Update 1:03 p.m. PST: This story was updated to add reactions from Congress and additional information about the privacy and security aspects of the Real ID rules.
WASHINGTON--If the Bush administration gets its way, all Americans will be required to present Real ID-compliant identification documents--or risk facing "inconveniences" at airports and federal buildings--by 2017.
DHS Secretary Michael Chertoff
(Credit: U.S. Department of Homeland Security)In a matter-of-fact outline of the final rules governing the controversial program, U.S. Department of Homeland Security Secretary Michael Chertoff on Friday vowed to counteract the naysayers and defend what he called a "more secure form of identification that will serve both our homeland security and our individual concerns about personal privacy."
Only three categories of people need be "disappointed" by the forthcoming identification cards, the Homeland Security chief told attendees at a midday press conference here: terrorists, illegal immigrants, and con-men.
The nearly 300 pages worth of guidelines for states put forth Friday came after the agency reviewed some 21,000 comments responding to draft regulations from last March.
The Real ID Act, which Congress passed as part of an emergency spending bill in 2005, is the result of recommendations from the 9/11 Commission. Chertoff reiterated Friday that the program is necessary in part because all but one of the hijackers in the September 11 attacks carried government-issued identification cards that helped them remain in the country illegally. Another goal is to prevent illegal immigrants from "pretending to be American citizens so they can work illegally in this country."
To that end, under the new rules, motor vehicle offices will be required to take photographs of driver's license applicants at the beginning of the application process and keep those images on file for five years. The idea is to help catch applicants who forge their identities--and fail to fool employees into issuing them cards--if they try to pull off a repeat attempt.
Whether the final rule will hold up through the decadelong implementation process remains to be seen. Prominent Democrats in Congress were quick to attack the approach.
"While fulfilling this 9/11 Recommendation is vital to our national security, I believe that the Final Rule still requires a great deal of work by the Department of Homeland Security," Rep. Bennie Thompson (D-Miss.), chairman of the House of Representatives Homeland Security Committee, said in a letter Friday.
Sen. Patrick Leahy, chairman of the Senate Judiciary Committee, said in a statement that he would continue to push for passage of a bill that would repeal the Real ID Act. That mandate would be replaced with what supporters say is a more "flexible" approach, in which states, privacy groups, the federal government, and other interested parties would devise a mutually beneficial approach to improving driver's license security.
New timeline
Arguably the biggest change in the final rule is the timeline. States will generally have a larger chunk of time, broken into "milestones," to become compliant with the new standards. Earlier in the planning process, Homeland Security had envisioned requiring the IDs to be in place starting on May 11, 2008--and no later than 2013--unless states had applied for an extension.
The final rule dictates that by the end of 2009, states will have to complete certain checks on all residents who apply for driver's licenses, such as verifying against Homeland Security databases that the cardholders have legal immigration status and ensuring that the Social Security number provided matches with Social Security Administration records. States will also have to conduct background checks on motor vehicles employees "to ensure licenses are not issued by corrupt insiders."
By May 11, 2011, states are expected to have methods in place to verify that the identity documents provided by driver's license applicants, such as birth certificates, are valid. They'll also be expected to start issuing Real ID-compliant licenses by then, if not sooner.
By Dec. 1, 2014, all Americans under the age of 50 will be expected to present Real ID-compliant licenses when boarding airplanes and entering federal buildings. Exactly three years later, all Americans, regardless of age, will have to meet those requirements.
Opponents of the Real ID plan said the deadline extensions do nothing to change their view that the requirements are unworkable.
"What the Department of Homeland Security has done is to kick the can down the road to the next administration, and probably not just to the next administration, but conceivably two to three administrations from now," Barry Steinhardt, an ACLU attorney, said on a conference call with reporters.
One key part of the timeline, however, remains unchanged, which may create a new dilemma for states that have opposed or outright rejected implementation of Real ID.
If states haven't asked the federal government for an extension for implementing the identification card program by 60 days after the final rule is formally published, which has not yet happened, then their residents will no longer be able to use driver's licenses or state-issued ID cards to board airplanes or enter federal buildings. Instead, they'll have to present one of the alternative acceptable forms of identification, such as a State Department-issued passport.
