History of National Identification Cards
National ID cards have long been advocated as a means to enhance national security, unmask potential terrorists, and guard against illegal immigrants. They are in use in many countries around the world including most European countries, Hong Kong, Malaysia, Singapore and Thailand. Currently, the United States and the United Kingdom have continued to debate the merits of adopting national ID cards. The types of card, their functions, and privacy safeguards vary widely.
Americans have rejected the idea of a national ID card. When the Social Security Number (SSN) was created in 1936, it was meant to be used only as an account number associated with the administration of the Social Security system. Though use of the SSN has expanded considerably, it is not a universal identifier and efforts to make it one have been consistently rejected. In 1971, the Social Security Administration task force on the SSN rejected the extension of the Social Security Number to the status of an ID card. In 1973, the Health, Education and Welfare Secretary's Advisory Committee on Automated Personal Data Systems concluded that a national identifier was not desirable. In 1976, the Federal Advisory Committee on False Identification rejected the idea of an identifier.
In 1977, the Carter Administration reiterated that the SSN was not to become an identifier, and in 1981 the Reagan Administration stated that it was "explicitly opposed" to the creation of a national ID card. The Clinton administration advocated a “Health Security Card” in 1993 and assured the public that the card, issued to every American, would have “full protection for privacy and confidentiality.” Still, the idea was rejected and the health security card was never created. In 1999 Congress repealed a controversial provision in the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 which gave authorization to include Social Security Numbers on driver's licenses.
In response to the tragic events of Sept. 11, 2001, there has been renewed interest in the creation of national ID cards. Soon after the attacks, Larry Ellison, head of California-based software company Oracle Corporation, called for the development of a national identification system and offered to donate the technology to make this possible. He proposed ID cards with embedded digitized thumbprints and photographs of all legal residents in the U.S. There was much public debate about the issue, and Congressional hearings were held. Former House Speaker Newt Gingrich testified that he "would not institute a national ID card because you do get into civil liberties issues." When it created the Department of Homeland Security, Congress made clear in the enabling legislation that the agency could not create a national ID system. In September 2004, then-DHS Secretary Tom Ridge reiterated, "[t]he legislation that created the Department of Homeland Security was very specific on the question of a national ID card. They said there will be no national ID card."
The public continues to debate the issue, and there have been many other proposals for the creation of a national identification system, some through the standardization of state driver's licenses. The debate remains in the international spotlight – several nations are considering implementing such systems. The U.S. Congress has passed the REAL ID Act of 2005, which mandates federal requirements for driver's licenses. Critics argue that it would make driver's licenses into de facto national IDs.
The REAL ID Act of 2005
Summary
The REAL ID Act of 2005 creates a de facto national identification card. Ostensibly voluntary, it would become mandatory as those without the card would face suspicion and increased scrutiny. It is a law imposing federal technological standards and verification procedures on state driver's licenses and identification cards, many of which are beyond the current capacity of the federal government, and mandating state compliance by May 2008. In fact, REAL ID turns state DMV workers into federal immigration officials, as they must verify the citizenship status of all those who want a REAL ID-approved state driver's license or identification cards. State DMVs would far move away from their core mission -- to license drivers.
REAL ID was appended to a bill providing tsunami relief and military appropriations, and passed with little debate and no hearings. The REAL ID Act repealed provisions in the Intelligence Reform and Terrorism Prevention Act of 2004, which contained "carefully crafted language -- bipartisan language -- to establish standards for States issuing driver's licenses," according to Sen. Richard Durbin. After more than two years, the Department of Homeland Security issued draft regulations for state compliance on March 1, 2007.
The National Conference of State Legislatures estimates (pdf) that that the cost to the states will be more than $11 billion over five years. This is more than 100 times the $100 million cost that Congress initially estimated. For 2006, $40 million was allocated for start-up costs. No more funding has been allocated, and it is likely that the cost will be shouldered by the public.
How will the REAL ID Act affect state driver's licenses and identification cards (DL/ID)?
