REAL ID Implementation: Less Expensive, Doable, and Helpful in Reducing Fraud
Print
Download a pdf of this Backgrounder.
Updated January 24, 2011
Janice Kephart is the Director of National Security Policy at the Center for Immigration Studies.
This Backgrounder is an attempt to (1) analyze and bring up to date information on REAL ID implementation and (2) discuss potential regulatory suggestions by the National Governors Association (NGA), National Conference of State Legislatures (NCSL), and the American Association of Motor Vehicle Administrators (AAMVA) slated for an upcoming lobbying campaign. Many of these proposed changes incorporate language from the failed 2009 PASS ID Act.2 One of the lobbyists’ suggestions is to use the regulatory process to delete the “official purposes” requirement, which requires REAL ID-compliant documents to board a commercial aircraft or enter a federal building and for other “official purposes,” in essence potentially negating the federal nexus to the law as a whole. Below is an attempt to lay a foundation for a more grounded review of the law, with as much current information regarding implementation as possible. The goal is to determine the value of the upcoming lobbying effort to dumb down REAL ID regulations in light of the fact that one-third of states are either already compliant with REAL ID or are moving toward compliance.
The second precursor (and foundation) for REAL ID was the 2004 AAMVA Security Framework, which stated that ensuring people are who they say they are requires identity verification and document authentication including date of birth, Social Security number, passport information, and lawful status. This Security Framework was based on detailed recommendations of numerous task forces within AAMVA, whose basic tenets became the outline for the details contained in REAL ID.4
In 2006, a conglomeration of interests seeking to nullify REAL ID and its security tenets put out a report stating that REAL ID implementation costs would be around $11 billion, $1 billion of which were non-recurring costs, concluding the law was unduly burdensome and an unfunded mandate. Much later, the Congressional Budget Office estimated the total cost at about $3 billion. To date, Congress has appropriated, and DHS has allocated, $176 million in federal grants to the states, some of which went unused and were returned to the U.S. Treasury. Compliance deadlines have been extended twice, and today states must be compliant with REAL ID by May 2011, but are not required to complete the REAL ID enrollment process and issue REAL ID-compliant licenses to eligible applicants until December 1, 2017.
In 2008, DHS issued REAL ID regulations based on extensive comments and input from the states and other interested parties, seeking to accommodate issues related to technology, cost, and infrastructure.5 The crux of the REAL ID regulations consists of security “benchmarks” states must meet to be deemed compliant with REAL ID. These requirements establish minimum standards for issuance practices whose foundations are the identity verification of applicants and counterfeit-resistant driver licenses and ID cards that protect against identity theft. Other elements required in the second phase of REAL ID compliance focus on the security of systems, protection of personal data, and security of facilities, employees, and the cards produced under REAL ID. These cards, in turn, are then to be presented at airports and federal facilities for proof of identity upon entry to better protect national security. Yet from the 9/11 Commission’s perspective, the goal is also to eliminate as much fraud as possible from state driver’s license issuance processes and systems in order to reduce the ability of terrorists, criminals, and illegal aliens to embed in the United States with the support of state-issued IDs.
In 2009, there was a major push to repeal much of REAL ID by Department of Homeland Security Secretary Janet Napolitano, who was supporting legislation drafted by the National Governors Association. While that lobbying effort with Congress failed, many states delayed implementation based on promises of PASS ID passage (only three have laws not allowing their motor vehicle department to implement REAL ID). PASS ID would have essentially rolled back security standards to “as-is” operations and negated key 9/11 Commission recommendations. Because of the immense attention paid to PASS ID, some states decided to wait and see what would happen before moving forward with implementation.
Over the course of 2010, REAL ID has remained in place and is federal law. To date, federal grant monies allocated to states are primarily based on the number of licenses issued in each state. Considering the political tenor of REAL ID, and the assault it suffered for years, it is unexpected that most states are quietly implementing the law. Pace and commitment still differ among the states, but there is a noteworthy reduction in discussion as states are finding out implementation, on the whole, is not as expensive as they thought and is achievable. States like Maryland and Delaware, once committed, have completed implementation of the 18 benchmarks needed to fulfill material compliance with the law within a year for only twice the grant monies provided by the federal government. Extrapolated out, that puts total costs for implementing these key 18 REAL ID benchmarks in a range from $350 million to $750 million, an order of magnitude less than estimated previously. And with metrics in place, the story of REAL ID’s value in securing against fraud is beginning to take shape as not simply theory, but reality.
Despite REAL ID’s success, the NGA, the NCSL, and the AAMVA are seeking a watered-down version of REAL ID that would negate some of the key identity verification and security provisions that are currently assuring a more secure driver’s license issuing system in compliant states. Increasingly, there appears to be a divergence between the rhetoric of D.C.-based special interests and the reality of implementation in the states.
Click here for a larger version of the table
This year, for the first time ever, all states are checking Social Security numbers upon application for a driver’s license or non-driver ID. Legal status checks through SAVE are now conducted in many states and are authorized by the federal government in at least 28 more states than were seeking to check lawful status in 2006, a tremendous step forward in protecting against fraud and illegal abuse of driver’s licenses. While many states utilize SAVE to verify lawful status, others have not yet begun doing so for various reasons. For example, Alaska will not use the SAVE database for political reasons. Montana is currently holding hearings in its state legislature in order to pass a state law enabling its DMV to use SAVE. Other States have been authorized to use SAVE to verify lawful status but may not yet be conducting these verifications. during the driver license issuance process. Research to determine the exact number of states that fall into this category is ongoing.
Requiring lawful status as a condition to obtain a state-issued driver’s license or identification card, originally controversial, is now done in all but two states: New Mexico and Washington State still enable illegal aliens to obtain licenses without first checking lawful status. Despite still not requiring lawful status for a license, Washington State has managed to secure its driver’s license issuance and close its most well-known loopholes — moving much closer to REAL ID compliance — despite being one of three states that has prohibited REAL ID implementation. Washington was the first state to implement a REAL ID alternative for cross-border travel in the form of the Enhanced Driver’s license (EDL). Only U.S. citizens can apply for an EDL, which requires proof of lawful status, and Washington has done a tremendous amount to root out fraud in the EDL process. However, the state has continually gone back and forth on REAL ID implementation. In fact, New Mexico, Washington, and Utah all suffered from Arizona illegal-alien transplants upon the passage of that state’s controversial S.B. 1070 immigration law in 2010..6
Utah and Hawaii are new add-ons to “lawful status” requirements. Utah’s two-tiered system includes a “driving privilege card” for illegal aliens that are “not for federal purposes.” However, the change is significant enough that Utah has placed on its driver’s license website its stated change as follows7:
Four years ago, only three states had digitized and created connectivity to access vital records in other states. Today, vital records digitization has been completed in 21 states and another seven will be in place shortly. The goal of the Electronic Verification of Vital Events (EVVE) system, an initiative by the National Association for Public Health Statistics and Information Systems Association representing state vital statistics directors, is to have all 50 states fully on board by the May 2011 REAL ID compliance deadline. While identity verification is a core element of REAL ID’s security benchmarks, digital birth record verification is not specifically required in those benchmarks. Despite this, e-verification of birth (and death) dates is already reducing fraud in the health care, welfare, and state employment arenas, and will do so in driver’s license issuance as well. There is thus a strong incentive for willing states to use e-verification, rather than paper birth certificates that have no way to be authenticated.
Unfortunately, only the same three states that had completed interstate connectivity four years ago — North Dakota, South Dakota, and Iowa — are currently checking both their own and other state’s vital records for residents claiming out-of-state birth when applying for a driver’s license. This remains the case despite the availability of federal funding for establishing connectivity between a state’s vital records database and that same state’s motor vehicle administration, as well as interstate data sharing. This also remains the case even though DMV users are finding use of EVVE quick and easy, with queries only requiring five to seven seconds.
The EVVE office described its mission in an e-mail to me as follows:
The total cost for connecting all state and territorial vital records comes in at a low $3.8 million, funds already provided for in prior fiscal years and being used now. The total cost of digitizing and cleaning up e-records in all states is less than $102.5 million (probably about $75 million), estimated by the National Association for Public Health Statistics and Information Systems (NAPHSIS) upon completion of a survey of the states three years ago.
The success of EVVE implementation — which has served to significantly reduce fraud and identity theft traditionally plaguing state health, welfare, and employment benefits and applications — can be attributed to the work of NAPHSIS, which envisioned EVVE as recently as 2005.
States that are at 50 percent compliance or less are Alaska, Illinois, Massachusetts, Montana, New Jersey, Oklahoma, Rhode Island, Vermont, Virginia, and Washington. Maine and Hawaii were holdouts against REAL ID implementation until recently, and both were noted for having relatively insecure driver’s license issuance procedures. Both had serious political objections to REAL ID, especially the “lawful status” checks. Yet both states are now on board.
Maryland, which had refused REAL ID compliance until April 2008, is now materially compliant. Examples like Maryland demonstrate that REAL ID compliance is achievable. Montana, Oklahoma, and Washington prohibit REAL ID compliance. Illinois has only nine benchmarks completed, but is working toward compliance on the remaining nine material compliance benchmarks. Virginia only has five benchmarks met, but is working towards compliance on 10 others. Vermont has nine benchmarks in place and five partially completed. Montana is considered to have one of the best issuance systems in the nation, whether considered REAL ID-compliant or not. Washington State is featured in more detail later in this paper.
However, even states with political troubles with REAL ID implementation, like Washington, are getting around legal prohibitions and adjusting their processes to eliminate the worst of their fraud problems in a manner that ironically makes them much closer to REAL ID compliance.
