Wash. to pilot biometric card

Project with DHS to test license that could meet Real ID and passport card standards

Related Links

Wherefore art thou?

Ten Top Real ID Complaints

The Real ID law has met with a fusillade of criticism from state and federal lawmakers, privacy advocates, state executive branch officials and commentators.
Opponents have cited dozens of potential technical problems, including:

10. Only one of the five national systems that state motor vehicle departments will need to implement the Real ID law is currently ready, according to the National Governors Association. DHS itself concedes that some federal 'reference databases' aren't yet complete.

9. Real ID calls for states to use a single array of security features for driver's license cards, which could force states to abandon existing card issuance systems.

8. The federal government lacks a uniform naming convention that would facilitate states' electronic verification between files.

7. The door remains open for creation of a de facto national identity database.

6. The draft Real ID rule doesn't include a redress process, which likely will become a technical as well as a policy issue, because thousands of people now have driver's licenses with faulty data.

5. The draft doesn't require that data on the license's machine-readable zone (MRZ) be encrypted. DHS has said that distributing encryption keys, or a single, common key to the 16,000 state and local law enforcement agencies that will need access to the MRZ data would pose an unacceptable challenge. The department said it would favor MRZ encryption if the practical problems could be solved and raised the possibility that the MRZ shouldn't include the bearer's address.

4. Some critics charge that Real ID magnifies privacy risks, partly by shirking the requirement that federally sponsored systems meet the standards of the Federal Information Security Management Act. The draft rule states that it doesn't create a national database because it leaves the interstate data exchange decisions to the DMVs. That statement prompted Jim Harper, director of information policy studies for the Cato Institute, to posit that DHS was saying, 'My car didn't hit you'the bumper did.'

3. DHS has failed to require that the MRZ omit the race identifier field.

2. Real ID fails to take advantage of identity verification processes the federal government already carries out when it issues passports, military IDs, Transportation Worker Identification Cards and some federal employee credentials. The National Conference of State Legislatures has asked why, if individuals holding such documents can already board an airliner, they should be checked again to get a driver's license.

1. Technical challenges, such as the apparently inadvertent omission of several categories of legal residents eligible for the credentials and the high cost to states of complying with the law, have spurred a vigorous rejection campaign in state capitals. Idaho and Maine already have enacted laws rejecting the Real ID requirements, and similar legislation is pending in dozens of additional states.

Wilson P. Dizard III

Status of anti-Real ID legislation
Maine and Idaho have passed legislation rejecting the Real ID program and similar measures have been introduced in other states, including Washington.
States with statute or resolution:
Red - Enacted
Blue - Passed one chamber
Green - Introduced

The debate over biometric credentials has moved into new territory now that Washington state and the Homeland Security Department have agreed to pilot a secure biometric driver's license that also would serve as proof of citizenship at border crossings.

The pilot would create a license that is compliant with the controversial Real ID program and could be used as a passport in some situations.

State and federal lawmakers, as well as the National Governors Association, have blasted the federal Real ID program, which is aimed at fostering secure biometric driver's licenses that also would serve as proof of citizenship or legal residence. Various states have threatened to opt out of the supposedly voluntary Real ID program, and Maine and Idaho have done so.

'We think it is a breakthrough,' DHS assistant secretary for policy development Richard Barth said last week. 'We expect other border states will also [seek comparable hybrid documents].'

Meanwhile, the controversial federal Western Hemisphere Travel Initiative (WHTI) has been tightening the rules for citizens to re-enter the country along the land borders and after sea cruises.

Beginning in January 2008, WHTI rules will require that returning citizens show secure biometric credentials at the land borders, ending a longstanding practice under which immigration officials accepted as many as 8,000 different types of documents or, in some cases, no ID at all.

That pending WHTI requirement has prompted outcries from border state lawmakers who charge that it will be a costly burden on their constituents and hamper travel and trade.

An agreement between DHS and Washington state calls for the state to produce a Real ID-compliant driver's license that could potentially also function as proof of citizenship for re-entry under the WHTI land border identification requirement.

DHS and the State Department have developed plans for a 'passport card,' seen as a cheaper and simpler alternative to a full-fledged passport for use by border state residents, to ease compliance with the WHTI rules.

"The pilot is a way to boost security without hampering trade and tourism." Gov. Chris Gregoire


'This pilot project is a way to boost security at our border without hampering trade and tourism,' Washington Gov. Chris Gregoire said in a prepared statement.
'Our effort to keep our border crossing moving is particularly important with the upcoming 2009 World Police and Fire Fighter Games and the 2010 Winter Olympics and Paralympics in British Columbia,' Gregoire said.