"There's no question the law creates a very powerful incentive for states getting on board with this process," Chertoff said Friday. "Convenience and common sense strongly counsel in favor of getting on the path toward secure identification."
According to Chertoff, 40 percent of the U.S. population live in states that have already begun the process of moving forward with Real ID. But 17 states have passed legislation registering their opposition to the regulations, of which six of those--Maine, Montana, New Hampshire, Oklahoma, South Carolina, and Washington--expressly prohibit compliance with Real ID.
In the ACLU's view, the threat of "inconvenience" to state residents who don't sign onto the plan is largely empty since alternative forms of ID will be accepted.
"This is an avoidable train wreck," Steinhardt said.
The states that have voiced resistance to Real ID have done so largely because of the hefty price tag, which Homeland Security initially estimated at $23 billion total, of which $14.6 billion would fall on state governments to pay.
Lingering funding, privacy concerns
Chertoff on Friday touted that under the final rule, the agency was able to cut that estimated cost to $3.9 billion. He also said that, based on dividing that cost by the number of Americans estimated to be applying for such a card, each Real ID-compliant license would cost only $8 (although whether states would actually charge that amount was another story, he added).
That substantial reduction drew skepticism from the ACLU, which claimed the adjusted figure is based on the assumption that one in every four adults "isn't ever going to get a Real ID license."
Another challenge is that Congress still hasn't appropriated anywhere near that amount of money to the states, William Pound, executive director of the National Conference on State Legislatures, said in a statement.
David Quam, a lobbyist for the National Governors Association, said state officials were still reviewing the mountain of regulations but would have some tough decisions to make in the coming weeks. He said it's too early to say whether they'll request additional time to make a decision about whether to comply.
"States and legislators and decision makers are going to have to turn around and make a decision as to what does Real ID mean, what does it bring us, and is it worth it," he said in a telephone interview.
Under the minimum standards set by the Real ID Act, all compliant licenses must contain all of the information typically on a driver's license--that is, a person's name, address, signature, date of birth, gender, photograph, and license number. In addition, they must contain physical security features designed to make them counterfeit-proof and use a "common, machine-readable technology."
That machine-readable requirement--and a lack of requirement that the encoded information be encrypted--has ignited concerns among privacy advocates who worried information could be swiped off the cards and used willy-nilly by bars, clubs, and other outsiders who may swipe the cards' bar code.
Those groups said their worries were hardly assuaged by Friday's final rule. Homeland Security kept the lack of encryption requirement because, in its words, of "law enforcement's need for easy access to the information and the complexities and costs of implementing an encryption infrastructure."
The final rule also leaves states responsible for setting minimum privacy standards for how such information may be used by third parties. That means "if any state in the country has weak or no privacy standards, every other state is going to be subjecting its citizens' information to a weak standard able to be stolen by identity thieves and harvested by people who want to share that information and sell it to other people," said Tim Sparapani, the ACLU's senior legislative counsel.
Melissa Ngo, an Electronic Privacy Information Center representative, said her organization still has major concerns about the Real ID requirements but cited one positive point: The latest rules do not compel states to embed radio-frequency identification chips in the cards. Such a requirement could have created the possibility that outsiders could skim off information more easily without the cardholder's permission.
The U.S. Department of Homeland Security on Friday plans to take the next step in getting its controversial Real ID plan off the ground, despite opposition from numerous states and privacy groups.
At a midday press conference in Washington, Homeland Security Secretary Michael Chertoff is scheduled to take the wraps off final regulations for the electronic identification card mandate and to make another pitch for the scheme's perceived importance in keeping Americans safe from terrorist threats.
Homeland Security Secretary Michael Chertoff
(Credit: U.S. Department of Homeland Security)The new rules, which are a few months behind schedule, are supposed to build on a draft version released last March for public comment.
Chertoff himself has been mum on the details ahead of his public appearance Friday. But according to anonymous sources cited by the Associated Press and The Washington Post, the department has made at least one significant change to its earlier plans: pushing back the deadlines by which the new identification cards will be required to board airplanes and enter federal buildings.
Before, Homeland Security had envisioned requiring the IDs to be in place, starting May 11, 2008--and no later than 2013--unless states had applied for an extension.
