REAL ID – Page 9 – Papers, Please!

Feb 23 2015

REAL-ID Act implementation, enforcement, and resistance

Is gradual implementation of the REAL-ID Act cooking us slowly, like frogs who, if the temperature of the water is increased gradually enough, don’t realize that they need to jump out of the pot until it’s too late?

Last month was another of the deadlines set by the Department of Homeland Security for “implementation” and “enforcement” of the REAL-ID Act. That also makes it time for stepped-up resistance to REAL-ID.

Understanding the meaning of this deadline, and the remaining deadlines to come, requires some background. Below is an overview of what the REAL-ID Act is, how and by whom it will be implemented and enforced, what it means to “comply” with the REAL-ID Act, what we can expect to happen next, and — perphaps most importantly — what we can do, now, to resist it.

[See this 15-minute video for an introduction to the REAL-ID Act, and the REAL-ID category in this blog for more recent updates.]

The REAL-ID Act of 2005 is a Federal law intended to mandate the creation of a distributed but integrated national database of personal identity records (including birth certificates or alternative “breeder documents” [sic]) linked to state-issued identity credentials. The REAL-ID Act also includes Federal standards for the physical ID cards, including drivers’ licenses or alternative non-driver ID cards, issued by US states and territories. But the real focus is on the database: what data will be included and how it will be normalized and made accessible through a single user query interface.

The Federal government can, and often does, bribe states with Federal funding to do things the way the Feds want. But the REAL-ID Act didn’t include funding for state-level implementation, and was based (like many other DHS programs, such as its multi-billion dollar mandates for modifications to airline IT systems to support surveillance and control of air travelers) on gross underestimates of its cost. In any event, some states strongly opposed the whole idea of a national ID scheme, and would probably have declined to participate even if the Feds had been willing to foot the bill.

The states already manage the issuance of drivers’ licenses and non-driver ID cards, which are most US citizens’ primary government-issued identity credentials. Setting up a Federally-administered ID credential system would have been vastly more expensive and politically controversial than leaving it to the states.

So the problem for the architects of “REAL-ID” was how to induce all the states and territories to “comply” with goals and standards that would neither be officially binding on the states, nor financed by the Feds.

The workaround for indirect coercion of state governments was to threaten Federal sanctions against individual residents of states that don’t comply with the REAL-ID Act. The sponsors of REAL-ID hoped that these threats would scare voters into lobbying their state legislators’ to bring their states into line with the Feds’ desires.

The REAL-ID Act doesn’t officially “require” states or individuals to do anything. Its “enforcement” mechanism is a prohibition on acceptance for “Federal purposes” of drivers’ licenses or other ID credentials issued by states or territories that don’t comply with the requirements in the Federal law and the implementing regulations issued by the DHS.

There was still a problem for the DHS and the other backers of REAL-ID, however: How to make the threat of sanctions against residents of “noncompliant” states sufficiently harsh and sufficiently credible to get them to pressure their state governments to comply, without catalyzing a mass movement of grassroots resistance by outraged victims (or potential victims, or their supporters) of those sanctions.

The strategy adopted by the DHS has been to phase in the sanctions very gradually, over a period of many years, starting with those which would have the least significant consequences. The problem for the DHS is that those threats which are most intimidating are those which would be most likely to provoke blowback against the Feds, and lead to more pressure on Congress to repeal the REAL-ID Act. The result has been a decade-long game of chicken between the DHS and reluctant or resistant state governments.

The DHS won’t (and politically can’t) admit the possibility that states won’t kowtow to its demands. State legislators can’t believe that the DHS would really be able to get away with denying access to Federally-controlled facilities and programs (more on that below) to all residents of noncompliant states, as well as residents of compliant states who are unable and/or unwilling to satisfy the documentary prerequisites for issuance of a REAL-ID compliant ID card.

When states haven’t complied — because they didn’t want to, or because they couldnt’t afford to, or because it was taking longer than expected to develop the infrastructure for the distributed database — the DHS postponed the deadlines.

