways that PASS ID was an improvement over the bill it’s modeled on, REAL ID.

Interstate Data Sharing?

First, CDT said, PASS ID “[r]emoves the requirement that states ‘provide electronic access’ allowing every other state to search their motor vehicles records.” It’s technically true: The language from REAL ID directly requiring states to share information among themselves came out of PASS ID. But the requirements of the law will cause that information sharing to happen all the same.

Like REAL ID did, PASS ID would require states to confirm that “a person submitting an application for a driver’s license or identification card is terminating or has terminated any driver’s license or identification card” issued by another state.

How do you do that? You check the driver license databases of every other state. Maybe you do this by directly accessing other states’ databases; maybe you do this indirectly, through a “pointer system” or “hub.” But to confirm that you’re talking about the right person, you don’t just compare names. You compare names, addresses, pictures, and other biometrics.

Just like REAL ID, PASS ID would require states to share driver data on a very large scale. It just doesn’t say so. As with REAL ID, the security weaknesses of any one state’s operations would accrue to the harm of all others.

Mission Creep?

Second, CDT says that PASS ID “[l]imits the ‘official purposes’ for which federal agencies can demand a PASS ID driver’s license, thereby helping prevent ‘mission creep.’” Again, it’s technically true, but materially false.

REAL ID had an open-ended list of “official purposes” - things that the homeland security secretary could require a REAL ID for. PASS ID is not so open-ended, but that is a small impediment to only one form of mission creep.

PASS ID places no limits on how the DHS, other agencies, and states could use the national ID to regulate the population. It simply requires the DHS to use PASS ID for certain purposes. A simple law change or amendment to existing regulation would expand those uses to give the federal government control over access to employment, access to credit cards, voting - CDT’s own PolicyBeta blog called a plan to use REAL ID to control cold medicine a “terrifying” example of mission creep. And these are just the ideas that have already been floated.

When I testified before the Senate Judiciary Committee on REAL ID in May 2007, I spoke about what we had recently heard in a meeting of the DHS Privacy Committee:

Ann Collins, the Registrar of Motor Vehicles from the State of Massachusetts, … said, “If you build it, they will come.” What she meant by that is that if you compile deep data bases of information about every driver, uses for it will be found. The Department of Homeland Security will find uses for it. Every agency that wants to control, manipulate, and affect people’s lives will say, “There is our easiest place to go. That is our path of least resistance.”

PASS ID is the same medium for mission creep that REAL ID is. The problem is with having a national ID at all - not with what its enabling legislation says.

Privacy Protections?

Next, CDT says that PASS ID requires “privacy and security protections for PII stored in back-end motor vehicle databases.” (“PII” means “personally identifiable information.”)

A glaring oversight of REAL ID - and the competition for glaring oversights was fierce - was to omit any requirement for privacy and security of the databases states would maintain and share on behalf of the federal government. The DHS took pains in the REAL ID rulemaking to drain this swamp. It tried to require minimal information collection for identity verification and minimal information display on the card and in the machine readable zone. (It failed in important ways, as I will discuss below.) The REAL ID regulation required states to file security plans that would explain how the state would protect personally identifiable information. And it said it would produce a set of “Privacy and Security Best Practices.” None of this mollified REAL ID opponents, and the privacy bromides in the PASS ID Act won’t either.

One of the more interesting privacy “protections” in the PASS ID Act is a requirement that individuals may access, amend, and correct their own personally identifiable information. This is a new and different security/identity fraud challenge not found in REAL ID, and the states have no idea what they’re getting themselves into if they try to implement such a thing. A May 2000 report from a panel of experts convened by the Federal Trade Commission was bowled over by the complexity of trying to secure information while giving people access to it. Nowhere is that tension more acute than in giving the public access to basic identity information.

The privacy language in the PASS ID Act is a welcome change to REAL ID’s gross error on that score. At least there’s privacy language! But creating a national identity system that is privacy protective is like trying to make water that isn’t wet.