For instance, in April 2010, Washington State announced an expansion of its facial recognition system from the Enhanced Driver’s License procedures to all license applicants, fulfilling Benchmark 1, one of the most costly and difficult benchmarks to achieve. Washington had already found a significant array of identity theft using the technology, including one individual with 36 different identities. The agency does not collect any more data than the typical license photo in the process, fulfilling REAL ID privacy requirements. Moreover, “only investigators with the Department of Licensing who have gone through extensive background checks”8 have access to the images. On November 11, 2010, facial recognition was credited with stopping identity thieves:
A quick look at expenditures for REAL ID implementation shows that those in two states were about twice the federal grant allocation (i.e., the state had to cover about half the cost, with the other half coming from the federal government). Iowa’s came in at just a little less than the federal grant monies, meaning they did not even need all the federal dollars provided to reach the 18 benchmarks. Delaware and Maryland found that federal REAL ID grants covered a tad more (Delaware) or a tad less (Maryland) than the state layout. Delaware’s total costs amounted to $3,075,00012 and Maryland’s $5,872,000.13
Florida, a large issuing state with $7,056,175 in federal grants and a relatively good driver’s license system prior to REAL ID, only had to spend $945,030 to become fully compliant.14 Alabama, on the other hand, began its implementation process with only two benchmarks in place and had to develop the remaining 16. However, mostly on its own dime, the state is already compliant. It cost Alabama $15,061,141 to become REAL ID-compliant with only $2,209,050 of those monies provided by federal REAL ID grant allocations.15
Extrapolating only Alabama’s numbers, whereby non-recurring costs are approximately seven times federal grant monies for each state, costs do seem to rise to the estimate of $11 billion as the 2006 Impact Analysis Statement concluded. But Alabama is likely an anomaly, as is Florida (whose experience would suggest the states had been over-granted for REAL ID compliance seven times over). Florida and Alabama appear to average out the numbers, so that between the two states, REAL ID implementation would come in at about the current REAL ID grant allocations to date, or the $176.45 million that has already been distributed to the states. (Note that these REAL ID numbers do not take into account EVVE implementation, which the federal government is paying for as well outside of the DHS REAL ID grant process.)
What seems more likely is that REAL ID implementation costs will be akin to those in Delaware and Maryland, about twice the current grant allocation, or about $350 million for the upfront costs. However, if Iowa is an accurate indicator, costs in some states will turn out about even with federal grants: REAL ID cost Iowa $2,093,000, for which it received from the federal treasury $2,767,990.16
If Congress feels that splitting the costs with the states is sufficient, then the federal government has fully funded REAL ID at this point except perhaps for side projects such as fulfilling the one driver/one license REAL ID requirement for which Mississippi is the lead state and has already received grant money to begin developing this project. If states successfully seek full funding, Congress is halfway there, and full REAL ID implementation is — at least from a financial and technical point of view — doable and in sight. Congress should be careful to look at real cost figures from state Departments of Motor Vehicles before making a decision.
While many states are quietly implementing REAL ID and costs are hard to find, other states, like California, are still claiming REAL ID is an unfunded mandate. As recently as this past year, the California governor’s budget analysts rejected a $4.2 million request from their Motor Vehicle Administrators to comply with REAL ID, claiming the law remained an unfunded mandate, despite the federal government having already allocated over $6.5 million for exactly such compliance. California analysts stated clearly that while well aware that REAL ID implementation is doable in a relatively short time frame, they decided to use funding issues as an excuse not to implement REAL ID. Instead, analysts ignored the series of federal grants already made available to the states. Ironically, accepting the California MVA request would have put California, like Florida, in the category of having leftover taxpayer dollars to send back the U.S. Treasury.
Yet despite the refusal to fund REAL ID implementation, California’s Motor Vehicle Administration on October 6, 2010, went ahead and implemented new physical security features that comply with Benchmark 9 pertaining to the physical security of the license. Under the AAMVA Security Framework, AAMVA defined — and REAL ID incorporated — levels of security as follows:
In fact, Maryland, originally quite vocal in speaking out against REAL ID implementation, decided instead, in 2008, with a push from Democratic Gov. Martin O’Malley in a late-night legislative session, to force REAL ID compliance language through the Maryland General Assembly; the details are described in my April 22, 2009 blog, “MD Faces Music on Drivers Licenses.”18 Maryland is now 100 percent compliant less than a year and a half later, and is no longer hearing complaints about fraud and waste from its DMV. In fact, the first day of implementation of lawful status rules saw the cancellation of 8,000 application interviews.
New York DMV document fraud investigators have seen a rise in identity theft and counterfeit arrests as the state moves toward stricter standards for identity verification and document issuance, from 140 arrests in 2000 and 216 in 2001 to 826 in 2008 and 789 in 2009.19 New York was an original driver of the AAMVA Security Framework that was the basis for REAL ID, and has been instituting groundbreaking security measures ever since September 11 — without prodding from the federal government. These improvements were reviewed in detail in my December 2008 piece, “An Example to Follow: New York State’s Secure Document Measures.”20
Indiana began issuing REAL ID-compliant licenses in January 2010.21 With REAL ID identity verification requirements in place and streamlined and more secure processes, the state has witnessed a 50 percent reduction in identity theft.22 The facial recognition technology deployed to all Bureau of Motor Vehicle (BMV) locations in November 2008 has been a significant factor in reducing identity theft. Within a month, all BMV locations were being serviced by facial recognition technology, and about two cases a day were being flagged for fraud investigation. (About two thirds of states are employing facial recognition technology today.23) One Indiana identity thief nabbed at the BMV was George Henry Helms.
“An alert customer service representative at the Hobart license branch and the Indiana Bureau of Motor Vehicles’ (BMV) new facial recognition technology combined to nab a customer committing an alleged identity theft crime. When the branch employee recognized George Henry Helms from a BMV ‘wanted’ poster, authorities were notified and Helms was detained by Hobart police.
Many of these changes incorporate language from the failed 2009 PASS ID Act.27 Others hold little to no value and are not reflective of the current status of REAL ID implementation. A few suggestions cut at the very core of the identity verification and authentication elements of REAL ID that are aimed at improving national and economic security.
In AAMVA’s publication MOVE, published for their 77th Annual International Conference in September 2010, a list of “Recommendations to REAL ID Rule” was published with the following lead:
AAMVA recommendation on REAL ID that would significantly devalue REAL ID’s identity verification requirements:
Remove the burden of having to provide additional documentation to prove a name change and instead rely on the Social Security number match to identify verifications.
A core element of a secure driver’s license issuance system is identity verification. If all anyone has to do is to rely on SSN matches, then counterfeiters will have an easy solution for those trying to game the system. This method of relying solely on an SSN has been used for years to commit identity theft against children or the deceased. The combination of both the lawful status database, SAVE, and the SSN database access tool, SSOLV, has forced counterfeiters to steal entire identities, both the name and SSN of an American citizen, a much harder task. Such a requirement seems minor — it applies, after all, only to the small number of people who change their names — but it actually helps address the serious fraud problem identified by the 9/11 Commission and the REAL ID Act, and is proving to do so in REAL ID-compliant states.
Conclusion: This recommendation should be deleted as it devalues a key identity verification and document authentication requirement.
AAMVA recommendations based on inaccurate or incomplete REAL ID facts:
Implementation deadlines and license enrollment cycles should be altered to accommodate the existing state cycles for issuance.
Implementation deadlines to meet minimum driver’s license issuance standards under REAL ID are a completely different issue from state license enrollment cycles. Even so, the deadlines for REAL ID implementation have already been pushed back twice and states that have pushed to meet the 18 benchmarks have done so in as little as a year. Enrollment cycles are pushed out now to 2017, so that those obtaining learner’s permits that year might not even have been born on 9/11. In short, full compliance with a 9/11 Commission recommendation will already be 16 years out from the event that spurred passage of the REAL ID law.
“Altered to accommodate the existing state cycles” should not be necessary considering the staggered time frames already provided under REAL ID regulations.
The purpose of this recommendation is to enable the Secretary of Homeland Security to pick and choose what states receive what time frames. What should be a technical requirement would automatically turn political. This result would not be a good-government outcome and opens up REAL ID implementation to abuse of power and unfair treatment of the states by the federal government.
Conclusion: This recommendation should be deleted as it unnecessarily delays REAL ID implementation based on misstatement of facts and also promotes poor policy.
The rule should not go into full effect until all the necessary federal systems are in place. REAL ID mandates the creation of a number of verification systems, including “state-to-state verification.” This suggested change would mean DHS could not hold states accountable for using these systems until they (DHS) build the systems.
In the case of Social Security number checks (SSOLV) and immigration lawful status (SAVE), the systems referred to are already in place and used by the federal government. All states are checking SSNs and all but two are checking lawful status. The only remaining database required is connectivity to the passport database held by the State Department, which is in the works and should be online by May 2011. To suggest that “DHS has to build them” is inaccurate.
Birth record systems are state systems, not federal systems. Currently 21 states and New York City have fully digitized vital records known as the EVVE program. Eight states are near completion of EVVE implementation. The EVVE schedule requires full implementation of all states and jurisdictions by May 2011, although not all states may meet that deadline. DHS does not require EVVE use until finally operational and deployed.
It is unclear what the reference to “state-to-state” systems is here. State-to-state digital image verification systems are not required by REAL ID, but do support REAL ID. Thus, these verification systems have never had to be completed prior to REAL ID implementation.