If the Department of Homeland Security Secretary doesn't grant a state an extension to meet the certification requirements, then by May 11, 2008 (three years after passage of the REAL ID Act), states must meet the following standards to be accepted for federal use (entrance into a courthouse, onto a plane; receiving federal benefits, such as Social Security or Medicare). After more than two years, the Department of Homeland Security issued draft regulations on March 1, 2007, explaining how the states can meet these standards. The EPIC analysis of the potential privacy implications follows the enumeration of the each set of standards.
Minimum document requirements, §202(b):
"To meet the requirements of this section, a State shall include, at a minimum, the following information and features on each driver's license and identification card issued to a person by the State:
(1) The person's full legal name.
(2) The person's date of birth.
(3) The person's gender.
(4) The person's driver's license or identification card number.
(5) A digital photograph of the person.
(6) The person's address of principle residence.
(7) The person's signature.
(8) Physical security features designed to prevent tampering, counterfeiting, or duplication of the document for fraudulent purposes.
(9) A common machine-readable technology, with defined minimum data elements."
EPIC analysis:
We strongly advise deleting the §202(b)(6) requirement of displaying the person's address of principal residence on the card. This has significant implications for domestic violence victims and the homeless. We suggest requiring the acceptance of alternate addresses, such as P.O. boxes, in order to protect the privacy of individuals.
There is also the risk that the Department of Homeland Security guidelines will, under the §202(b)(9) requirement of "common machine-readable technology," mandate that the states must include radio frequency identification (RFID) technology in DL/ID. This wireless technology has significant security risks, including those of surreptitious gathering of personal data by unauthorized individuals and clandestine tracking of cardholders. EPIC has consistently recommended the use of contact technology, such as the stripes on the backs of credit cards, in identification documents. Contact cards are more secure; they do not contain the risk of data theft through wireless transmission and allow cardholders to have control over who sees their data. See EPIC's RFID page for more information on the dangers of using RFID in identification documents.
Minimum driver's license and identification card issuance standards, general, §202(c)(1):
"(1) In general. -- To meet the requirements of this section, a State shall require, at a minimum, presentation and verification of the following information before issuing a driver's license or identification card to a person:
(A) A photo identity document, except that a non-photo identity document is acceptable if it includes both the person's full legal name and date of birth.
(B) Documentation showing the person's date of birth.
(C) Proof of the person's social security account number or verification that the person is not eligible for a social security account number.
(D) Documentation showing the person's name and address of principal residence."
Minimum driver's license and identification card issuance standards, special requirements §202(c)(2):
"(2) Special requirements. --
(A) In general. -- To meet the requirements of this section, a State shall comply with the minimum standards of this paragraph.
(B) Evidence of lawful status. -- A State shall require, before issuing a driver's license or identification card to a person, valid documentary evidence that the person --
(i) is a citizen or national of the United States;
(ii) is an alien lawfully admitted for permanent or temporary residence in the United States;
(iii) has conditional permanent resident status in the United States;
(iv) has an approved application for asylum in the United States or has entered into the United States in refugee status;
(v) has a valid, unexpired nonimmigrant visa or nonimmigrant visa status for entry into the United States;
(vi) has a pending application for asylum in the United States;
(vii) has a pending or approved application for temporary protected status in the United States;
(viii) has approved deferred action status; or
(ix) has a pending application for adjustment of status to that of an alien lawfully admitted for permanent residence in the United States or conditional permanent resident status in the United States."
Verification of documents, §202(c)(3):
"(3) Verification of documents. -- To meet the requirements of this section, a State shall implement the following procedures:
(A) Before issuing a driver's license or identification card to a person, the State shall verify, with the issuing agency, the issuance, validity, and completeness of each document required to be presented by the person under paragraph (1) or (2).
(B) The State shall not accept any foreign document, other than an official passport, to satisfy a requirement of paragraph (1) or (2).
(C) <> Not later than September 11, 2005, the State shall enter into a memorandum of understanding with the Secretary of Homeland Security to routinely utilize the automated system known as Systematic Alien Verification for Entitlements, as provided for by section 404 of the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 (110 Stat. 3009-664), to verify the legal presence status of a person, other than a United States citizen, applying for a driver's license or identification card.