Limits on Use of Card Data?

CDT’s final defense of PASS ID is the presence of meager limits on how data collected from national ID cards will be used. Much like with mission creep, the statutory language is beside the point, but CDT points out that PASS ID “prohibits states from including the cardholder’s social security number in the MRZ and places limits on the storage, use, and re-disclosure of that information.”

“MRZ” stands for “machine-readable zone.” In the PASS Act and REAL ID Act, this is referred to as “machine-readable technology,” and in the REAL ID rulemaking, the DHS selected a 2D barcode standard for the back of REAL ID licenses and IDs. Think of government officials scanning your license the way grocery clerks scan your toilet paper and canned peaches.

It’s true that the PASS ID Act bars states from including the Social Security number in that easily scanable data, but it doesn’t prohibit anything else from being scanned - including race, which was included in DHS’ standard for REAL ID.

And don’t think that limits on the storage, use, and re-disclosure of card information would have any teeth. It would create a new crime: scanning licenses, reselling or trading information from them, or tracking holders of them “without lawful authority,” but it’s not clear what “without lawful authority” means. It would probably allow people to give implied permission for all this data-collection and -sharing by handing their cards to someone else. It would certainly allow governments to authorize themselves to collect and trade data from cards en masse.

Not that we should want this “protection.” The last thing we need is another obtusely defined federal crime. Nearly as bad as being required to carry a national ID is making it illegal for people to collect information from it when you want them to!

And in Some Ways PASS ID is Worse

But let’s talk some more about that machine-readable zone. When Congress passed REAL ID, suspicion was strong that the “MRZ” would be an RFID chip - a tiny computer chip that can be read remotely by radio.

Recognizing the insecurity of such devices - and the strong public opposition to it - DHS declined to adopt RFID for the REAL ID Act. It did, however, work with a few states and the U.S. State Department to develop an RFID-chipped license that it calls the “enhanced driver’s license.” This has a long read-range chip that will signal its presence to readers as much as fifteen or twenty feet away. The convenience gain DHS and State sought for themselves at the border would be a privacy loss, as scanning cards could become commonplace in doorways and other bottlenecks throughout the country - your whereabouts recorded regularly, as a matter of course, by public and private entities.

Why do we care about “enhanced drivers licenses”? Because the PASS ID Act would ratify them for use as national IDs. States could push their residents into using these chipped cards if they didn’t want to implement every last detail of PASS ID.

Needless to say, ID cards with long-distance (including surreptitious) tracking are a step backward for privacy. This is one sense in which PASS ID is worse than REAL ID.

Consider more carefully also what PASS ID and REAL ID are about in terms of biometrics. Both require states to “[s]ubject each person applying for a driver’s license or identification card to mandatory facial image capture.”

States across the country are using driver license photos to implement facial-recognition software that will ultimately be able to track people directly - nevermind whether you have an RFID-chipped license or show your card to a government official. They are aiming at preventing identity fraud, of course, but with advancing technology, before too long you will be subject to biometric tracking simply because you posed for an unsmiling digital photo at the DMV. REAL ID and PASS ID are part and parcel of promoting that.

Does PASS ID address “most of the major privacy and security concerns with REAL ID”? Not even close. PASS ID is a national ID, with all the privacy consequences that go with that.

Changing the name of REAL ID to something else is not an alternative to scrapping it. Scrapping REAL ID is something Senator Akaka (D-HI) proposed in the last Congress. Fixing REAL ID is an impossibility, and PASS ID does not do that.

UK Home Secretary Abandons National ID

The UK has been operating in parallel to the United States on the national ID question, and rumors about the collapse of the UK national ID have been circulating for a couple of years.

Now comes word that Home Secretary Alan Johnson will scrap the national ID card system, making it voluntary. When volunteers fail to materialize, it is easy to anticipate that it will disappear entirely.