On the other hand, REAL ID does require that states be able to sustain a “one driver/one license” rule, which will conduct state-to-state checks of prior driver’s licenses issued to applicants. This recommendation therefore would accurately read “DHS should not hold states accountable for using the one driver/one license identification hub actively being developed by Mississippi under a $17 million federal grant until it is complete and DHS has deemed the hub sufficient to meet this REAL ID requirement.”
Conclusion: This AAMVA recommendation is overly broad and not based on current state operations. This recommendation needs to be significantly narrowed to add value, and limited only to the one driver/one license verification requirement. Two suggestions: (1) Clarify what “verification systems” are being referenced, and request a carve-out only for the systems necessary. In this instance, carve-out full compliance deadlines for the “one driver/one license” rule for states while providing accountability for building and completing this system; and (2) Encourage DMVs to provide connectivity to EVVE as soon as operational within their state so that, at minimum, checks can be made on lifelong residents of that state. NAPHSIS, which runs the EVVE program, has monies available for states to obtain this connectivity. No new federal appropriation would be required.
DHS should provide resources and funding to make SAVE work the way it should for it to be the tool it was meant to be.
The SAVE system already is being used in all but three states. REAL ID is currently funding for SAVE system enhancements.
Conclusion: This AAMVA recommendation is not based on the current status of the SAVE program nor its funding. This recommendation should be deleted.
Inject state flexibility in facilities security. The new language would outline broad security principles, but not be as prescriptive as past language. This will allow DHS to approve security plans on a state-by-state basis, allowing for the unique characteristics that may vary not only state to state, but within regions of a state.
The states already have flexibility in facilities security. In fact, states are encouraged to accommodate their own risks and vulnerabilities and the current guidance is just that, guidance.
Conclusion: This AAMVA recommendation is not based on the current requirements. This recommendation should be deleted.
The key AAMVA recommendation regarding REAL ID that would require congressional action:
Remove branding clauses.
“Branding” clauses refer to (1) the “gold star” affixed in the upper right hand corner of the driver’s license or state-issued ID overtly showing that the state is issuing cards that meet the benchmarks set out in REAL ID and thus is available for “official purposes” to enter federal facilities and airports (this is not a REAL ID requirement, but a regulatory one); (2) the REAL ID Act requires states to put on non-compliant license or ID issued after REAL ID is in effect “Not for federal purposes.”
Deleting the “Official Purposes” or “Not for Federal Purposes” requirement — which requires a REAL ID-compliant document to board a commercial aircraft or enter a federal building and for other “official purposes” — negates the whole federal purpose behind the REAL ID Act. It makes any license, once again, sufficient to access secure facilities and airports. It fails to distinguish between REAL ID-compliant state licenses, and those licenses or IDs provided by states but only on provisional bases. Without overt indicators of REAL ID compliance, an underlying purpose of the law — to assure a baseline of identity verification for state-issued IDs — would be negated. No officer in a secure building or TSA screener at an airport could distinguish a REAL ID-compliant license from a non-compliant one.
Conclusion: This AAMVA recommendation negates the underlying aviation and federal facility security aspect of the law. This recommendation should be deleted.
That being said, identity theft needs to be addressed head-on with robust measures to support prosecutions, levy penalties, and prevent victimization. Prosecutions and penalties can be addressed by a small changes to the federal criminal statutes pertaining to identity theft as laid out in detail in my January 2010 Backgrounder, “Fixing Flores: Assuring Adequate Penalties for Identity Theft and Fraud"28 and also proposed by Sen. Orrin Hatch in his September 2010 bill, likely to be re-introduced in the 112th Congress, “S.3901 - Strengthening Our Commitment to Legal Immigration and America’s Security Act.”29
More powerful means for individuals to protect themselves from identity theft are also needed. One example would be to allow victims of identity theft to “lock” their personal information so that it cannot be recycled for a second driver’s license by someone else. Since DMVs are already set up to check photos and dates of birth — which will be simpler and quicker as e-verification becomes standardized — it would be relatively easy to verify, and process, a request that the same identity be “unlocked.”
Thus, if John Doe locks his name and SSN while living in Alabama (it will not matter if he was born in Alabama or not), but later moves from Alabama to Tennessee, a quick look at a digital facial image and date of birth will assure the Tennessee DMV that Doe has authority to unlock his identity. Alabama’s license can be canceled and Tennessee can quickly and efficiently issue Doe a new license. State DMVs, or perhaps a more centralized state institution responsible for vital records, could maintain a voluntary, central list of “locked” names and SSNs that the DMV would check before issuing the license or upon issuing an initial license (when date of birth would be checked as well), as just another automatic query during identity verification. Other uses for the “locked” SSN, name, digital image, and date of birth from an issued driver’s license could include identity fraud prevention under E-Verify or in the health care arena, if the owner of the identity is willing to provide access to locked data to potential employers or health care institutions.
This is a possible alternative to setting up a separate database for assuring only one license per driver across the United States, although it is understood that the driver safety goals of making sure only safe drivers are on the road — not suspended or convicted drivers — is not necessarily fulfilled under this rubric. As Mississippi continues its work to define and test its identification hub in conjunction with stakeholders, assuring that is has a similar identity “lock” asset — even if such an asset is secondary to its intended purpose — would be both helpful and efficient.
Underlying the identity theft protections outlined above are other, equally important recommendations, such as:
Moreover, 11 states are already in full compliance, well ahead of the May 2011 deadline for the 18 benchmarks. Another eight are close behind. Some states, like Delaware and Maryland, have achieved REAL ID compliance within a year. Washington State refuses REAL ID compliance, but has already implemented the most difficult benchmarks.
Perhaps most astonishing is that from the cost numbers currently available, it looks like implementation of the 18 REAL ID material compliance benchmarks in all the states may end up costing somewhere between $350 million and $750 million, significantly less than the $1 billion projected by those still seeking to change the law.
Lawful status is being required as a condition to obtain a driver’s license or identification card in all but two states, up 28 states from 2006. Only Washington and New Mexico still do not require lawful status to obtain a license, but Washington so significantly upgraded its license issuance in 2010 that the fraudulent attempts to garner licenses in that state are now significantly reduced. Every state is now checking Social Security numbers.
Four years ago, only three states had digitized and created connectivity to access vital records in other states. To date, vital records digitization has been completed in 21 states. Shortly, another seven will be in place. Unfortunately, only the same three states that had completed interstate connectivity four years ago are currently checking both their own and other states’ vital records for residents claiming out-of-state birth when applying for a driver’s license. This remains the case despite the availability of federal funding for establishing connectivity between a state’s vital records database and that same state’s motor vehicle administration, as well as for interstate data sharing. E-verification of vital records, and connectivity amongst the states, could be one of the most important steps to reduce fraud. With all states due to have completed vital records digitization by early 2011, they should jump on board to obtain fully federally funded connectivity between e-vital records and DMVs for identity verification checks as soon as possible.
Unsurprisingly, the more robust the implementation of the law, the more streamlined and less fraud-ridden the ID system is, saving money and time, and reducing crime. The hypothetical support for REAL ID is becoming a reality, and vicious — and what are now baseless — attacks on REAL ID should be fading. If the National Governors Association, the National Conference of State Legislatures, and the Association of American Motor Vehicle Administrators had the best interests of their constituents in mind, they would be doing what they can to support bold states — like Indiana, Maryland, and others — and work with those struggling towards compliance and actively preventing identity theft. No changes are needed in REAL ID regulations, except perhaps a realignment of the one driver/one license rule which perhaps can be achieved by creating an interactive identity “lock” rubric between name, SSN, digital photo and date of birth. However this assumes that identification hub being developed under REAL ID by Mississippi can not meet that mandate; far from a fair assumption at this point.
At this point, all that needs to happen is for the work to go on and maintain flexibility with anti-fraud measures. It is hard not to conclude that this 9/11 Commission recommendation is proving more beneficial than anyone imagined.
2 See Janice Kephart, “Repealing REAL ID? Rolling Back Driver’s License Security,” Center for Immigration Studies, July 2009, http://www.cis.org/realid.
3 See Janice Kephart, “Identity Document Security: Moving Beyond the 9/11 Staff Report on Identity Document Security,” January 2006, for the terrorist and criminal backdrop to driver’s license fraud, http://www.cis.org/sites/cis.org/files/articles/2011/ IDSecurityStateWhitePaper0407.pdf.
4 The Security Framework and related 9/11 Commission recommendations are reviewed in detail by Janice Kephart, “The Appearance of Security: REAL ID Final Regulations vs. PASS ID Act of 2009,” Center for Immigration Studies, April 2009, http://www.cis.org/PASSID. For a detailed history of the AAMVA Security Framework, see Janice Kephart, “Identity and Security: REAL ID and the States,” April 2007, http://www.cis.org/sites/cis.org/files/articles/2011/IDSecurityStateWhit....
5 See Janice Kephart, “REAL ID Final Rules: a Summary,” March 2008, http://www.cis.org/sites/cis.org/files/articles/2011/REAL-ID-White-Paper....
6 Arizona IndyMedia, “Illegal immigrants flocking to 3 states to obtain identification: Washington, New Mexico and Utah don’t require citizenship proof for a driver’s license,” August 14, 2010, http://arizona.indymedia.org/news/2010/08/77697.php.
7 http://publicsafety.utah.gov/dld/.
8 Tony Semonti, DL Blog, “New license design, facial recognition to play latest role in stemming ID theft,” April 27, 2010, http://licensingexpress.wordpress.com/2010/04/27/new-license-design-faci....
9 Chelsea Kopta KEPR-TV, Pasco, Washington, “DOL’s Technology Thwarting ID Thieves,” November 11, 2010, http://www.keprtv.com/news/tech/107395203.html.