EPIC analysis:
As the DMVs must verify name, date of birth, Social Security number, place of residence and citizenship status, "with the issuing agency," this creates an incredible bureaucracy. The DMVs must all have secure access to state and federal databases with this information. These databases have been found to have inaccurate or incomplete information, which would significantly affect DL/ID applicants. Imagine the delays, as state DMV workers will be forced to become federal immigration officers, verifying the citizenship status of applicants. And there is question of whether citizens or legal permanent residents can find the documentation required. Section 202(c)(3)(B) forbids the acceptance of "any foreign document, other than an official passport, to satisfy a requirement of paragraph (1) or (2)." There are also discrimination concerns, as those who look or sound "foreign" would be targeted. The National Conference of State Legislatures has said, "The Real ID Act would cause chaos and backlogs in thousands of state offices across the country, making the nation less secure."
Other requirements, §202(d):
"(d) Other Requirements. -- To meet the requirements of this section, a State shall adopt the following practices in the issuance of drivers' licenses and identification cards:
(1) Employ technology to capture digital images of identity source documents so that the images can be retained in electronic storage in a transferable format.
(2) Retain paper copies of source documents for a minimum of 7 years or images of source documents presented for a minimum of 10 years.
(3) Subject each person applying for a driver's license or identification card to mandatory facial image capture.
(4) Establish an effective procedure to confirm or verify a renewing applicant's information.
(5) Confirm with the Social Security Administration a social security account number presented by a person using the full social security account number. In the event that a social security account number is already registered to or associated with another person to which any State has issued a driver's license or identification card, the State shall resolve the discrepancy and take appropriate action.
(6) Refuse to issue a driver's license or identification card to a person holding a driver's license issued by another State without confirmation that the person is terminating or has terminated the driver's license.
(7) Ensure the physical security of locations where drivers' licenses and identification cards are produced and the security of document materials and papers from which drivers' licenses and identification cards are produced.
(8) Subject all persons authorized to manufacture or produce drivers' licenses and identification card security clearance requirements.
(9) Establish fraudulent document recognition training programs for appropriate employees engaged in the issuance of drivers' licenses and identification cards.
(10) Limit the period of validity of all driver's licenses and identification cards that are not temporary to a period that does not exceed 8 years.
(11) In any case in which the State issues a driver's license or identification card that does not satisfy the requirements of this section, ensure that such license or identification card --
(A) clearly states on its face that it may not be accepted by any Federal agency for federal identification or any other official purpose; and
(B) uses a unique design or color indicator to alert Federal agency and other law enforcement personnel that it may not be accepted for any such purpose.
(12) Provide electronic access to all other States to information contained in the motor vehicle database of the State.
(13) Maintain a State motor vehicle database that contains, at a minimum -
(A) all data fields printed on drivers' licenses and identification cards issued by the State; and
(B) motor vehicle drivers' histories, including motor vehicle violations, suspensions, and points on licenses."
EPIC analysis:
The requirements to maintain paper copies or digital images of these important identity documents for seven to 10 years, combined with the requirement to "provide electronic access to all other States to information contained in the motor vehicle database of the State" will make this data a tempting target for identity thieves. The 50 state (plus the District of Columbia) databases would become on large database. And one presumes that each DMV would have access to these databases at the very least to confirm that the applicant does not have a REAL ID license or ID card in another state. If a criminal could break the security of any one of the tens of thousands of entrance points, then the criminal would have access to the personal data, including Social Security numbers, of every single person in the United State with a REAL ID license or ID card. This would put hundreds of millions of people at risk for identity theft.
The requirement for non-REAL ID-compliant DL/ID to have explicit "invalid for federal purposes" designations, turns this "voluntary" card into a mandatory national ID card. Anyone with a non-REAL ID-compliant card would be instantly suspicious. Compliant cards would be necessary for federal purposes such as entering courthouses, air travel or receiving federal benefits, such as Medicaid or Social Security. It would be easy for insurance companies, credit card companies, even video stores, to demand a REAL ID-compliant DL/ID in order to receive services. Significant delay, complication and possibly harassment or discrimination would fall upon those without a REAL ID license or ID card.