This is another thing U.S. Homeland Security secretary Janet Napolitano might want to note as she struggles with with national ID issue here.

… But What Is “Cyber”?

Cyberwar. Cyberdefense. Cyberattack. Cybercommand.

You run across these four words before you finish the first paragraph of this New York Times story (as reposted on msnbc.com). It’s about government plans to secure our technical infrastructure.

When you reach the end of the story, though, you still don’t know what it’s about. But you do get a sense of coming inroads against Americans’ online privacy.

The problem, which the federal government has assumed to tackle, is the nominal insecurity of networks, computers, and data. And the approach the federal government has assumed is the most self-gratifying: “Cyber” is a “strategic national asset.” It’s up to the defense, intelligence, and homeland security bureaucracies to protect it.

But what is “cyber”?

With the Internet and other technologies, we are creating a new communications and commerce “space.” And just like the real spaces we are so accustomed to, there are security issues. Some of the houses have flimsy locks on the front doors. Some of the stores leave merchandise on the loading docks unattended. Some office managers don’t lock the desk drawers that hold personnel files. Some of the streets can be too easily flooded with water. Some of the power lines can be too easily snapped.

These are problems that should be corrected, but we don’t call on the federal government to lock up our homes, merchandise, and personnel files. We don’t call on the federal government to fix roads and power lines (deficit “stimulus” spending aside). The federal government secures its own assets, but that doesn’t make all assets a federal responsibility or a military problem.

As yet, I haven’t seen an explanation of how an opponent of U.S. power would use “cyberattack” to advance any of its aims. If it’s even possible, which I doubt, taking down our banking system for a few days would not “soften up” the country for a military attack. Knocking out the electrical system in one region of the country for a day wouldn’t let Russia take control of the Bering Strait. Shutting down Americans’ access to Google Calendar wouldn’t advance Islamists’ plans for a worldwide Muslim caliphate.

This is why President Obama’s speech on cybersecurity retreated to a contrived threat he called “weapons of mass disruption.” Fearsome inconvenience!

The story quotes one government official as follows:

“How do you understand sovereignty in the cyberdomain?” General Cartwright asked. “It doesn’t tend to pay a lot of attention to geographic boundaries.”

That’s correct. “Cyber” is not a problem that affects our sovereignty or the integrity of our national boundaries. Thus, it’s not a problem for the defense or intelligence establishments to handle.

The benefits of the online world vastly outstrip the risks - sorry Senator Rockefeller. With those benefits come a variety of problems akin to graffiti, house fires, street closures, petit theft, and organized crime. Those are not best handled by centralized bureaucracies, but by the decentralized systems we use to secure the real world: property rights, contract and tort liability, private enterprise, and innovation.

Obama’s First 100 Days: Mixed Record on Foreign Policy

Cato foreign policy experts weigh in on President Obama’s record in his first 100 days:

Christopher Preble, Director Foreign Policy Studies:

President Obama deserves credit for making a few modest changes in U.S. foreign and defense policy, and he has signaled a desire to make more fundamental shifts in the future. Some of these may prove helpful, while others are likely to encounter problems. In the end, however, so long as the president is unwilling to revisit some of the core assumptions that have guided U.S grand strategy for nearly two decades – chief among these the conceit that the United States is the world’s indispensable nation, and that we must take the lead in resolving all the world’s problems – then he will be unable to effect the broad changes that are truly needed.

Ted Galen Carpenter, Vice President Defense & Foreign Policy Studies; Christopher Preble:

On the plus side, Obama moved quickly to fulfill his most important foreign policy promise: ending the war in Iraq. That said, the policy that his administration will implement is consistent with the agreement that the outgoing Bush administration negotiated with the Iraqis. Given that the war has undermined U.S. security interests, and our continuing presence there is costly and counterproductive, Obama should have proposed to remove U.S. troops on a faster timetable.