10 DL Blog, “Policy change for first time driver’s license applicants will reduce fraud,” November 4, 2010, http://licensingexpress.wordpress.com/2010/11/04/policy-change-for-first....
11 “The Real ID Act: National Impact Analysis,” National Governors Association, National Conference of State Legislatures, American Association of Motor Vehicle Administrators, September 2006, http://www.nga.org/Files/pdf/0609REALID.pdf.
12 Jennifer Cohan, Director Delaware Division of Motor Vehicles, AAMVA Region Annual Conference Presentation, July 25, 2008.
13 “Maryland Motor Vehicle Administration Capital Program Summary,” FY09 Total Accumulated Expenditures to comply with “The Real ID Act.”
14 Florida Department of Highway Safety and Motor Vehicles, “Fiscal Year 2009-2010 Legislative Budget Request,” September 22, 2008, http://www.flhsmv.gov/agenda/2008/093008Agenda.pdf.
15 Department of Public Safety, State of Alabama, “Special Report on the State’s Compliance with Public Law 109-13 (the “REAL ID Act of 2005”),” July 25, 2008.
16 “Iowa - An Act Relating to and Making Transportation and Other Infra-Structure-related Appropriations to the Department of Transportation,” 2009.
17 KXJZ 90.9 Sacramento, “California Licenses Get a Makeover,” October 6, 2010, http://www.capradio.org/articles/2010/10/06/california-licenses-get-a-ma....
18 http://www.cis.org/Kephart/MDHouseBill387-REALID.
19 New York Department of Fraud Investigation Arrests by Year, 2010 Presentation, New York DMV, July 2010; data obtained by the Coalition for a Secure Driver’s License.
20 http://cis.org/kephart/NYSecureDocuments.
21 Press release, “Governor eases compliance for secure driver’s licenses, identification cards,” August 12, 2009, http://www.in.gov/portal/news_events/41390.htm.
22 Devon Scott, WIBC 93.1 FM, “BMV Pleased with New Driver’s License Process,” July 12, 2010, http://www.wibc.com/news/Story.aspx?id=1251608.
23 Jim McKay, Government Technology, “Facial Recognition Helps Indiana Secure Drivers’ Licenses,” pp. 30-31, April 2009, http://www.govtech.com/gt/627236.
24 BMV press release, “Identity Theft Suspect Apprehended,” August 5, 2009, http://www.in.gov/portal/news_events/41787.htm.
25 https://myweb.in.gov/BMV/mybmvportal/InformationFor/InformationForMedia/....
26 Sandra Chapman, Channel 13 Eyewitness News, “Indiana BMV gets top honors,” September 27, 2010, http://www.wthr.com/story/13225281/indiana-bmv-gets-top-honors.
27 See “Repealing REAL ID? Rolling Back Driver’s License Security,” op.cit.
28 http://www.cis.org/Flores-Figueroa.
29 Bill introduced Sept. 29, 2010. Seehttp://www.govtrack.us/congress/bill.xpd?bill=s111-3901. See Janice Kephart, “Senator Hatch Drops a Helpful and Thoughtful Border Security Bill” (Oct. 3, 2010) at http://www.cis.org/kephart/hatch-bill .
30 Notary Bulletin, “Facial Technology Is A Powerful Tool Against Identity Theft,” September 8, 2009, http://www.nationalnotary.org/bulletin/newsNotary.cfm?newsid=2171.
Updated January 24, 2011
Janice Kephart is the Director of National Security Policy at the Center for Immigration Studies.
Raising the standards of state-issued identification is an important step toward enhancing national security. Because a driver’s license serves so many purposes (access to federal buildings and nuclear power plants, boarding aircraft, etc.), criminals and terrorists actively seek fraudulent state-issued identification. States that implement measures to increase their documents’ security make it more difficult for criminals to obtain these documents, while making it easier for law enforcement to detect falsified documents.The implementation of laws providing for minimum security standards for driver’s license issuance is living up to the claims of its supporters, primarily the Department of Homeland Security (DHS), which asserts that driver’s license security is an important step toward national security and reduced fraud at the state level. Equally important, this same 2005 REAL ID law described above, based on recommendations of the 9/11 Commission, is proving to be easier to implement and less expensive than critics have alleged for years. In fact, 11 states have already fulfilled the critical first stage of REAL ID compliance — meaning they have fulfilled all 18 REAL ID security benchmarks for material compliance — ahead of the May 2011 deadline. Additionally, many other states have implemented or are in the process of implementing more secure procedures, systems, and documents consistent with the requirements of REAL ID. The next stage requires all individuals under age 50 as of December 1, 2014, to be issued (by that date) a driver’s license or identification card that complies with all of the REAL ID requirements if the document is to be presented for official federal purposes such as boarding a commercial aircraft. The final stage requires all eligible individuals using a state-issued driver’s license or identification card for official federal purposes to be issued REAL ID-compliant licenses by December 1, 2017.
While many states have invested in improvements to their driver’s licenses and licensing processes, the lack of minimum performance standards has made it possible for criminals and terrorists to exploit jurisdictions where standards are lower and fraud is easier to commit. That is why the 9/11 Commission recommended that the federal government issue minimum performance standards that all states could measure themselves against.
-Department of Homeland Security, REAL ID Web page1
This Backgrounder is an attempt to (1) analyze and bring up to date information on REAL ID implementation and (2) discuss potential regulatory suggestions by the National Governors Association (NGA), National Conference of State Legislatures (NCSL), and the American Association of Motor Vehicle Administrators (AAMVA) slated for an upcoming lobbying campaign. Many of these proposed changes incorporate language from the failed 2009 PASS ID Act.2 One of the lobbyists’ suggestions is to use the regulatory process to delete the “official purposes” requirement, which requires REAL ID-compliant documents to board a commercial aircraft or enter a federal building and for other “official purposes,” in essence potentially negating the federal nexus to the law as a whole. Below is an attempt to lay a foundation for a more grounded review of the law, with as much current information regarding implementation as possible. The goal is to determine the value of the upcoming lobbying effort to dumb down REAL ID regulations in light of the fact that one-third of states are either already compliant with REAL ID or are moving toward compliance.
Part I: Current Status of Real ID Implementation
Background
REAL ID driver’s license provisions derive from two sources. First,
the 9/11 Commission recommended in 2004 that Congress set minimum
standards for more secure issuance of driver’s licenses and birth
records. The Commission made this recommendation based on the finding
that terrorists’ easy access to state-issued IDs helped them embed in
the United States, with 18 of the 19 hijackers having acquired a total
of 30 state-issued IDs among them, documents that enabled them to board
aircraft without additional scrutiny at check-in counters.3The second precursor (and foundation) for REAL ID was the 2004 AAMVA Security Framework, which stated that ensuring people are who they say they are requires identity verification and document authentication including date of birth, Social Security number, passport information, and lawful status. This Security Framework was based on detailed recommendations of numerous task forces within AAMVA, whose basic tenets became the outline for the details contained in REAL ID.4
In 2006, a conglomeration of interests seeking to nullify REAL ID and its security tenets put out a report stating that REAL ID implementation costs would be around $11 billion, $1 billion of which were non-recurring costs, concluding the law was unduly burdensome and an unfunded mandate. Much later, the Congressional Budget Office estimated the total cost at about $3 billion. To date, Congress has appropriated, and DHS has allocated, $176 million in federal grants to the states, some of which went unused and were returned to the U.S. Treasury. Compliance deadlines have been extended twice, and today states must be compliant with REAL ID by May 2011, but are not required to complete the REAL ID enrollment process and issue REAL ID-compliant licenses to eligible applicants until December 1, 2017.
In 2008, DHS issued REAL ID regulations based on extensive comments and input from the states and other interested parties, seeking to accommodate issues related to technology, cost, and infrastructure.5 The crux of the REAL ID regulations consists of security “benchmarks” states must meet to be deemed compliant with REAL ID. These requirements establish minimum standards for issuance practices whose foundations are the identity verification of applicants and counterfeit-resistant driver licenses and ID cards that protect against identity theft. Other elements required in the second phase of REAL ID compliance focus on the security of systems, protection of personal data, and security of facilities, employees, and the cards produced under REAL ID. These cards, in turn, are then to be presented at airports and federal facilities for proof of identity upon entry to better protect national security. Yet from the 9/11 Commission’s perspective, the goal is also to eliminate as much fraud as possible from state driver’s license issuance processes and systems in order to reduce the ability of terrorists, criminals, and illegal aliens to embed in the United States with the support of state-issued IDs.
In 2009, there was a major push to repeal much of REAL ID by Department of Homeland Security Secretary Janet Napolitano, who was supporting legislation drafted by the National Governors Association. While that lobbying effort with Congress failed, many states delayed implementation based on promises of PASS ID passage (only three have laws not allowing their motor vehicle department to implement REAL ID). PASS ID would have essentially rolled back security standards to “as-is” operations and negated key 9/11 Commission recommendations. Because of the immense attention paid to PASS ID, some states decided to wait and see what would happen before moving forward with implementation.
Over the course of 2010, REAL ID has remained in place and is federal law. To date, federal grant monies allocated to states are primarily based on the number of licenses issued in each state. Considering the political tenor of REAL ID, and the assault it suffered for years, it is unexpected that most states are quietly implementing the law. Pace and commitment still differ among the states, but there is a noteworthy reduction in discussion as states are finding out implementation, on the whole, is not as expensive as they thought and is achievable. States like Maryland and Delaware, once committed, have completed implementation of the 18 benchmarks needed to fulfill material compliance with the law within a year for only twice the grant monies provided by the federal government. Extrapolated out, that puts total costs for implementing these key 18 REAL ID benchmarks in a range from $350 million to $750 million, an order of magnitude less than estimated previously. And with metrics in place, the story of REAL ID’s value in securing against fraud is beginning to take shape as not simply theory, but reality.
