Papers, Please!

The Identity Project

Category Archives: REAL ID

Oct 02 2008

Congress Passes Continuing Resolution, Includes $100M for REAL ID

Over the weekend, Congress passed H.R. 2638, a Fiscal Year 2009 Continuing Resolution that includes funding for federal agencies though March. President Bush signed the bill into law earlier this week. H.R. 2638 includes a provision granting $100 million for state implementation of REAL ID. (These funds are in addition to the $79 million in grants DHS gave to states for REAL ID implementation earlier this year.)

H.R. 2638 reads:

SEC. 547. For grants to States pursuant to section 204(a) of the REAL ID Act of 2005 (division B of Public Law 109-13), $50,000,000, to remain available until expended. In addition, for developing an information sharing and verification capability with States to support implementation of the REAL ID Act, $50,000,000, to remain available until expended: Provided, That none of the funds provided in this section for development of the information sharing and verification system shall be available to create any new system of records from the data accessible by such information technology system, or to create any means of access by Federal agencies to such information technology system other than to fulfill responsibilities pursuant to the REAL ID Act of 2005.

“Verification hub” is just the latest euphemism for the national identification system DHS seeks to create by linking the motor vehicle databases of all 56 states and territories. This massive national database could contain data on all 240 million driver’s license and cardholders nationwide, if all the states and territories agree to implement the national ID system. Read More →

Sep 29 2008

New York Begins Issuing RFID-Enabled “Enhanced” Driver’s Licenses

The state of New York has begun issuing (pdf) so-called “enhanced” driver’s licenses (or EDLs). These licenses contain RFID tags and include the individual’s citizenship status on the face of the cards. They are issued under the Department of Homeland Security’s “Western Hemisphere Travel Initiative” and will be used as alternatives to passports for crossing the US border.

According to DHS, the “long-range” RFID tag would include a unique number that Customs and Border Protection would “read” as you drove up to the checkpoint and use that unique number to link to your individual name and file. (Such long-range tags can be read from a distance of 70 feet or more.) There are numerous privacy and civil liberty problems connected with using RFID tags in identification documents. Some EDL critics would surprise you: the RFID industry, the Government Accountability Office, and the DHS’s own Data Privacy and Integrity Advisory Committee.

The DHS Data Privacy and Integrity Advisory Committee urged (pdf) that long-range RFID only be used in ID documents if RFID is the “least intrusive means,” because there are significant privacy and security drawbacks.

The Government Accountability Office also has urged (pdf) against the use of RFID to track people, testifying that: Read More →

Jul 10 2008

Auditor: Colorado DMV Security So Poor That It Puts Cardholders At Risk of Identity Theft

A report from the Colorado State Auditor reveals that the state DMV’s data security system is so flawed that it puts the personal information of 3.4 million driver’s license and state ID cardholders at risk of identity theft or fraud. The State Auditor told the Colorado legislature that, among other things, the Colorado DMV “does not have adequate processes for mitigating the risk of employee-perpetrated fraud or measuring the effectiveness of its improvements to the issuance system” and “the Department’s management of information security is fragmented, disorganized, and poorly planned.”

The State Auditor explained that the DMV transmitted large batches of personally identifiable data unencrypted. “These batch transmissions could be intercepted by unscrupulous individuals and expose Colorado residents to identity theft and other criminal activity.” A significant problem is that “the Department lacks a tracking mechanism for collecting and analyzing statistics on the effectiveness of its controls for preventing fraudulent issuances [of licenses or ID cards]. As such, the Department cannot determine whether additional controls or system enhancements are needed.”

Under the REAL ID national identification system being pushed by the US Department of Homeland Security, the databases of 56 states and territories would be linked, allowing any individual state to access all of the others’ information. This massive, centralized system would include the personal data of 245 million license and ID cardholders nationwide. It would be a tempting target for identity thieves, because if a criminal could break just one state’s data security system, then he would have access to the sensitive data retained by all 56 states and territories.

Jun 27 2008

Target Store Scans Driver’s License / ID Card Data

George Hulme at InformationWeek has an interesting story about a Target store scanning his driver’s license when he went to buy Nicorette gum:

Now, during checkout, the cashier asks to “see” my driver’s license. Alright, since I’ve been carded before buying controlled substances, I figure she needs to check my age.

Before I have a chance to realize exactly what’s going on, the cashier swipes my driver’s license through the register. The machine then kicks and spasms out my receipt. Whoa!

I inquire, “What information, if any, was captured from my license?”

I get that deer-in-the-headlights what-ya-talk’n-bout glaze. She’d never thought about, or was apparently never asked, why she was physically scanning driver’s licenses.

“You asked to ‘see’ my license, but you swiped it. Big difference,” I say.

The cashier has no idea how to answer his question. Hulme leaves a message at Target’s press office asking for information as to whether his data was merely scanned to verify age or if all of his license data was downloaded by Target; if so what was the reason for this data capture and how long were they going to keep his data. No answer. He also e-mailed Target customer service and got a response. But it was a non-response. Read his full story.

Note that the final regulations for the REAL ID national identification system includes an unencrypted machine-readable zone. This means that anyone with an off-the-shelf card reader could swipe and download your personal data. And DHS Secretary Chertoff wants everyone to use this national ID card to “cash a check, hire a baby sitter, board a plane or engage in countless other activities,” so all of those situations could lead to your data being downloaded and retained.