Malou Innocent, Foreign Policy Analyst:

The jury is still out on the other major, ongoing military operation, the war in Afghanistan. That mission is directly related to events in neighboring Pakistan, which is serving – and has served – as a safe haven for Taliban supporters for years. President Obama deserves credit for approaching the problem with both countries together, and also in a regional context, which includes Iran, as well as India. Still unknown is the scope and scale of the U.S. commitment. President Obama has approved a nearly 50 percent increase in the number of U.S. military personnel in Afghanistan. Some have suggested that still more troops are needed, and that these additional troop numbers might prevail for 10-15 years. That would be a mistake. The United States should be looking for ways to increase the capacity of both Afghanistan and Pakistan to confront the extremism in their countries, and should not allow either to grow dependent upon U.S. military and financial support.

Christopher Preble and Ted Galen Carpenter:

On Iran, President Obama made the right decision by agreeing to join the P5 + 1 negotiations, but that is only a first step. The two sides are far apart and President Obama has not signaled his intentions if negotiations fail to produce a definitive breakthrough. Sanctions have had a very uneven track record, and are unlikely to succeed in convincing the Iranians to permanently forego uranium enrichment. If the Iranians are intent upon acquiring nuclear weapons, military action would merely delay Iran ’s program, and would serve in the meantime to rally support for an otherwise unpopular clerical regime, and a manifestly incompetent president.

Doug Bandow, Senior Fellow; Christopher Preble:

A related problem is North Korea’s ongoing nuclear program, an area where the president and his team seem to be grasping for answers. President Obama was mistaken if he believed that that the UN Security Council would render a meaningful response to Pyongyang’s provocative missile launch. It was naive, at best, for him to believe that even a strong rebuke from the UNSC would have altered Kim Jong Il’s behavior. The president must directly engage China, the only country with any significant influence over Kim. The North’s reckless and unpredictable behavior does not serve Beijing’s interests.

Benjamin Friedman, Research Fellow; Christopher Preble:

Obama and Defense Secretary Robert Gates are correct to apply greater scrutiny to bloated Pentagon spending, and to terminating unnecessary weapon systems, but the budget will actually grow slightly, at a time when we should be looking for ways to trim spending. If President Obama decided to avoid Iraq-style occupations, we could cut our ground forces in half. If we stopped planning for near-term war with China or Russia, the Air Force and Navy could be much smaller. Unless we commit to a grand strategy of restraint, and encourage other countries to provide for their own defense, it will be impossible to make the large-scale cuts in military spending that are needed.

Jim Harper, Director of Information Policy Studies; Benjamin Friedman; Christopher Preble:

Two other quick points. President Obama has moved away from some of the overheated rhetoric surrounding counterterrorism and homeland security, including dropping the phrase ‘War on Terror”. This was the right approach. The language surrounding the fight against terrorism is as important – if not more important – than the actual fight itself. Equally useful is his pledge to close the detention facility at Guantanamo Bay and his renunciation of the use of torture and other illegal means in the first against al Qaeda. These steps send an important message to audiences outside of the United States who cooperation is essential.

Ian Vasquez, Director, Center for Global Liberty & Prosperity; Juan Carlos Hidalgo, Project Coordinator for Latin America.

President Obama has signaled a slight change on US-Cuba policy by softening some travel and financial restrictions. It is not as far as we would have liked, but it is a step in the right direction – toward greater engagement, as opposed to more isolation, which was the approach adopted by the Bush administration.

For more research, check out Cato’s foreign policy and national security page.

Dust Off Your Tinfoil Hats

It’s official. Everyone supportive of federalism and/or upset about taxes, etc., is now considered a potentially dangerous “rightwing extremist” by Homeland Security.

From all around the web:

A footnote attached to the report by the Homeland Security Office of Intelligence and Analysis defines “rightwing extremism in the United States” as including not just racist or hate groups, but also groups that reject federal authority in favor of state or local authority.