Despite REAL ID’s success, the NGA, the NCSL, and the AAMVA are seeking a watered-down version of REAL ID that would negate some of the key identity verification and security provisions that are currently assuring a more secure driver’s license issuing system in compliant states. Increasingly, there appears to be a divergence between the rhetoric of D.C.-based special interests and the reality of implementation in the states.
Click here for a larger version of the table
Identity Verification and Authentication
Since 9/11 and the passage of the REAL ID Act in 2005, there has been
a surge in identity verification and document authentication compliance
in state ID-issuance systems (as well as in other federal and state
programs across the country). In the realm of driver’s license issuance,
identity verification requires digitizing birth records and providing
connectivity so any vital record can be checked by any state for any
driver’s license applicant. Verifying information provided to obtain a
license includes checking with the Social Security Administration,
checking lawful status through the immigration database known as the
Systematic Alien Verification for Entitlements (SAVE) Program or through
other means acceptable to DHS, and verifying information contained on
passports and other documents with the U.S. State Department. The law
also requires states to require multiple proofs of principal place of
residence — as opposed to a single utility bill, for example, or an
affidavit signed by the resident, as was the case in Virginia when six
9/11 hijackers fraudulently obtained IDs.This year, for the first time ever, all states are checking Social Security numbers upon application for a driver’s license or non-driver ID. Legal status checks through SAVE are now conducted in many states and are authorized by the federal government in at least 28 more states than were seeking to check lawful status in 2006, a tremendous step forward in protecting against fraud and illegal abuse of driver’s licenses. While many states utilize SAVE to verify lawful status, others have not yet begun doing so for various reasons. For example, Alaska will not use the SAVE database for political reasons. Montana is currently holding hearings in its state legislature in order to pass a state law enabling its DMV to use SAVE. Other States have been authorized to use SAVE to verify lawful status but may not yet be conducting these verifications. during the driver license issuance process. Research to determine the exact number of states that fall into this category is ongoing.
Requiring lawful status as a condition to obtain a state-issued driver’s license or identification card, originally controversial, is now done in all but two states: New Mexico and Washington State still enable illegal aliens to obtain licenses without first checking lawful status. Despite still not requiring lawful status for a license, Washington State has managed to secure its driver’s license issuance and close its most well-known loopholes — moving much closer to REAL ID compliance — despite being one of three states that has prohibited REAL ID implementation. Washington was the first state to implement a REAL ID alternative for cross-border travel in the form of the Enhanced Driver’s license (EDL). Only U.S. citizens can apply for an EDL, which requires proof of lawful status, and Washington has done a tremendous amount to root out fraud in the EDL process. However, the state has continually gone back and forth on REAL ID implementation. In fact, New Mexico, Washington, and Utah all suffered from Arizona illegal-alien transplants upon the passage of that state’s controversial S.B. 1070 immigration law in 2010..6
Utah and Hawaii are new add-ons to “lawful status” requirements. Utah’s two-tiered system includes a “driving privilege card” for illegal aliens that are “not for federal purposes.” However, the change is significant enough that Utah has placed on its driver’s license website its stated change as follows7:
“Effective January 1, 2010, Utah Driver License Division has big changes that affect EVERYONE:
ALL applicants will be required to provide the following when needing a duplicate (including applying for an endorsement), applying for or renewing a Utah Driver’s license, Original Utah Driver’s license, Utah Driving Privilege Card, or Utah Identification Card:
- Proof of identity (birth certificate in English or accompanied by a translated copy if in another language) by showing evidence of original or copies certified by the issuing agency;
- Proof of Legal/lawful presence;
- Proof of Social Security number or ITIN;
- Two proofs of Utah residence address, if it is different than the address on your current Utah record; and
- Evidence of name change, if applicable”
Vital Record Digitization
Vital records digitization is perhaps the single most important
fraud-prevention step in identity verification. No matter what other
documents or information an applicant for a driver’s license or ID
submits, everyone submits a birth date. Verifying date of birth is thus
absolutely vital to a secure driver’s license issuance process. That is
why the 9/11 Commission recommended birth record digitization and why
this requirement was made law and funded by the REAL ID Act.Four years ago, only three states had digitized and created connectivity to access vital records in other states. Today, vital records digitization has been completed in 21 states and another seven will be in place shortly. The goal of the Electronic Verification of Vital Events (EVVE) system, an initiative by the National Association for Public Health Statistics and Information Systems Association representing state vital statistics directors, is to have all 50 states fully on board by the May 2011 REAL ID compliance deadline. While identity verification is a core element of REAL ID’s security benchmarks, digital birth record verification is not specifically required in those benchmarks. Despite this, e-verification of birth (and death) dates is already reducing fraud in the health care, welfare, and state employment arenas, and will do so in driver’s license issuance as well. There is thus a strong incentive for willing states to use e-verification, rather than paper birth certificates that have no way to be authenticated.
Unfortunately, only the same three states that had completed interstate connectivity four years ago — North Dakota, South Dakota, and Iowa — are currently checking both their own and other state’s vital records for residents claiming out-of-state birth when applying for a driver’s license. This remains the case despite the availability of federal funding for establishing connectivity between a state’s vital records database and that same state’s motor vehicle administration, as well as interstate data sharing. This also remains the case even though DMV users are finding use of EVVE quick and easy, with queries only requiring five to seven seconds.
The EVVE office described its mission in an e-mail to me as follows:
“The National Association for Public Health Statistics and Information Systems (NAPHSIS) has developed and implemented an electronic verification of vital events (EVVE) system that allows immediate confirmation of the information on a birth certificate presented by an applicant to a government office anywhere in the nation irrespective of the place or date of issuance. Authorized Federal and State agency users via a single interface can generate an electronic query to any participating vital records jurisdiction throughout the country to verify the contents of a paper birth certificate or to request an electronic certification (in lieu of the paper birth certificate). An electronic response from the participating vital records jurisdiction either verifies or denies the match with official state or jurisdiction records. It will also flag positive responses where the person matched is now deceased. The EVVE system is also capable of supporting the electronic verification and/or electronic certification of death records.”Some states have indicated they prefer to wait until all 50 states are on board before establishing connectivity, even if any replacement of digital versus paper birth certificate checks for the 21 states online now would be a significant improvement to most state operations. The jurisdictions currently online are: Alabama, Arkansas, California, Connecticut, Hawaii, Iowa, Kansas, Kentucky, Minnesota, Mississippi, Missouri, Montana, New Jersey, New York City, North Dakota, Ohio, Oklahoma, Oregon, Rhode Island, South Dakota, and Utah. Nine more states and territories are in progress: Arizona, Colorado, Guam, Indiana, Massachusetts, Michigan, New York State, Northern Mariana Islands, and Pennsylvania.
The total cost for connecting all state and territorial vital records comes in at a low $3.8 million, funds already provided for in prior fiscal years and being used now. The total cost of digitizing and cleaning up e-records in all states is less than $102.5 million (probably about $75 million), estimated by the National Association for Public Health Statistics and Information Systems (NAPHSIS) upon completion of a survey of the states three years ago.
The success of EVVE implementation — which has served to significantly reduce fraud and identity theft traditionally plaguing state health, welfare, and employment benefits and applications — can be attributed to the work of NAPHSIS, which envisioned EVVE as recently as 2005.
REAL ID Material Compliance
Secretary Napolitano’s effort to replace REAL ID with PASS ID failed,
but delayed by nearly a year REAL ID implementation in some states
awaiting a congressional decision before moving forward with
implementation. Despite that delay, 11 states are already fully
compliant with all 18 of the REAL ID material compliance benchmarks:
Alabama, Colorado, Delaware, Florida, Indiana, Kansas, Kentucky,
Maryland, Mississippi, South Dakota, and Utah. Another eight states are
within one to three benchmarks of full compliance: Arkansas,
Connecticut, Georgia, Nebraska, Nevada, New York, North Dakota, and
Wyoming.States that are at 50 percent compliance or less are Alaska, Illinois, Massachusetts, Montana, New Jersey, Oklahoma, Rhode Island, Vermont, Virginia, and Washington. Maine and Hawaii were holdouts against REAL ID implementation until recently, and both were noted for having relatively insecure driver’s license issuance procedures. Both had serious political objections to REAL ID, especially the “lawful status” checks. Yet both states are now on board.
Maryland, which had refused REAL ID compliance until April 2008, is now materially compliant. Examples like Maryland demonstrate that REAL ID compliance is achievable. Montana, Oklahoma, and Washington prohibit REAL ID compliance. Illinois has only nine benchmarks completed, but is working toward compliance on the remaining nine material compliance benchmarks. Virginia only has five benchmarks met, but is working towards compliance on 10 others. Vermont has nine benchmarks in place and five partially completed. Montana is considered to have one of the best issuance systems in the nation, whether considered REAL ID-compliant or not. Washington State is featured in more detail later in this paper.
However, even states with political troubles with REAL ID implementation, like Washington, are getting around legal prohibitions and adjusting their processes to eliminate the worst of their fraud problems in a manner that ironically makes them much closer to REAL ID compliance.