It’s been a decade since the REAL-ID act of 2005 was enacted, and most residents of “noncompliant” states have yet to be subjected to any Federal consequences for not having a REAL-ID card. The criterion for “compliance” is political obeisance and stated or inferred intent, not action. All states that said they intended eventually to comply were deemed to be “compliant”, and given extensions of time to get with the program in practice. Even some states which enacted state laws prohibiting state agencies from implementing REAL-ID procedures have been “certified” by the DHS to be in “constructive compliance” with the required intent to comply.

Is this DHS certiification wishful thinking? What will these states do as the deadlines approach? That remains to be seen, and depends primarily on what individual residents of those states do.

Aug 27 2014

“I don’t want a unitary, unfakeable identity.”

Dan Geer’s keynote speech at the Blackhat security conference earlier this month (video, transcript) included an important discussion of the often-misunderstood “right to be forgotten” and the larger context of why it matters: the threat posed by compelled identification, and how we can defend ourselves against that threat:

Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more — what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. If you are a pessimist or a hacker/maker, then your answer will tend towards the operational, and your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself…

The Obama administration’s issuance of a National Strategy for Trusted Identities in Cyberspace [NSTIC] is a case in point; it “calls for the development of interoperable technology standards and policies — an ‘Identity Ecosystem’ — where individuals, organizations, and underlying infrastructure — such as routers and servers — can be authoritatively authenticated.” If you can trust a digital identity, that is because it can’t be faked…. Is having a non-fake-able digital identity for government services worth the registration of your remaining secrets with that government? Is there any real difference between a system that permits easy, secure, identity-based services and a surveillance system? Do you trust those who hold surveillance data on you over the long haul, by which I mean the indefinite retention of transactional data between government services and you, the individual required to proffer a non-fake-able identity to engage in those transactions? Assuming this spreads well beyond the public sector, which is its designers’ intent, do you want this everywhere?…

I conclude that a unitary, unfakeable digital identity is no bargain and that I don’t want one. I want to choose whether to misrepresent myself. I may rarely use that, but it is my right to do so. If that right vanishes into the panopticon, I have lost something and, in my view, gained next to nothing. In that regard, and acknowledging that it is a baby step, I conclude that the EU’s “Right to be Forgotten” is both appropriate and advantageous though it does not go far enough. Being forgotten is consistent with moving to a new town to start over, to changing your name, to a definition of privacy that turns on whether you do or do not retain the effective capacity to misrepresent yourself…. A right to be forgotten is the only check on the tidal wave of observability that a ubiquitous sensor fabric is birthing now, observability that changes the very quality of what “in public” means….

There’s more: video, transcript.

Mr. Geer’s comments help answer one of the questions we are most frequently asked: What’s Wrong With Showing ID?

Aug 13 2014

Another brick in the (falling) REAL-ID wall

July 21, 2014 marked “Phase 2” of implementation of the REAL-ID Act.

What does this mean, and does it matter?

As of July 21, drivers’ licenses and other state ID credentials issued by US states or territories that haven’t been certified by the DHS to comply with the REAL-ID Act cannot be accepted by Federal agencies for access to ID-controlled “restricted” areas of Federal facilities (“i.e., areas accessible by agency personnel, contractors, and their guests”).

Because Federal agencies typically issue their own ID credentials to their own employees and regular contractors, this will mostly affect occasional visitors to Federal facilities. NASA, for example, which has facilities in states that have not been certified by DHS as sufficiently compliant, has issued this advice to would-be visitors:

Effective July 21, 2014, the implementation of Phase II of the Real-ID Act (2005) restricts the use of state ID from non-compliant states (including New York) as an acceptable form of identification for federal facilities (including NASA GISS). If you are intending to visit GISS and only have a standard drivers license from a non-compliant state, please ensure that you have a second form of ID (passport, military ID, etc.) to avoid unnecessary complications.

It isn’t clear from this notice, or others we’ve seen, what these “unnecessary complications” will amount to. Visitors with ID credentials from non-compliant states will, presumably, be treated as visitors without “valid” state ID credentials, but that begs the questions of whether or on what basis they will be allowed entry after additional scrutiny or some form of alternate ID verification, allowed entry but only if escorted by staff and not allowed unescorted, or denied entry entirely.

In its eseence, the REAL-ID Act was intended to mandate the creation of a distributed national identity card system. The key “compliance” requirement for states and territories is participation in a linked, distributed database of ID-card and biometric information about all ID cardholders nationwide.

