Papers, Please!

The Identity Project

Monthly Archives: October 2023

Oct 16 2023

The TSA wants to put a government tracking app on your smartphone

Today the Identity Project submitted our comments to the Transportation Security Administration (TSA) on the TSA’s proposed rules for “mobile driver’s licenses”.

The term “mobile driver’s license” is highly misleading. The model Electronic Credential Act drafted by the American Association of Motor Vehicle Administrators (AAMVA) to authorize the issuance of these digital credentials and installation (“provisioning”) of government-provided identification and tracking apps on individual’s smartphones provides that, “The Electronic Credential Holder shall be required to have their Physical Credential on their person while operating a motor vehicle.”

So the purpose of “mobile driver’s licenses” isn’t actually licensing of motor vehicle operators, as one might naively assume from the name. Rather, the purpose of the “mobile drivers license” scheme is to create a national digital ID, according to standards controlled by the TSA, AAMVA, and other private parties, to be issued by state motor vehicle agencies but intended for use as an all-purpose government identifier linked to a smartphone and used for purposes unrelated to motor vehicles.

We’ve seen the ways that government-mandated tracking apps on citizens’ smartphones are used by the government of China, and that’s not an example we want the US to follow.

AAMVA’s website is more honest about the purpose and planned scope of the scheme: “The mobile driver’s license (mDL) is the future of licensing and proof of identity.”

As we note in our comments:

The fact that the TSA seeks to require the installation of a government app on a mobile device of a certain type suggests that the government has other purposes than mere “identification”, such as the ability to track devices as well as people. But we don’t know, because we haven’t been able to inspect the source code for any of these apps.

Most of the details of the TSA proposal remain secret, despite our efforts to learn them. So our comments focus on the unanswered questions about the proposal, the deficiencies in the TSA’s “notice”, and the TSA’s failure to comply with the procedural requirements for consideration of proposed regulations and for approval of collections of information from members of the public — which the TSA is already carrying out illegally, without notice or approval, with digital ID apps that state agencies are already installing on smartphones:

By this Notice of Proposed Rulemaking (NPRM), the Transportation Security Administration (TSA) proposes to establish “standards” (which are not included in the NPRM and not available to the public) for a national digital ID to be used by Federal agencies in an unknown range of circumstances for unknown purposes (also not specified in the NPRM, and for which the notices and approvals required by law have not been provided or obtained).

The NPRM, which includes a proposal to incorporate by reference numerous documents which are not included in the NPRM and have not been made available to would-be commenters who have requested them, fails to provide adequate notice of the proposed rule or opportunity to comment on the undisclosed documents proposed to be incorporated by reference. It violates the regulatory requirements for incorporation by reference of unpublished material….

The proposed rule would also implicitly incorporate the Master Specification for State Pointer Exchange Services (SPEXS) published by the American Association of Motor Vehicle Administrators (AAMVA), which is not included or mentioned in the NPRM or publicly available and which AAMVA has actively attempted to remove from public availability….

The NPRM purports to include an analysis, pursuant to the Paperwork Reduction Act (PRA), of “the information collection burdens imposed on the public,” and claims to have requested approval for these information collection from the the Office of Management and Budget (OMB). But both the NPRM and the request for OMB approval omit any mention of the collection of information from individuals that occurs each time a “mobile ID” is “presented” and an app on a mobile device interacts with TSA or other Federal agency devices or servers….

What data fields will be collected when a TSA or other Federal agency device interacts with a mobile ID app on an individual’s device? We don’t know. What code will an individual be required to allow to run on their device, and with what privileges? We don’t know, although this could be critical to the risks and potential costs to individuals if, for example, they are required to allow closed-source code to run on their devices with root privileges.

From which people, how many of them, in what circumstances, and for what purposes, will this information be collected? We don’t know, although all of this is required to be included in an application for OMB approval of a collection of information….

What will individuals be told about whether these collections of information are required? We don’t know this either, although this is a required element of each PRA notice, because the TSA provides no PRA notices to any of those individuals from whom it collects information at its checkpoints, including information collected from mobile IDs.

As the TSA itself has argued in litigation, no Federal statute or regulation requires airline passengers to show ID. And hundreds of people pass through TSA checkpoints and board flights without showing ID every day. An accurate submission to OMB, and an accurate PRA notice (if approved by OMB), would inform all individuals passing through TSA checkpoints that ID is not required for passage. But instead of providing OMB-approved PRA notices at its checkpoints in airports, the TSA has posted or caused to be posted knowingly false signage claiming that all airline passengers are “required” to show government-issued ID credentials. Individuals incur substantial costs as a result of these false notices, particularly when individuals without ID forego valuable travel in reliance on deliberately misleading signs that ID is required.