But under the new rules, Americans won't be expected to present Real ID-compliant identification cards until 2014. Even then, the mandate will apply only to Americans younger than 50 at the time, in an apparent effort to give some disgruntled state motor vehicle departments more time to issue the licenses. The requirements would be broadened to all Americans by 2017.
"We've worked very closely with the states, in terms of developing a plan that I think will be quite inexpensive, reasonable to implement, and produce the results that...are a part of the core recommendation of the 9/11 Commission, which is secure identification when driver's licenses are presented," Chertoff said Thursday, according to a transcript of his remarks, at a meeting of departmental advisers.
Largely because of the price tag, 17 states have already enacted legislation rejecting the Real ID requirements, which Congress passed as part of an emergency spending bill in 2005, and several others were considering such a step, according to the American Civil Liberties Union, one of the most prominent voices against the plan. But according to the AP and the Post, federal officials have somehow devised a way to reduce the expected $14 billion in costs to states to $3.9 billion under the revised rules.
It's unclear how the department plans to assuage security and privacy concerns about the cards, including whether data encoded on their two-dimensional bar codes will be encrypted to guard against misuse. The AP reported that states will have a "menu" of security options from which to choose but will not be required to embed "microchips"--ostensibly a reference to radio frequency identification, or RFID, technology, which, depending on the type, could be read either from a distance or close-up.
Update: Click here to read our follow-up story, featuring Secretary Chertoff's remarks about the final rules and reactions from state officials, privacy groups, and members of Congress.
Editors note: An earlier version of this story incorrectly said that Homeland Security Secretary Michael Chertoff offered states a new deadline of February 2008; this deadline had actually been announced earlier.
WASHINGTON--A controversial plan for national identification cards known as Real ID drew another ringing endorsement from top Bush administration officials on Monday, even as senators continued to question the law's privacy implications and cost.
Cheerleading for the mandate was led by the retiring Sen. John Warner (R-Va.), who called a nationalized ID card a top priority. He asked the four Bush administration officials present to divulge whether they supported the idea, which was recommended by the 9/11 Commission but has sparked rebellion from numerous states and civil liberties advocates concerned about its cost and potential for abuse.
One by one, Homeland Security Secretary Michael Chertoff, FBI Director Robert Mueller, Director of National Intelligence Mike McConnell and National Counterterrorism Center Director John Redd--said they fully endorsed the idea. Each ranked it as a high priority.
Draft regulations issued earlier this year by the Department of Homeland Security dictate that starting May 11, 2008, residents of all states must begin presenting compliant electronic cards in order to board airplanes or enter federal buildings--that is, unless their respective states file for a reprieve starting October 1 of this year. That deadline, coupled with the compliance costs, is one of the main reasons why individual states are leading something of a Real ID rebellion in opposition to the federal mandate.
But with Homeland Security not expecting to issue its final Real ID rules until October, one Republican politician said he was concerned states won't have enough time to digest the regulations and ask for relief. "How are you going to address that administrative train wreck?" Sen. John Sununu (R-N.H.) asked Chertoff at the Senate Homeland Security Committee event, which focused on steps the United States has taken to "confront the terrorist threat" and was pegged to the sixth anniversary of the September 11, 2001, attacks.
Chertoff said the department has indicated that it would be "quite reasonable in terms of extensions," offering states until the end of 2009 to outline how they plan to outfit their residents with the new cards by 2013. He later added that the states will have until February to request deadline extensions for submitting those plans--as opposed to October, which Sununu appeared to believe was the final cutoff.
Sununu also raised privacy concerns, asking Chertoff to explain how the department plans to ensure that data stored on the IDs is adequately protected, particularly since the Real ID regime requires that those fields be shareable among all state motor vehicle departments. (The idea behind that requirement is to help keep the same person from obtaining a drivers license in more than one state.)
Chertoff downplayed the worries, claiming that a new obligation that all motor vehicle employees undergo federal background checks "is going to elevate the level of privacy," and implying such a step would help keep off the payrolls employees who would abuse their access to the databases. (Chertoff recently reiterated that he believes Real ID will actually strengthen Americans' personal privacy, a position with which civil liberties groups vehemently disagree.)