For instance, in April 2010, Washington State announced an expansion of its facial recognition system from the Enhanced Driver’s License procedures to all license applicants, fulfilling Benchmark 1, one of the most costly and difficult benchmarks to achieve. Washington had already found a significant array of identity theft using the technology, including one individual with 36 different identities. The agency does not collect any more data than the typical license photo in the process, fulfilling REAL ID privacy requirements. Moreover, “only investigators with the Department of Licensing who have gone through extensive background checks”8 have access to the images. On November 11, 2010, facial recognition was credited with stopping identity thieves:
“Department of Licensing spokesman Tony Sermonti explained that identity theft is ‘a hugely expensive crime.’In addition, on November 4, 2010, Washington eliminated the worst of its loopholes pertaining to residency by requiring authentication of addresses as required by Benchmark 4. Washington’s lax residency policies had resulted in alien smugglers shipping in busloads of illegal aliens who would take up residency in Washington for a couple weeks, claim residency and obtain licenses, and leave again. The problem became exacerbated when Arizona passed its S.B. 1070. The new requirement to prove residency is described in Washington State’s Department of Licensing blog as follows:
To combat the ever-increasing crime, the Department of Licensing started using a new tool, close to six months ago, called facial recognition technology. It’s designed to unmask criminals who use a drivers license photo for any sort of fraudulent activity, such as using someone photo under a fake name.
‘We’re trying to protect (people’s) identities, we’re trying to protect their finances,’ Sermonti said.”9
“The Department of Licensing is updating its proof of residence policy in an effort aimed at reducing the numbers of individuals that fraudulently receive a Washington driver’s license.States like Washington make clear that even with a law in place that prohibits REAL ID compliance, achieving the REAL ID benchmarks is beneficial enough for the state DMV to work around the legal prohibition. Benchmarks can continue to be accomplished in this manner where state legislators or governors may be resistant, but the DMVs are capable of bureaucratic changes that are in line with REAL ID benchmarks that increase customer satisfaction and decrease fraud.
State law requires individuals to have a valid Washington residence address to obtain a Washington driver’s license or ID card.
The agency will require proof of a Washington residence address if an applicant does not provide a verified Social Security number at a driver licensing office. The documents provided will be copied and later verified by agency staff to ensure that they are valid. After that validation, a permanent license will be issued.
The change is effective Monday, Nov. 8.
This is another in a series of steps we’ve taken to clamp down on license fraud and ensure that people are Washington residents if they’re getting a license,’ said DOL director Liz Luce.”10
REAL ID Compliance Costs
Perhaps most remarkable about REAL ID implementation to date, from
the states whose REAL ID expenditures have been made public, is that the
costs for compliance are coming in nowhere near the $11 billion price
tag that the NGA, NCSL, and AAMVA presented in the 2006 National Impact
Statement. This $11 billion price tage, including $1 billion in
non-recurring costs, became a key talking point, and key complaint,
about REAL ID implementation; the first of the impact statement’s “key
findings” was, simply, “REAL ID will cost more than $11 billion to
implement.”11 This number now appears to have been grossly exaggerated.A quick look at expenditures for REAL ID implementation shows that those in two states were about twice the federal grant allocation (i.e., the state had to cover about half the cost, with the other half coming from the federal government). Iowa’s came in at just a little less than the federal grant monies, meaning they did not even need all the federal dollars provided to reach the 18 benchmarks. Delaware and Maryland found that federal REAL ID grants covered a tad more (Delaware) or a tad less (Maryland) than the state layout. Delaware’s total costs amounted to $3,075,00012 and Maryland’s $5,872,000.13
Florida, a large issuing state with $7,056,175 in federal grants and a relatively good driver’s license system prior to REAL ID, only had to spend $945,030 to become fully compliant.14 Alabama, on the other hand, began its implementation process with only two benchmarks in place and had to develop the remaining 16. However, mostly on its own dime, the state is already compliant. It cost Alabama $15,061,141 to become REAL ID-compliant with only $2,209,050 of those monies provided by federal REAL ID grant allocations.15
Extrapolating only Alabama’s numbers, whereby non-recurring costs are approximately seven times federal grant monies for each state, costs do seem to rise to the estimate of $11 billion as the 2006 Impact Analysis Statement concluded. But Alabama is likely an anomaly, as is Florida (whose experience would suggest the states had been over-granted for REAL ID compliance seven times over). Florida and Alabama appear to average out the numbers, so that between the two states, REAL ID implementation would come in at about the current REAL ID grant allocations to date, or the $176.45 million that has already been distributed to the states. (Note that these REAL ID numbers do not take into account EVVE implementation, which the federal government is paying for as well outside of the DHS REAL ID grant process.)
What seems more likely is that REAL ID implementation costs will be akin to those in Delaware and Maryland, about twice the current grant allocation, or about $350 million for the upfront costs. However, if Iowa is an accurate indicator, costs in some states will turn out about even with federal grants: REAL ID cost Iowa $2,093,000, for which it received from the federal treasury $2,767,990.16
If Congress feels that splitting the costs with the states is sufficient, then the federal government has fully funded REAL ID at this point except perhaps for side projects such as fulfilling the one driver/one license REAL ID requirement for which Mississippi is the lead state and has already received grant money to begin developing this project. If states successfully seek full funding, Congress is halfway there, and full REAL ID implementation is — at least from a financial and technical point of view — doable and in sight. Congress should be careful to look at real cost figures from state Departments of Motor Vehicles before making a decision.
While many states are quietly implementing REAL ID and costs are hard to find, other states, like California, are still claiming REAL ID is an unfunded mandate. As recently as this past year, the California governor’s budget analysts rejected a $4.2 million request from their Motor Vehicle Administrators to comply with REAL ID, claiming the law remained an unfunded mandate, despite the federal government having already allocated over $6.5 million for exactly such compliance. California analysts stated clearly that while well aware that REAL ID implementation is doable in a relatively short time frame, they decided to use funding issues as an excuse not to implement REAL ID. Instead, analysts ignored the series of federal grants already made available to the states. Ironically, accepting the California MVA request would have put California, like Florida, in the category of having leftover taxpayer dollars to send back the U.S. Treasury.
Yet despite the refusal to fund REAL ID implementation, California’s Motor Vehicle Administration on October 6, 2010, went ahead and implemented new physical security features that comply with Benchmark 9 pertaining to the physical security of the license. Under the AAMVA Security Framework, AAMVA defined — and REAL ID incorporated — levels of security as follows:
California media reported: “The new drivers licenses will feature a raised signature, photos that are only visible by UV light, and an image of the California brown bear that can only been seen with a flashlight from behind. Steve Haskins with the Department of Motor Vehicles says the changes will make it harder to forge California licenses.”17
- Level 1: inspection visible to the human eye or apparent to touch
- Level 2: inspection requiring the use of a tool or instrument (e.g. magnifying glass, UV light)
- Level 3: inspection requiring higher level of inspection (e.g., microscope)
Fraud Reduction, Law Enforcement, and Enhanced National Security
Tightening procedures for identity verification and driver’s license
issuance has an additional benefit for states. Notably, REAL ID
implementation is helping states reduce fraud, enforce the law, and
enhance national security. The Department of Homeland Security promoted
this aspect of REAL ID implementation in a 2010 power point
presentation:“REAL ID Improves Our Security: Top 5 Reasons to Adopt REAL IDStates that had chosen not to comply with REAL ID and not require lawful status found themselves, like Maryland in 2008, overwhelmed with illegal alien applications at their DMVs. The education, health, and human resources budgets were being run into the red from illegal aliens embedding in Maryland because of lax driver’s license standards, according to senior state officials, and the DMVs were overloaded with out-of-state and out-of-country requests for license application interviews.
Deters terrorists from using fraudulent identification to commit terrorist attacks
Prevents illegal immigrants from using your identity to violate immigration laws
Stops identity thieves from assuming your identity to commit crimes
Ensures aliens do not get secure licenses for longer than their lawful stay
Gives employers greater confidence in documents presented by job applicants”
In fact, Maryland, originally quite vocal in speaking out against REAL ID implementation, decided instead, in 2008, with a push from Democratic Gov. Martin O’Malley in a late-night legislative session, to force REAL ID compliance language through the Maryland General Assembly; the details are described in my April 22, 2009 blog, “MD Faces Music on Drivers Licenses.”18 Maryland is now 100 percent compliant less than a year and a half later, and is no longer hearing complaints about fraud and waste from its DMV. In fact, the first day of implementation of lawful status rules saw the cancellation of 8,000 application interviews.
New York DMV document fraud investigators have seen a rise in identity theft and counterfeit arrests as the state moves toward stricter standards for identity verification and document issuance, from 140 arrests in 2000 and 216 in 2001 to 826 in 2008 and 789 in 2009.19 New York was an original driver of the AAMVA Security Framework that was the basis for REAL ID, and has been instituting groundbreaking security measures ever since September 11 — without prodding from the federal government. These improvements were reviewed in detail in my December 2008 piece, “An Example to Follow: New York State’s Secure Document Measures.”20
Indiana began issuing REAL ID-compliant licenses in January 2010.21 With REAL ID identity verification requirements in place and streamlined and more secure processes, the state has witnessed a 50 percent reduction in identity theft.22 The facial recognition technology deployed to all Bureau of Motor Vehicle (BMV) locations in November 2008 has been a significant factor in reducing identity theft. Within a month, all BMV locations were being serviced by facial recognition technology, and about two cases a day were being flagged for fraud investigation. (About two thirds of states are employing facial recognition technology today.23) One Indiana identity thief nabbed at the BMV was George Henry Helms.