Read More →

Oct 09 2023

The difference between stating your name and showing ID

The 11th Circuit Court of appeals has ruled that it is clearly established law that even in a state with a “stop-and-identify” law, and even if police reasonably suspect you of a crime, police may not require you to show ID or arrest you if you refuse to do so.

We don’t think people should be required to identify themselves. Self-identification can amount to self-incrimination, and compelling individuals to answer any question from police or other government agents would violate the Constitutional right not to be compelled to give evidence against oneself. You have the same right to remain silent if police ask, “What is your name?” as you have if you are asked any other question.

Despite this bedrock principle, some states have passed “stop and identify” laws of dubious Constitutionality that purport to require people to identify themselves on demand to any law enforcement officer who reasonably suspects them of a crime.

Even in those states, however, there’s a fundamental difference between being required to state your name verbally and being required to have, to carry, or to show ID credentials.

That distinction was central to the decision of the US Supreme Court in Hiibel v. Nevada, in which the court didn’t reach the question of whether a law requiring suspects to “show” ID would be Constitutional because it found that Mr. Hiibel could have satisfied the Nevada “stop and identify” law by verbally stating, “My name is Dudley Hiibel.”

Other cases in the lower courts since Hiibel have touched on this issue, but until now, none that we are aware of has depended squarely on this distinction between stating your name and showing ID.

The clarity and significance of the 11th Circuit panel’s opinion in Edger v. McCabe makes it worth quoting at length:

The facts of this case are not in dispute, as the entirety of the encounter between Mr. Edger and the police was captured on the police officers’ body-worn and dash cameras….

Mr. Edger is a mechanic in Huntsville, Alabama….. One of Mr. Edger’s longtime clients is Kajal Ghosh, who owns a red Toyota Camry. The Camry is primarily driven by Mr. Ghosh’s wife, who works as a teacher at Progressive Union Missionary Baptist Church. One or
two days before June 10, 2019, Mr. Ghosh called Mr. Edger and reported that the Camry had broken down while his wife was working at the Church. He asked Mr. Edger to fix the car and told him the keys would be waiting for him at the Church’s front office.

On June 10, around 2 p.m., Mr. Edger went to the Church to pick up the keys and to inspect the Camry. He determined something was wrong with either the car’s steering or its tires, and he concluded he would need to come back later with tools to fix the car. That evening, he returned to the Church with his stepson, Justin Nuby, in tow, intending to either fix the Camry on-site or to take it back to the shop for further repairs. Mr. Edger and Mr. Nuby drove a black hatchback to the Church.

After Mr. Edger and his stepson entered the Church’s lot, the Church’s security guard observed them and grew concerned…. At about 8:05 p.m., the security guard called 911 and told dispatch: “I have two Hispanic males, messing with an employee’s car that was left on the lot.”

Police arrived, and the court describes what the video evidence showed as follows:

Mr. Edger continued to work, and the following conversation began:

Officer McCabe: What are y’all doing?

Mr. Edger: Getting the car fixed.

Officer McCabe: Is this your car?

Mr. Edger: Yeah, well, it is one of my customer’s.

Officer McCabe: One of your customer’s?

Mr. Edger: Ghosh Patel, yep. I was over here earlier….

From here, the interaction rapidly escalated:

Officer McCabe:  Alright. Take a break for me real fast and do y’all have driver’s license or IDs on you?

Mr. Edger: I ain’t going to submit to no ID. Listen, you call the lady right now. Listen I don’t have time for this. I don’t mean to be rude, or ugly, but …

Officer McCabe: Okay. No, you need to—

Mr. Edger: I don’t mean to be—

Officer McCabe: —give me your ID or driver’s license.

Mr. Edger: No. I don’t. Listen, I don’t want you to run me in for nothing.

Officer McCabe: Are you refusing me—are you refusing to give me your ID or driver’s license?

Mr. Edger: I’m telling you that if you will call this lady that owns this car—

In the middle of Mr. Edger’s sentence, as he was attempting to explain the situation to Officer McCabe, Officer Perillat seized Mr. Edger from behind. He led Mr. Edger to the side of the Camry and started handcuffing him. As Mr. Edger protested, Officer Perillat told Mr. Edger: “We don’t have time for this,” and, “You don’t understand the law.” During this time, the video shows that Mr. Edger offered his driver’s license at least three times before the officers could finish handcuffing him. Eventually, the officers managed to handcuff and search Mr. Edger, and then detain him in a squad car. Throughout this process, the officers never asked Mr. Edger or his stepson for their names or addresses….