The intent of the Federal law is to force states to particpate in (and absorb the cost of) this scheme, sparing the Feds the costs and hassle of issuing national ID cards and providing (implausible) deniability as to whether it’s a “national ID” at all: “See, it’s not a ‘national’ ID card. It’s still issued by your state.”

But since the Feds probably don’t have jurisdiction over state issuance of drivers’ licenses or state ID cards, the REAL-ID Act relies on threats, rather than direct orders, to extort compliance by states resistant to registering their citizens and residents in a national ID database.

Aug 22 2013

California considers “enhancing” drivers licenses with radio tracking beacons

California’s legislature is considering a bill to authorize adding radio tracking beacons to drivers licenses and state non-driver ID cards.

Each such card would broadcast a unique tracking number which could legally be intercepted by anyone with a suitable radio transceiver within range, and which would be linked to a national DHS database of drivers license, state ID card, and citizenship information.

The tracking beacons are designed to allow the tracking numbers on ID cards carried by travelers in motor vehicles to be read from outside their vehicles as they approach or pass through checkpoints.

Independent academic studies of actual ID cards issued by other states, using the same standards proposed for use in California, have found that they can sometimes be read from more than 50 yards away.

S.B. 397 has already been approved by the California Senate, and is now under consideration in the Assembly. Because it has been amended by the Assembly, it will need to be reconsidered by the Senate (to decide whether to accept the Assembly amendments) if and when it is approved by the Assembly.

To date, S.B. 397 has been largely unopposed in the California legislature, and it is likely to be approved unless legislators start hearing a groundswell of opposition from their constituents.

What excuse is being offered for this scheme? And what’s its real purpose?

Nov 16 2012

The facts on the ground in Arizona

“Don’t trust, and don’t verify“, would seem to be the motto of authorities in Arizona when it comes to demands for documents and “proof” of citizenship and status — if your skin is brown.

Arizona’s SB1070 requires police, in certain circumstances, to “attempt” to determine your immigration status. But that obligation on the police does not create any obligation on individuals. In its initial decision on SB1070, the Supreme Court made clear that this provision of the law cannot Constitutionally be used as the basis to detain people without some other lawful basis.

Actions on the ground in Arizona, however, suggest that in practice the burden of proof is being placed on (brown-skinned) Arizonans to prove that they are “not illegal”, on pain of prolonged detention on the basis of mere suspicion (and regardless of the weight of the actual evidence).

The Phoenix New Times has been following the case of Briseira Torres. She was born (at her mother’s home, which the Department of State seems to find inherently suspicious) in Arizona, and her birth was registered (albeit late, as is common for home births) with the Arizona Office of Vital Records.

One doesn’t have to be registered with the government to be born, or to be a US citizen. But that didn’t stand in the way of Arizona and US authorities. When Torres went to the Federal Building to apply for a passport for her daughter, after submitting a copy of her own birth certificate as evidence of her daughter’s US citizenship by birth, the State Department employees at the passport office called in Arizona state law enforcement officers to help interrogate Ms. Torres.

Eventually, on the theory that the original registration of Ms. Torres’ home birth had been falsified, the Feds turned her over to state authorities, who had her indicted (withholding from the grand jury the state’s official record of her valid birth certificate, and falsely claiming to the grand jury that her birth registration had been “cancelled”) for fraud. She was jailed for 4 1/2 months, during which time she was separated from her child and lost her home and car because she couldn’t make the payments on them, before she got a lawyer and the state withdrew the charges.

Now, to try to retroactively justify their deprivation of Ms. Torres’ rights, state officials have initiated a newly-created administrative process to revoke the registration of her birth.

In other words, the state of Arizona wants to “un-birth” Ms. Torres — at age 31.

We’re glad Ms. Torres has a lawyer, and we hope she collects substantial damages from both Arizona state and county officials and the State Department “special agent” who initially detained her, called in the state cops, and eventually turned her over to their custody.

This incident began with Ms. Torres being called in to answer questions about her passport application for her daughter. The role of the Passport Office and other State Department employees shows exactly why we are so concerned about the State Department’s proposed new questionnaire for passport applicants.

Government “un-birthing” of citizens isn’t the only strange thing going on in Arizona, unfortunately.