Has your license or ID card data been swiped and retained by a store, bank, bar, club or other business? Tell us about it. E-mail jph AT papersplease.org

Jun 24 2008

AAMVA Is Big Winner in DHS Grants to States for REAL ID Implementation

DHS recently announced $79 million in grants to states for REAL ID implementation. DHS said it “awarded $17 million to Missouri to lead the development of the verification hub. Four other states – Florida, Indiana, Nevada, and Wisconsin – will each receive $1.2 million to partner with Missouri for verification hub testing and implementation.”

Homeland Security Today investigated the details of the grants, and it’s clear that AAMVA is the big winner. The site reveals, “The breakdown of awards, obtained by HSToday.us, signifies that AAMVA effectively gains a no-bid contract under the awards, as DHS designates it the sole national centralized database of driver’s license information under REAL ID through a grant award to the state of Missouri.” (emphasis ours).

DHS sources told Homeland Security Today, “A competitive grant process could have resulted in multiple hub awards instead of a sole-source contract to AAMVA, sources argue, decentralizing REAL ID information somewhat and encouraging the rise of the most effective database solution between competing vendors.”

It is not surprising that DHS would ensure there would be a single database system. Currently, the states all have their own databases. The point of the REAL ID national identification system is to meld the information from 56 states and territories and create a single database filled with the personal data of all 240 million license and ID cardholders nationwide.

Jun 23 2008

Department of Homeland Security Gives States $79M for REAL ID Implementation

The Department of Homeland Security announced $79 million in grants to states for implementation of the REAL ID national identification system. The funds will go to projects “such as collecting applicants’ photos at the start of the application process and incorporating additional physical security features into DLs and IDs. Other funded projects that advance REAL ID implementation, include transitioning to centralized DL and ID production, improving data records for driver’s licenses, and upgrading source document imaging and storage.”

DHS also wants the states to use the funds to create a central “verification hub that will enable states to query federal and non-federal document-issuing authorities and verify applicant source documents.” “Verification hub” is DHS’s latest euphemism for the national identification system it seeks to create by linking the motor vehicle databases of all 56 states and territories, which the agency hopes will contain data on all 240 million driver’s license and cardholders nationwide.

Twenty states have passed anti-REAL ID legislation. The latest was Arizona. Last week, its governor signed into law a bill that prohibits Arizona from implementing the REAL ID system.

Read IDP’s comments on the draft regulations here (pdf). Our privacy and civil liberty arguments remain even with the final regulations. No national identification system should ever be created, whether under REAL ID or any other scheme.

Mar 31 2008

ID Still Not Required To Fly

As reported several weeks ago and in accordance with the Gilmore decision, ID is not required to fly in the United States. Two recent documents have corroborated this fact. The first is today’s letter from South Carolina Governor Sanford to DHS in which he does not ask for an extension to comply with Real ID, but he does reference on its last page the Gilmore decision and the court’s determination therein that there is no ID to fly requirement.

The second is a letter from DHS dated March 22, 2008 to a private individual who queried DHS on their identification to fly policy after seeing signs in airports stating ID was required to fly despite the 9th Circuit’s ruling in Gilmore. This letter states that ID is, in fact, not required to fly domestically, despite DHS’ mis-truths printed on signs at airports.

This letter is important because the law that governs ID requirements to travel by air in the United States is identified by the Secretary of TSA to be Sensitive Security Information (“SSI”) meaning its release would be “detrimental to the safety of transportation” – meaning it’s “secret law” – meaning we can’t tell when the law has changed. All we are now allowed to know is that the law has not changed as of March 22, 2008.

We prefer the Federal Register as the resource for being alerted as to a change in the laws as opposed to DHS’ random corrections to their continuous mis-truths printed up on signs in our nation’s airports.

Mar 10 2008

IDP Helps Forment REAL ID Rebellion In California

After a long and uncharacteristic silence, the State of California is finally weighing-in on the national ID card debate: the anti-REAL ID Assembly Joint Resolution 51 was introduced today by Transportation Committee Chairman Pedro Nava.

At the Assembly’s invitation, IDP Director Jim Harrison was instrumental in drafting the Resolution: go Jim!

More on the Resolution can be read over at Ryan “That’s a shovel, not a spade” Singel’s webular log, 27 B-6.

Feb 03 2008

Will you really need a “REAL-ID” to fly? No.

There’ve been a lot of scary reports lately about how, if your state governor doesn’t “volunteer” to collaborate with the Department of Homeland Security’s “REAL-ID” scheme for a distributed national identity card and linked databases of personal information about every American resident, the DHS won’t “allow” you to board any airline flight in the U.S. of A.

What’s the skinny?

It’s an empty threat, designed to intimidate citizens, state legislators, and governors. You’ll still have a legal right to travel, even by air, even if your state opts out of compliance with the REAL-ID Act.

The DHS does have plans to require everyone who wants to fly to carry government-issued papers and get permission for each flight from the DHS. The DHS is already trying to put some of those into effect this month for international travel, and has proposed to extend them to domestic flights as part of Secure Flight.

But those other rules are independent of the REAL-ID Act, and don’t yet affect domestic air travel. Nothing in the REAL-ID law or regulations would require you to show ID to fly.

Don’t be scared. Ignore the empty threats. Stand up for your rights, and fly freely — with or without papers or permission.