Mr. Edger was charged with obstructing governmental operations in violation of Alabama Code § 13A-10-2(a)(1). The City of Huntsville dropped all charges relating to this incident. After the dismissal of the charges, Mr. Edger filed a § 1983 civil rights lawsuit, alleging a false arrest in violation of his Fourth Amendment rights against unlawful searches and seizures, as well as a state law false arrest claim….

Turning now to the defendant’s theory that probable cause existed to support Mr. Edger’s arrest because he violated Alabama’s Stop-and-Identify statute, Alabama Code § 15-5-30. The Stop-and-Identify statute allows an Alabama police officer who “reasonably suspects” a crime is being, has been, or is about to be committed to stop a person in public and “demand of him his name, address and an explanation of his actions.” Id.

Mr. Edger argues that he cannot possibly have violated § 15-5-30, because it clearly delineates three things the police may ask him for: his name, his address, and an explanation of his actions. He argues nothing in the statute requires him to produce physical identification, and that Officer McCabe’s question, “Do y’all have driver’s license or IDs on you?” and repeated references to “IDs” were clearly demands for him to produce physical identification of some kind. He notes that physical identification is not one of the three enumerated things that the police may ask for under Alabama law, and that he was never asked for his name or address.

We agree with the district court’s assessment that Mr. Edger did not actually violate § 15-5-30… Section 15-5-30 does not require anyone to produce an “ID” or “driver’s license” as Officer McCabe demanded. Indeed, it does not require anyone to produce anything. Instead, it grants Alabama police the authority to request three specific pieces of information. Here, the video evidence is clear that neither Officer McCabe nor Officer Perillat asked for Mr. Edger’s name or address. Additionally, Mr. Edger’s objection was clearly related to the unlawful demand that he produce physical identification…. Because the Alabama statute, by its plain text, does not permit the police to demand physical identification, the officers lacked probable cause and thus violated Mr. Edger’s Fourth Amendment rights by arresting him….

We hold that the plain text of the Alabama statute is so clear that no reasonable officer could have believed they could arrest Mr. Edger for failing to produce his “ID” or “driver’s license” under § 15-5-30….

[T]he broad background rule is that the police may ask members of the public questions and make consensual requests of them, Florida v. Bostick, 501 U.S. 429, 434–35 (1991) (collecting cases and examples), “as long as the police do not convey a message that compliance . . . is required.” Id. at 435. But the person “need not answer any question put to him; indeed, he may decline to listen to questions at all and may go on his way.” Florida v. Royer, 460 U.S. 491, 497–98 (1983)….

[T]he Alabama statute is clear. It lists only three things that the police may ask about. This is not an issue of “magic words” that must be uttered. There is a difference between asking for specific information: “What is your name? Where do you live?” and demanding a physical license or ID. The information contained in a driver’s license goes beyond the information required to be revealed under § 15-5-30. Compare Ala. Code § 32-6-6 (“Each driver license . . . shall contain a distinguishing number assigned to the licensee and a color photograph of the licensee, the name, birthdate, address, and a description of the licensee . . . .”), and Ala. Code § 22-19-72 (requiring that there be “a space on each driver’s license . . . to indicate in appropriate language that the [licensee] desires to be an organ donor”), with Ala. Code § 15-5-30 (“A [police officer] may stop any person abroad in a public place whom he reasonably suspects is committing . . . a [crime] and may demand of him his name, address and an explanation of his actions.”).

Further, neither the parties nor our own research can identify any Alabama law that generally requires the public to carry physical identification—much less an Alabama law requiring them to produce it upon demand of a police officer. There simply is no state
law foundation for Officer McCabe’s demand that Mr. Edger produce physical identification

So to summarize, it has been clearly established for decades prior to Mr. Edger’s arrest that the police are free to ask questions, and the public is free to ignore them. It has been clearly established prior to Mr. Edger’s arrest that any legal obligation to speak to the
police and answer their questions arises as a matter of state law. And the state statute itself in this case is clear and requires no additional construction: police are empowered to demand from an individual three things: “name, address and an explanation of his actions.” Ala. Code § 15-5-30. It was thus clearly established at the time of Mr. Edger’s arrest that she could not demand he produce physical identification. And because Officer McCabe’s demands for an “ID” or a “driver’s license” went beyond what the statute and state law required of Mr. Edger, she violated clearly established law. Under this set of facts and these precedents, no reasonable officer could have believed there was probable cause to arrest Mr. Edger for obstructing governmental operations by violating § 15-5-30. And this theory cannot support the grant of qualified immunity to the officers.

We welcome this decision and commend it to the attention of other courts and other cops.