DHS said in a press statement that the combo credential would be 'slightly more expensive than a standard Washington state driver's license, and will require proof of citizenship, identity and residence, as well as contain security features similar to a U.S. passport.'

DHS Secretary Michael Chertoff praised the agreement, saying that 'the foundation of terrorist and criminal activity is the ability to move undetected.' He added that security and efficiency at the borders can be harmonized.

The Washington state pilot poses several technical issues, some of which flow from the major differences between the plans for the passport cards and the draft technical definition of the Real ID driver's licenses.

The issues fall in three main categories:

  • How will the business rules for the Real ID program mesh with those for the WHTI credentials?
  • How will the states produce credentials that meet the requirements the State Department has developed for the WHTI passport cards themselves, not only in the aspects of document security but in the storage media and content of biometric data on the actual cards?
  • How will states and federal agencies develop the back-end systems to allow immigration officials, law enforcement officers and others to authenticate the combo credentials?

The business rule issue for the Real ID program and the WHTI passport card puts two dramatically different programs and technologies on a collision course.
On the Real ID side, DHS has issued a Notice of Proposed Rulemaking that describes a recommended process for structuring the secure biometric driver's license program.

However, structuring the Real ID program calls for 50 states as well as several other territories that issue driver's licenses to agree on compatible business rules for authentication, privacy, data security, encryption of data in transit and security of data 'at rest' within motor vehicle departments.

In the passport card arena, State can rely on its business processes, painstakingly built over many decades, for verifying citizenship. So the WHTI program can rely on an existing, monolithic structure with relatively clear business rules.

Another glaring difference between the two programs is that while only citizens will be eligible for the passport cards, many other categories of legal residents and even temporary visitors will need Real ID cards. Checking the legal residence status of, say, a foreign student, a refugee or a permanent legal resident calls for access to various types of databases, mostly within DHS.

Production of the hybrid cards themselves potentially will require states to use a radically different set of security features than that which has grown up in the DMV world. The passport card security features include several that have their roots in those used for the full-fledged passports.

Security levels
Passport experts say that passport security features range from simple and visible measures to several levels of increasingly secure special features.

Some of the most secure features 'which include special printing, visible and invisible self-checking features, and some of the materials used ' require laboratory tests to detect. There is even a level of security features above what the basic laboratory tests can find, which requires especially sophisticated laboratory equipment, the experts said.

In a separate technical area, the passport card development plans now call for embedding a radio frequency identification device in the credentials.

That use of RFID technology in driver's licenses could give new impetus to critics who condemn all types of RFID technology, among them lawmakers in several state legislatures.

The Real ID draft regulations recommend the use of an unencrypted bar code on the back of the driver's licenses, a technology that isn't secure at all.

In addition, the Real ID rulemaking proposal states that DHS will help the states meet the requirements for the program by fostering the creation of an as-yet unbuilt back-end network that states would use to verify applicants' eligibility for driver's licenses (see sidebar).

State motor vehicle administrators long have recognized that thousands of drivers hold licenses for multiple states, or have licenses based on various kinds of flawed information, such as incorrect addresses.

A large part of the Real ID program calls for states to dramatically upgrade the security of their physical facilities for motor vehicle administration, improve the vetting of DMV employees and bolster system security.

The agreement between DHS and Washington state raises all the security issues to a higher level because the credential in effect would entail several benefits:

  • The right to enter the country an unlimited number of times
  • The right to employment
  • The privilege of driving.

The special Washington state credential could be a document forger's dream come true, because it would confer multiple benefits to the person holding it, credential specialists said.

But Jim Lewis, director of the Technology and Public Policy program at the Center for Strategic and International Studies in Washington, said, 'Using a driver's license to get across the border doesn't bother me. For a long time, that was all you needed. It appears now that we are getting back to that, and the driver's license will prove to the immigration officials that you are an American.'

Lewis contended that the government likely has gone overboard with its credentialing requirements, especially with regard to the Transportation Worker Identification Credential and the Western Hemisphere Travel Initiative.

'The driver's license is the primary identification document for most people and so anything that strengthens that is a good idea,' Lewis said. He cautioned that having one all-purpose card that confers every possible benefit the government can provide would be a problem, partly because of how creating such a credential would centralize so much personal information in one source.

'It's not like we are coming from perfection now,' Lewis said. 'You have to look for improvement, not perfection.'

Lewis agreed with DHS officials' predictions that other border states would seek to emulate the Washington state hybrid credential program.

'We should issue a better driver's license and get out of the multiple credential business,' Lewis said. 'Just because Congress created WHTI doesn't mean it is a good idea.'

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above