Nov 21 2018

REAL-ID database still lacks basic protections

[As of August 2017, this was one of the two highest priorities for the SPEXS/S2S governance committee — but still unresolved.]

There is still no way to find out whether there’s a record about yourself in the national REAL-ID database, or what information that record contains, or to correct it. This has been recognized as a priority by the state officials who indirectly “govern” the contractors who operate the database. But years have passed, and nothing has been done to address the problem, even as the database has grown to include information about more than 50 million US residents.

How has this been allowed to happen?

The most significant requirement for US states and territories that choose to comply with the Federal REAL-ID Act of 2005 is participation in the national ID database, SPEXS.

But while SPEXS has been developed to enable state submission to Federal requests, development and operation of the SPEXS has been outsourced to the American Association of Motor Vehicle Administrators, a nominally-private nonprofit corporation, and a for-profit AAMVA contractor, Clerus Solutions. Neither AAMVA nor Clerus Solutions are directly subject to any Federal or state government transparency laws.

Federal funding for SPEXS from the DHS has been laundered through grants to states, keeping the Feds at arms length from AAMVA, Clerus Solutions, or any direct oversight of, or accountability for, SPEXS. We have requested DHS records of these grants, but the DHS has yet to produce them. Just today — well after the deadline for the DHS to respond to our request  — we got a message  claiming that the FOIA office to which our request has been referred isn’t sure what we want, and asking us to “clarify” our request.

In the meantime, the main sources of information about the build-out of SPEXS into a comprehensive national database of drivers licenses and state-issued ID cards have been responses to requests to state driver licensing agencies (DLAs in AAMVA-speak) under state public records laws.  If you want to request these records from your state DLA, here’s a 2017 list of state points of contact for participants in SPEXS and the AAMVA subcommittee for privatized “governance” of SPEXS.

This list is part of the latest batch of records released by the Wisconsin Department of Motor Vehicles (the first participant in SPEXS) in response to a  request under that state’s open records law.

Among other details, these records confirm that as recently as August 2017, AAMVA still had not  agreed on any procedure by which an individual could find out whether there is a record about them in the SPEXS database, or what information it contains. No system for handling access or correction requests had been established, even though by that time the SPEXS database contained information about 50 million people.

We asked AAMVA’s Chief Privacy Officer about this in early 2016. Nothing was done. Members of the S2S/SPEXS governance committee were polled in 2017, and identified this as one of their two highest priorities. Still, another year later, nothing has been done.

Apparently, AAMVA is reluctant to accept “responsibility and potentially liability” for the accuracy of the data it is maintaining and disseminating. As we have previously reported, these problems with SPEXS mirror those of the NCIC database of unverified arrest and criminal history data aggregated and maintained by the FBI, but for whose accuracy the FBI disclaims any responsibility.

AAMVA and state DLAs are aware of the significance of this problem, but have done nothing to correct it.  We’ve seen no evidence that AAMVA or the states have taken any action to address this, even as the number of records in SPEXS grows.

AAMVA continues to try to suppress information about what data is contained in SPEXS, and how the system operates. But this table of fees assessed to states participating in S2S and SPEXS shows the numbers of drivers licenses for which data was included in SPEXS as of September 2017. The number of SPEXS records is much higher, since SPEXS also includes records for non-driver ID cards issued by participating states.

An email message from AAMVA on April 19, 2018, gave the following calendar for additional states planning to upload their residents’ drivers license and ID data to SPEXS:

New Mexico (NM) is the next state poised to benefit from the S2S functionality following Pennsylvania (PA). This will occur over the weekend of June 16th, 2018….

Following NM, Several states will be joining the S2S program in the upcoming months. The table below reflects these states and their planned implementation dates.

State – Implementation Date:

  • Mississippi – August 13, 2018
  • Washington – September 4, 2018
  • Louisiana – October 22, 2018
  • North Carolina – December 3, 2018
  • Utah – January 28, 2019
  • Illinois – February 2019 (Preliminary)
  • Missouri -March 4, 2019
  • Maine – May 6, 2019
  • Rhode Island – June 3, 2019
  • Texas -July 1, 2019
  • Minnesota – September 2019 (Preliminary)
  • South Carolina – October 21, 2019
  • Montana – November 2019 (Preliminary)

Please note that states are encouraged to avoid these weekends for performing maintenance or deployment activities that require the Central Site to be available.

2 thoughts on “REAL-ID database still lacks basic protections

  1. Pingback: Drivers’ license data sold to businesses, given to Feds – Papers, Please!

  2. Pingback: ACLU: “Digital IDs Could Be a Nightmare” – Papers, Please!

Leave a Reply

Your email address will not be published. Required fields are marked *