Sununu and another Real ID skeptic, committee ranking member Susan Collins (R-Maine), also told the Homeland Security chief that they're also still concerned about the costs states will have to bear in reworking their drivers license systems. Warner, for his part, said he would try again to seek additional federal dollars for the state-level projects--a move that has failed twice this summer alone.
WASHINGTON--In another attempt to head off privacy advocates' attacks on the Bush administration's Real ID plans, Homeland Security Secretary Michael Chertoff said the national-identification scheme will actually "strengthen" personal privacy by providing added protection against identity theft.
In written testimony Chertoff submitted (PDF) on Wednesday to the U.S. House of Representatives Homeland Security Committee, he made another pitch for his department's requirements, which generally say that starting on May 11, 2008, Americans will need a federally approved, "machine readable" ID card to travel on an airplane, open a bank account, collect Social Security payments or take advantage of nearly any government service.
A Real ID-compliant document will be of higher "quality" than existing driver's licenses and other state-issued identification cards, thus helping prevent terrorists and identity thieves alike from committing forgery, Chertoff said in his testimony.
That improved quality will come about, in part, because motor vehicle administrators will be required to link into databases to verify the legitimacy of the underlying identification documents, such as birth certificates, that Americans submit when they apply for Real ID-compliant cards, the Homeland Security chief suggested. Another senior Homeland Security official, Stewart Baker, made similar claims earlier this year.
Opponents of the Real ID plan, meanwhile, have cited numerous privacy and security flaws in the plan. One of their concerns is that the government's failure to require encryption on the cards' two-dimensional bar code could lead to information being swiped and harvested by outsiders for potentially invasive purposes.
Interestingly, not one member of the House committee asked Chertoff about the issue during Wednesday's wide-ranging hearing, which lasted about three hours and covered everything from hurricane preparedness to one Republican's call for more domestically bred bomb- and cadaver-sniffing dogs. (It also touched, albeit briefly, on cybersecurity.)
Perhaps the silence is emblematic of the increasing controversy the plan has generated over the past year, with numerous states endorsing legal measures attacking or rejecting Real ID and Congress, just before breaking for its August recess, rejecting an extra $300 million in grants for states to implement the mandate.
WASHINGTON--Homeland Security Secretary Michael Chertoff on Wednesday largely dodged questions from a congressional committee about the department's cybersecurity operations, including whether its computers have ever faced attacks from Chinese hackers.
Michael Chertoff
During wide-ranging testimony before the U.S. House of Representatives Homeland Security Committee here, Chertoff devoted only a few sentences to his department's charge of protecting the nation's computer systems from attack. He claimed he couldn't get into many of the details because of their "classified" nature.
"I can assure you we are working with other elements of the federal government and giving the highest priority to putting together an enhanced strategy with respect to cybersecurity," he told the politicians.
DHS has been publicly blasted by Congress and government auditors in the past for failing to live up to their expectations in the cybersecurity realm. At a hearing in June, members of the same committee attacked the department's chief information officer over reports of 844 security-related "incidents"--granted, many of which were not particularly serious and did not indicate actual intrusions--on its computer systems in 2005 and 2006.
The Homeland Security chief, who's rumored to be in the running for Attorney General Gonzales' soon-to-be-vacated post, didn't divulge much more under subsequent questioning at Wednesday's event from Rep. Jim Langevin (D-R.I.), who leads a cybersecurity subcommittee. In light of recent reports, which were later denied by the Chinese government, that Chinese hackers penetrated Department of Defense computer systems, Langevin asked Chertoff to reveal whether DHS computers have "ever called home to Chinese servers" or whether he knew of Chinese hackers breaking into those systems. (China was also believed to be the source of attacks on Commerce Department computers last year.)
Chertoff never directly answered the questions, saying, "this is the area which is heavily intertwined with classified information."
The purpose of the hearing, at which the DHS chief was the sole witness, was to assess "security gaps" at the agency. Democrats presented Chertoff with a "to-do list" for the remainder of his term and chided him for missing deadlines for certain administration programs. Yet some nonetheless voiced respect for his work so far and said they'd hate to see him leave the department, say, for the attorney general post.
The Homeland Security chief's response was fairly noncommittal. He said he's "happy to continue to do this job up until the very last day of the administration," that is, unless the president decides otherwise.
- prev
- 1
- next