At the Deconcini border crossing between the central business districts of Nogales, Arizona, and Nogales, Sonora, US Customs and Border protection is requiring some “trusted travelers” to submit to interrogation by allegedly lie-detecting robots developed (with DHS grant money, we presume) by the National Center for Border Security and Immigration at the University of Arizona.

If the robot thinks you are lying, “a more through interview would follow”, according to news reports.

But Ms. Torres’ example shows that if a human Fed in Arizona thinks you are lying about your papers, they will detain you and turn you over to the state of Arizona to be locked up without bail for months, without bothering even to look at your actual papers (not that you have to have any “papers” in the first place to be born or have rights).

In that light, we hope courts will look skeptically at the legality of prolonging the detention of a border crosser based on the statement of a semi-anthropomorphic animated robot that, “I think you are lying.”

Oct 01 2011

A real story about REAL-ID

From the Identity Project mailbag:

My life has been basically destroyed because I don’t have a valid state-issued photo ID.

Thanks to terrorists, it is illegal for any employer in my state to hire me.

I am a natural-born citizen of the United States, born and raised in the State of New Jersey. I have lived here most of my life. I have never been convicted of a felony nor even a misdemeanor. I have never been arrested, nor even ever received so much as a parking ticket. I do not receive any funds from Welfare, Social Security, or any other government program. I am not a terrorist.

Yet, in the State of New Jersey, it is illegal for any employer to hire me, and has been for about the last 6 years.

Sep 30 2011

How would REAL-ID affect the right to travel?

In the latest step in the implementation of the REAL-ID Act and the establishment of a de facto national ID card and database, the Department of Homeland Security has requested OMB approval for the collection of additional information from states and individuals.

The public response to the DHS request, particularly these comments submitted by the Electronic Privacy Information Center (EPIC), highlight the important unanswered questions about how REAL-ID Act implementation will affect the right to travel:

EPIC’s comments focus on the widely-publicized recent case of Lewis Brown, a former high school and college basketball star who died on a street in Southern California homeless, earlier this month:

EPIC writes today to draw the agency’s attention to the death of Lewis Brown, a former college basketball prodigy, who died on the streets of Los Angeles because he could not scrape together the money to obtain a state-issued identity document…. According to the New York Times, Brown, a basketball legend at the University of Nevada at Las Vegas, planned to fly to visit his family in New York and could not. Homeless and destitute, living on the sidewalks of Hollywood, Brown had developed cancer and planned to go to the hospital. Brown’s mother learned about his condition and stated that she wanted to see him “before he died.” Brown’s sister, Anita, told him to visit New York. Brown told confidants that he lacked funds to qualify for a California identification card, and was taking donations and borrowing money.

Read More →

Jun 06 2010

UK government admits it was becoming authoritarian. Can the USA do the same?

The new UK coalition government has announced its initial Programme for Government, including a plan of action on civil liberties including, “We will scrap the ID card scheme, the National Identity register and the ContactPoint database, and halt the next generation of biometric passports.” Talk is cheap, but Bill 1 (text, explanatory notes) already introduced by the new government would repeal the UK national ID card scheme in mid-rollout.

It’s an important precedent even though, as some have already noted, the repeal would be limited to UK citizens. Foreigners residing in the UK — including citizens of other members of the European Union, who have the right by treaty to live and work anywhere in the EU — would remain subject to a similar ID card requirement under a separate law that is not (yet) proposed for repeal.

Two aspects of the new UK government’s action seem especially significant as examples for the USA:

One, the government is making this plank of its platform a priority for action only because they perceived it as an issue that citizens and voters were prepared to act on, through noncompliance with orders to enroll in the national ID scheme and/or at the ballot box. The government is following, not leading, UK public opinion and votes. The US government is unlikely to abandon its national ID schemes — in whatever guise they are cloaked — unless US citizens and voters demonstrate a similar commitment to direct action against them.

Two, the new UK government has admitted much more than that “mistakes were made” or that policies need to be changed:

The Government believes that the British state has become too authoritarian, and that over the past decade it has abused and eroded fundamental human freedoms and historic civil liberties. We need to restore the rights of individuals in the face of encroaching state power, in keeping with Britain’s tradition of freedom and fairness.