“An alert customer service representative at the Hobart license branch and the Indiana Bureau of Motor Vehicles’ (BMV) new facial recognition technology combined to nab a customer committing an alleged identity theft crime. When the branch employee recognized George Henry Helms from a BMV ‘wanted’ poster, authorities were notified and Helms was detained by Hobart police.
The Hobart Police Department confirmed that Helms already had an active warrant for check deception in Hammond. Helms has been charged with seven counts of forgery and is being held in the Lake County Jail.A “History of the Indiana BMV” page, while not mentioning REAL ID explicitly, highlights benchmarks 1 (facial imaging), 3, 4, and 5 (identity verification and document authentication), 8 (SSN checks), and 18 and 19 (controlled access and physical security of driver’s license credentialing):
BMV officials believe that Helms potentially had 10 different identities and was attempting to get an 11th credential. Helms also allegedly has 15 different identities in Illinois.
According to Indiana’s highest officials, ‘the security and integrity of the Indiana driver’s license and ID card’ was unprecedented for that state, concluding that ‘our facial recognition technology identified the suspect with multiple identities combined with the vigilance of our branch staff led to the capture of this identity thief.’”
‘Our SecureID program will help add other ways to protect Indiana credentials and ultimately reduce identity theft for Hoosiers.’”24
“While improving customer service, the BMV also focused on improving security. In 2007 the BMV began to check if names and Social Security numbers of individuals applying for credentials matched with Social Security Administration records. After scanning the driver BMV database, over 19,000 credentials were invalidated because customers could not verify why their name was different from the records with the Social Security Administration.These changes resulted in AAMVA presenting Indiana an award for “best customer service in North America” on September 27, 2010. Indiana had been considered one of the worst agencies due to long wait times, poor service, and extensive fraud, according to AAMVA:
Beginning in the fall of 2008, the BMV began screening all applicants with facial recognition technology. The software scans the entire BMV database of photos to determine if the same face was on multiple driver’s licenses or identification cards. In 2009, the BMV investigated over 2,200 cases of potential identity theft, most of which were discovered because of the facial recognition software.
In 2010, the BMV introduced the SecureID initiative to combat identity theft and enhance the security of driver’s licenses and identification cards. The new rules required customers to meet federal standards when supplying documents to receive a credential. Additionally, all credentials would be printed at the government center and mailed to customers. This new process allowed a more thorough verification of the driver’s license and identification card applications.
By 2010, Indiana had approximately 5.6 million credentials and over 6.6 million registered vehicles. The BMV processed over 13 million transactions in 2009.25
“For the second time in three years, first time for any state has ever achieved this, this year’s winner of the International Customer Service Award, best BMV anywhere on the planet is the Indiana Bureau of Motor Vehicles,” Gov. Mitch Daniels announced to a cheering crowd of employees.It is not likely that Indiana would have undertaken such positive change had it not been for the prodding of REAL ID.
There were cheers for lower wait times. The average service transaction was down from 12 minutes 15 seconds in 2007, to about eight minutes, 10 seconds in 2010. A decline despite Indiana’s move to a more Secure ID process. [emphasis added]
The BMV has also processed more than 860,000 credentials, with new facial recognition technology and survived a lawsuit over its use of Social Security numbers for verification.”26
Part II: Analysis of Proposed Changes to REAL ID
While implementation of REAL ID appears to be significantly less
expensive and time-consuming than previously thought, the proponents of
the unsuccessful attempts to repeal REAL ID and adopt PASS ID are now
quietly suggesting regulatory changes. Some of these changes require
Congress to pass significant amendments to the REAL ID law. These
suggestions are proposed by the authors of the same National Impact
Statement that claimed a price tag for REAL ID of $11 billion: the
National Governors Association, the National Conference of State
Legislatures, and the American Association of Motor Vehicle
Administrators.Many of these changes incorporate language from the failed 2009 PASS ID Act.27 Others hold little to no value and are not reflective of the current status of REAL ID implementation. A few suggestions cut at the very core of the identity verification and authentication elements of REAL ID that are aimed at improving national and economic security.
In AAMVA’s publication MOVE, published for their 77th Annual International Conference in September 2010, a list of “Recommendations to REAL ID Rule” was published with the following lead:
“Now that PASS ID appears to be all but dead in the Congress, AAMVA, along with the National Governors Association and the National Conference of State Legislatures, is considering other options to relieve REAL ID pressure on states. Though REAL ID remains, AAMVA is hopeful that the Department of Homeland Security may consider revisiting the REAL ID Final Rule and amending some burdensome portions. Though this mechanism would not alter provisions of the original statute, it could alter some of implementation details that are the troublesome for many states.” [Grammar as published]AAMVA’s recommendations would alter some provisions of the original statute. The recommendations are also contrary to AAMVA’s 2004 Security Framework, which laid the foundation for the 2005 REAL ID law. In addition, many of these recommendations are not based on implementation to date. One recommendation has potential for consideration. On the whole, however, these recommendations contribute little to the securing of driver’s license issuance. Detailed explanations are below.
AAMVA recommendation on REAL ID that would significantly devalue REAL ID’s identity verification requirements:
Remove the burden of having to provide additional documentation to prove a name change and instead rely on the Social Security number match to identify verifications.
A core element of a secure driver’s license issuance system is identity verification. If all anyone has to do is to rely on SSN matches, then counterfeiters will have an easy solution for those trying to game the system. This method of relying solely on an SSN has been used for years to commit identity theft against children or the deceased. The combination of both the lawful status database, SAVE, and the SSN database access tool, SSOLV, has forced counterfeiters to steal entire identities, both the name and SSN of an American citizen, a much harder task. Such a requirement seems minor — it applies, after all, only to the small number of people who change their names — but it actually helps address the serious fraud problem identified by the 9/11 Commission and the REAL ID Act, and is proving to do so in REAL ID-compliant states.
Conclusion: This recommendation should be deleted as it devalues a key identity verification and document authentication requirement.
AAMVA recommendations based on inaccurate or incomplete REAL ID facts:
Implementation deadlines and license enrollment cycles should be altered to accommodate the existing state cycles for issuance.
Implementation deadlines to meet minimum driver’s license issuance standards under REAL ID are a completely different issue from state license enrollment cycles. Even so, the deadlines for REAL ID implementation have already been pushed back twice and states that have pushed to meet the 18 benchmarks have done so in as little as a year. Enrollment cycles are pushed out now to 2017, so that those obtaining learner’s permits that year might not even have been born on 9/11. In short, full compliance with a 9/11 Commission recommendation will already be 16 years out from the event that spurred passage of the REAL ID law.
“Altered to accommodate the existing state cycles” should not be necessary considering the staggered time frames already provided under REAL ID regulations.
The purpose of this recommendation is to enable the Secretary of Homeland Security to pick and choose what states receive what time frames. What should be a technical requirement would automatically turn political. This result would not be a good-government outcome and opens up REAL ID implementation to abuse of power and unfair treatment of the states by the federal government.
Conclusion: This recommendation should be deleted as it unnecessarily delays REAL ID implementation based on misstatement of facts and also promotes poor policy.
The rule should not go into full effect until all the necessary federal systems are in place. REAL ID mandates the creation of a number of verification systems, including “state-to-state verification.” This suggested change would mean DHS could not hold states accountable for using these systems until they (DHS) build the systems.
In the case of Social Security number checks (SSOLV) and immigration lawful status (SAVE), the systems referred to are already in place and used by the federal government. All states are checking SSNs and all but two are checking lawful status. The only remaining database required is connectivity to the passport database held by the State Department, which is in the works and should be online by May 2011. To suggest that “DHS has to build them” is inaccurate.
Birth record systems are state systems, not federal systems. Currently 21 states and New York City have fully digitized vital records known as the EVVE program. Eight states are near completion of EVVE implementation. The EVVE schedule requires full implementation of all states and jurisdictions by May 2011, although not all states may meet that deadline. DHS does not require EVVE use until finally operational and deployed.
It is unclear what the reference to “state-to-state” systems is here. State-to-state digital image verification systems are not required by REAL ID, but do support REAL ID. Thus, these verification systems have never had to be completed prior to REAL ID implementation.
On the other hand, REAL ID does require that states be able to sustain a “one driver/one license” rule, which will conduct state-to-state checks of prior driver’s licenses issued to applicants. This recommendation therefore would accurately read “DHS should not hold states accountable for using the one driver/one license identification hub actively being developed by Mississippi under a $17 million federal grant until it is complete and DHS has deemed the hub sufficient to meet this REAL ID requirement.”
Conclusion: This AAMVA recommendation is overly broad and not based on current state operations. This recommendation needs to be significantly narrowed to add value, and limited only to the one driver/one license verification requirement. Two suggestions: (1) Clarify what “verification systems” are being referenced, and request a carve-out only for the systems necessary. In this instance, carve-out full compliance deadlines for the “one driver/one license” rule for states while providing accountability for building and completing this system; and (2) Encourage DMVs to provide connectivity to EVVE as soon as operational within their state so that, at minimum, checks can be made on lifelong residents of that state. NAPHSIS, which runs the EVVE program, has monies available for states to obtain this connectivity. No new federal appropriation would be required.
DHS should provide resources and funding to make SAVE work the way it should for it to be the tool it was meant to be.
The SAVE system already is being used in all but three states. REAL ID is currently funding for SAVE system enhancements.
Conclusion: This AAMVA recommendation is not based on the current status of the SAVE program nor its funding. This recommendation should be deleted.
Inject state flexibility in facilities security. The new language would outline broad security principles, but not be as prescriptive as past language. This will allow DHS to approve security plans on a state-by-state basis, allowing for the unique characteristics that may vary not only state to state, but within regions of a state.
