Today the Transportation Security Administration (TSA) published new regulations for the REAL-ID Act in the Federal Register, finalizing a bizarre and clearly illegal proposal the agency made in September 2024.

The new TSA regulations leave it even more unclear than before who the TSA will allow to fly without ID, and who it will prevent from flying without ID, after May 7, 2025.

Rather than establishing standards applicable to demands for ID by all Federal agencies, the new TSA regulations purport to authorize the TSA itself as well as other Federal agencies to establish agency-specific plans for selective enforcement of REAL-ID Act requirements.

These “graduated enforcement plans” will be regulations in all but name, and the TSA seems to think that they  will have the force of law. But these graduated enforcement plans won’t be standardized, and may vary from agency to agency, contrary to the plain mandate of the REAL-ID Act for the Department of Homeland Security to promulgate standards for ID applicable to all Federal agencies.

“Graduated enforcement plans” will be promulgated summarily, solely by posting on different Federal agency websites, without notice, opportunity for public comment, or publication in the Federal Register. In effect, the TSA is trying to opt itself and all other Federal agencies out of the most basic  transparency, procedural, and due process requirements of the Administrative Procedure Act (APA).

In its analysis of the 11,000 comments submitted in response to its Notice of Proposed Rulemaking  (NPRM), the TSA acknowledges our objection to its attempt to re-delegate rulemaking authority to other agencies and opt out of APA requirements. But the TSA claims that “graduated enforcement plans” posted on agency websites won’t be “regulations”, even if they are claimed to authorize decisions about who can and can’t exercise rights.

The TSA also brushes off a wide range of Constitutional and statutory objections to the proposed regulations as “outside the scope of this rulemaking”.

It remains to be seen whether the new REAL-ID regulations will be challenged on APA and/or other grounds.

In response to our objection to statements in (NPRM) implying that after the effective date of the new regulations ID would be required to fly, the TSA says  as follows:

Upon full card-based enforcement, TSA may not accept noncompliant State-issued DL/IDs at security screening checkpoints for the purpose of boarding federally regulated commercial aircraft. This rule does not otherwise effect TSA’s policies related to acceptable forms of identification and identity verification.

If this is true, it means that the procedures for travel without ID (as distinct from any procedures for travel with noncompliant state-issued ID) won’t change.  But we won’t know for sure until after May 7, 2025, how the TSA will deal with air travelers without any ID.

The dilemma for the TSA is that enforcing the REAL-ID Act by turning away air travelers at TSA checkpoints if they don’t have compliant IDs would cause difficult-to-manage backups of disgruntled would-be travelers who are denied passage through TSA checkpoints, but Congress has not yet been willing to give serious consideration to repeal of the REAL-ID Act.

The TSA’s workaround is to say, in its new regulations, that the prohibition in the REAL-ID Act on acceptance for Federal purposes of noncompliant IDs will be “enforced” beginning May 7, 2025, but not “fully” enforced until May 5, 2027. During the intervening two years, the TSA and other agencies will have discretion (discretion granted by the TSA to itself through its new regulations, not discretion granted by the REAL-ID statute) to enforce the REAL-ID Act selectively, in accordance with agency-specific “graduated enforcement plans”.

Selective enforcement without the guardrails of administrative due process provided by the APA is an invitation to arbitrariness. It’s especially harmful in this situation, in which it will form the basis of decisions to prevent individuals from exercising their right to travel by common carrier.

In its analysis of its new regulations, the TSA says it expects that only 4% of Federal agencies (including the TSA itself) will adopt graduated REAL-ID enforcement plans. It could be that only the TSA will do so. If so, this further supports the inference that the real goal of the TSA is not to give other agencies flexibility to adopt different enforcement schemes, but to try to grant itself greater discretion than Congress granted it to engage in arbitrary actions and to change its enforcement procedures and criteria without warning.

The TSA suggests — by way of example and without limitation — that “graduated” enforcement might mean limiting the number of times or time period during which an individual would be allowed to use a noncompliant ID for a particular purpose. For example, someone might be told that they could be allowed through TSA checkpoints at airports only twice, or only for a week after first doing so, with a noncompliant ID, after which they would have to either show compliant ID or be treated as someone with no ID.

Any enforcement scheme like this would require, as the TSA notes in its analysis of its new regulations, keeping records of who passes through checkpoints with noncompliant IDs. And identifying travelers (or requiring them to identify themselves) is the enabler for both surveillance and control of travel.

There would be no basis in either the REAL-ID Act or these regulations for including travelers without ID in a system of records of travelers with noncompliant ID, or limiting the number of times that someone can travel with no ID. A graduated TSA enforcement plan like this would likely prompt more people to travel with no ID at all rather than trying to travel with noncompliant ID that could only be used a few times or for a limited time.

We wouldn’t be surprised, however, to see the TSA propose to treat travelers without ID the same as travelers with noncompliant ID, require travelers without ID to provide additional information, and limit the number times that they can fly with no ID. Any such proposal or practice would exceed the authority granted to the TSA by the REAL-ID Act, and be subject to challenge. Impose a requirement to have, carry, or show ID to travel by common carrier — even if it would be Constitutional, which we doubt — would require action by Congress.

Logging travelers with noncompliant IDs would require notice-and-comment promulgation of a System Of Records Notice (SORN) pursuant to the Privacy Act, and an application for approval of this collection of information by the Office of Management and Budget (OMB) pursuant to the Paperwork Reduction Act (PRA).

Given the required comment periods and time required for approval, we assume that the TSA is already working on these Privacy Act and PRA notices, and plans to publish them soon in the Federal Register. And sometime between now and May 7, 2025, although possibly only at the last minute, we expect the TSA to post its own “graduated enforcement plan” for airport checkpoints somewhere on its website. Stay tuned!