If the closest allies of the USA can make such an admission, and act on it, is there still a chance for the Obama Administration to make the same bravely honest admission, and take the same sort of straightforward action to scrap authoritarian measures like REAL-ID and the whole system of travel surveillance and control?

We aren’t holding our breath for fundamental change, either in the UK or the USA. At least in principle, however, the new UK government has paved the way for what needs to be done. It’s up to the people to see that they follow through, and that the US government follows suit.

Mar 19 2010

Obama endorses DNA database, considers biometric national ID

Yesterday President Obama met again with Senators Chuck Schumer (D-NY) and Lindsey Graham (R-SC), the sponsors of the “immigration reform” bill we reported on yesterday, which has as its first “pillar” a mandatory biometric national worker ID card. In conjunction with his meeting with the Senate sponsors of this scheme, President Obama issued a statement which didn’t mention the national ID card specifically, but praised the overall proposal as “a promising, bipartisan framework which can and should be the basis for moving forward.”

Meanwhile, President Obama has strongly and explicitly endorsed mandatory DNA sampling of everyone arrested (not convicted, arrested — people who are presumed to be innocent) and retention of DNA records in a national database. “It’s the right thing to do… This is where the national registry becomes so important,” the President said [transcript] in an on-camera interview. We hope he reconsiders, and that his views on a national DNA database aren’t an indication of his leanings on a national biometric ID card.

Whichever way they are leaning now, the President and the Senate need to hear from the public, right away, what you think of these ideas — and that you won’t go along with unconstitutional restrictions on your rights.

Mar 18 2010

New excuses for state and Federal ID laws and databases

Heads up, Arizona readers: Your state legislature is on the verge of enacting a REAL-ID type national ID requirement in the guise of “immigration reform”. And a heads up to readers elsewhere: Congress is also considering an ID mandate as part of an “immigration reform” bill.

For a while after 9/11, the excuse offered by proponents of a national ID card was that it would somehow prevent terrorism. We all know that there’s never any terrorism in police states, right? With that excuse wearing thin, the old bugaboo of illegal immigration is emerging (or reemerging) as the rationale for a national ID requirement and database.

In Arizona, SB1070/HB2632 is under consideration on the floor of the state House of representatives today, and could be voted on at any time. The Campaign for Liberty has a detailed analysis of the provisions of this bill. We don’t know why the state of Arizona needs any legislation on “ENFORCEMENT OF IMMIGRATION LAWS”, since those are Federal laws normally enforced by the Feds, not by state authorities. But in the guise of an amendment to those “immigration” provisions of Arizona law, the bill would require not merely state law enforcement officers but all state and local agencies to make “a reasonable attempt … to determine the immigration status of the person” in a wide range of circumstance. As part of that attempt to determine the person’s status, “The person’s immigration status shall be verified with the federal government pursuant to 8 United States code section 1373(c).” And checks of ID against Federal immigration databases would be allowed as a condition of virtually any state or local public services.

In Congress, “Lawmakers working to craft a new comprehensive immigration bill are proposing a new national biometric ID card that would be required of all U.S. workers… Under the potentially controversial plan still taking shape in the Senate, all legal U.S. workers, including citizens and immigrants, would be issued an ID card with embedded information, such as fingerprints, to tie the card to the worker”, according to a report in the Wall Street Journal quoting Senators Chuck Schumer (D-NY) and Lindsey Graham (R-SC).

As one commentator put it, “Every worker would have to ask permission from the federal government to get a job. American workers shouldn’t have to beg or plead to anybody to get permission to work.” Nor should they have to have their fingerprints in a national database that, to work as designed, would have to be open to verification queries form every potential employer in the country. (Never mind what would happen to remote workers or contractors who’ve never met their employers in the flesh for them to be able to verify their fingerprints.)

But the key problem with any of these schemes isn’t the excuse that is offered to justify their creation, but the potential they create for abuse and the inevitability that they will be used in ways that the public never imagined when they allowed them to be created — such as, for example, the historic “mission creep” of Social Security numbers.

A national ID card or database or identification requirement is wrong, regardless of whether it is created through state or local law, and regardless of the “excuse du jour” proffered as its rationale.

Papers, Please!

The Identity Project