The states already have flexibility in facilities security. In fact, states are encouraged to accommodate their own risks and vulnerabilities and the current guidance is just that, guidance.
Conclusion: This AAMVA recommendation is not based on the current requirements. This recommendation should be deleted.
The key AAMVA recommendation regarding REAL ID that would require congressional action:
Remove branding clauses.
“Branding” clauses refer to (1) the “gold star” affixed in the upper right hand corner of the driver’s license or state-issued ID overtly showing that the state is issuing cards that meet the benchmarks set out in REAL ID and thus is available for “official purposes” to enter federal facilities and airports (this is not a REAL ID requirement, but a regulatory one); (2) the REAL ID Act requires states to put on non-compliant license or ID issued after REAL ID is in effect “Not for federal purposes.”
Deleting the “Official Purposes” or “Not for Federal Purposes” requirement — which requires a REAL ID-compliant document to board a commercial aircraft or enter a federal building and for other “official purposes” — negates the whole federal purpose behind the REAL ID Act. It makes any license, once again, sufficient to access secure facilities and airports. It fails to distinguish between REAL ID-compliant state licenses, and those licenses or IDs provided by states but only on provisional bases. Without overt indicators of REAL ID compliance, an underlying purpose of the law — to assure a baseline of identity verification for state-issued IDs — would be negated. No officer in a secure building or TSA screener at an airport could distinguish a REAL ID-compliant license from a non-compliant one.
Conclusion: This AAMVA recommendation negates the underlying aviation and federal facility security aspect of the law. This recommendation should be deleted.
Recommendations
DHS needs to be empowered to address the ever-changing dynamic of
fraud by not allowing REAL ID to stagnate in the current rules, but
rather asserting a set of best practices that addresses changes and
updates to fraudulent activity. These need not be requirements of REAL
ID, but rather a dynamic set of best practices entered into with the
state DMVs based on the trends they are seeing, enabled by the rules.
One prescription remains inevitable: as REAL ID security measures widen,
driver’s licenses will be harder to obtain for those seeking to change
or steal identities for criminal, terrorist, or illegal immigration
purposes. As this happens, the nature of identity theft will change from
stealing just identity information such as SSNs, to stealing entire
identities, since only completely lifted identities will make it through
REAL ID identity verification and document authentication procedures.That being said, identity theft needs to be addressed head-on with robust measures to support prosecutions, levy penalties, and prevent victimization. Prosecutions and penalties can be addressed by a small changes to the federal criminal statutes pertaining to identity theft as laid out in detail in my January 2010 Backgrounder, “Fixing Flores: Assuring Adequate Penalties for Identity Theft and Fraud"28 and also proposed by Sen. Orrin Hatch in his September 2010 bill, likely to be re-introduced in the 112th Congress, “S.3901 - Strengthening Our Commitment to Legal Immigration and America’s Security Act.”29
More powerful means for individuals to protect themselves from identity theft are also needed. One example would be to allow victims of identity theft to “lock” their personal information so that it cannot be recycled for a second driver’s license by someone else. Since DMVs are already set up to check photos and dates of birth — which will be simpler and quicker as e-verification becomes standardized — it would be relatively easy to verify, and process, a request that the same identity be “unlocked.”
Thus, if John Doe locks his name and SSN while living in Alabama (it will not matter if he was born in Alabama or not), but later moves from Alabama to Tennessee, a quick look at a digital facial image and date of birth will assure the Tennessee DMV that Doe has authority to unlock his identity. Alabama’s license can be canceled and Tennessee can quickly and efficiently issue Doe a new license. State DMVs, or perhaps a more centralized state institution responsible for vital records, could maintain a voluntary, central list of “locked” names and SSNs that the DMV would check before issuing the license or upon issuing an initial license (when date of birth would be checked as well), as just another automatic query during identity verification. Other uses for the “locked” SSN, name, digital image, and date of birth from an issued driver’s license could include identity fraud prevention under E-Verify or in the health care arena, if the owner of the identity is willing to provide access to locked data to potential employers or health care institutions.
This is a possible alternative to setting up a separate database for assuring only one license per driver across the United States, although it is understood that the driver safety goals of making sure only safe drivers are on the road — not suspended or convicted drivers — is not necessarily fulfilled under this rubric. As Mississippi continues its work to define and test its identification hub in conjunction with stakeholders, assuring that is has a similar identity “lock” asset — even if such an asset is secondary to its intended purpose — would be both helpful and efficient.
Underlying the identity theft protections outlined above are other, equally important recommendations, such as:
- Provide a financial incentive for states reaching early compliance
or going beyond REAL ID security requirements. For states that fail to
meet compliance deadlines, rather than their federal grant monies being
returned to the Treasury, as has been the case to date, it would be
better to turn those monies back around to help backfill the coffers of
other states where REAL ID monies were insufficient to gain full
compliance.
- Require all states to obtain and use connectivity to digitized vital
records via EVVE as well as interstate connectivity that incorporate
vital records checks into the initial identity verification check.
- Authorize DHS to organize and require states to do in-state (at
least 37 states are using facial recognition technology under the
International Civil Aviation Organization passport photo requirements to
drastically reduce fraud)30
and interstate state digital photo comparisons to identify drivers who
have multiple licenses in several states under different identities. The
digital photo match, along with a name/SSN/DOB lock, could be a more
effective way to enforce the one driver/one license requirement of REAL
ID.
- Require states to report compromised security features to DHS in order that the DHS Secretary, in conjunction with a working group of state DMVs, can make recommendations to states to alter practices to stay in front of fraudulent compromises to secure IDs.
Conclusion
States are finding that implementation of the 2005 REAL ID Act is
much easier and less expensive than previously thought, and is a
significant factor in reducing fraud. In cases like Indiana, REAL ID has
significantly improved customer satisfaction, resulting in that state
receiving AAMVA’s “customer satisfaction” award of the year. This is not
just a win-win for national and economic security, but a win (less
expensive) -win (doable) -win (fraud reduction) -win (improved customer
satisfaction) for federal and state governments as well as individuals. Moreover, 11 states are already in full compliance, well ahead of the May 2011 deadline for the 18 benchmarks. Another eight are close behind. Some states, like Delaware and Maryland, have achieved REAL ID compliance within a year. Washington State refuses REAL ID compliance, but has already implemented the most difficult benchmarks.
Perhaps most astonishing is that from the cost numbers currently available, it looks like implementation of the 18 REAL ID material compliance benchmarks in all the states may end up costing somewhere between $350 million and $750 million, significantly less than the $1 billion projected by those still seeking to change the law.
Lawful status is being required as a condition to obtain a driver’s license or identification card in all but two states, up 28 states from 2006. Only Washington and New Mexico still do not require lawful status to obtain a license, but Washington so significantly upgraded its license issuance in 2010 that the fraudulent attempts to garner licenses in that state are now significantly reduced. Every state is now checking Social Security numbers.
Four years ago, only three states had digitized and created connectivity to access vital records in other states. To date, vital records digitization has been completed in 21 states. Shortly, another seven will be in place. Unfortunately, only the same three states that had completed interstate connectivity four years ago are currently checking both their own and other states’ vital records for residents claiming out-of-state birth when applying for a driver’s license. This remains the case despite the availability of federal funding for establishing connectivity between a state’s vital records database and that same state’s motor vehicle administration, as well as for interstate data sharing. E-verification of vital records, and connectivity amongst the states, could be one of the most important steps to reduce fraud. With all states due to have completed vital records digitization by early 2011, they should jump on board to obtain fully federally funded connectivity between e-vital records and DMVs for identity verification checks as soon as possible.
Unsurprisingly, the more robust the implementation of the law, the more streamlined and less fraud-ridden the ID system is, saving money and time, and reducing crime. The hypothetical support for REAL ID is becoming a reality, and vicious — and what are now baseless — attacks on REAL ID should be fading. If the National Governors Association, the National Conference of State Legislatures, and the Association of American Motor Vehicle Administrators had the best interests of their constituents in mind, they would be doing what they can to support bold states — like Indiana, Maryland, and others — and work with those struggling towards compliance and actively preventing identity theft. No changes are needed in REAL ID regulations, except perhaps a realignment of the one driver/one license rule which perhaps can be achieved by creating an interactive identity “lock” rubric between name, SSN, digital photo and date of birth. However this assumes that identification hub being developed under REAL ID by Mississippi can not meet that mandate; far from a fair assumption at this point.
At this point, all that needs to happen is for the work to go on and maintain flexibility with anti-fraud measures. It is hard not to conclude that this 9/11 Commission recommendation is proving more beneficial than anyone imagined.
End Notes
1 http://www.dhs.gov/files/programs/gc_1200062053842.shtm.2 See Janice Kephart, “Repealing REAL ID? Rolling Back Driver’s License Security,” Center for Immigration Studies, July 2009, http://www.cis.org/realid.
3 See Janice Kephart, “Identity Document Security: Moving Beyond the 9/11 Staff Report on Identity Document Security,” January 2006, for the terrorist and criminal backdrop to driver’s license fraud, http://www.cis.org/sites/cis.org/files/articles/2011/ IDSecurityStateWhitePaper0407.pdf.
4 The Security Framework and related 9/11 Commission recommendations are reviewed in detail by Janice Kephart, “The Appearance of Security: REAL ID Final Regulations vs. PASS ID Act of 2009,” Center for Immigration Studies, April 2009, http://www.cis.org/PASSID. For a detailed history of the AAMVA Security Framework, see Janice Kephart, “Identity and Security: REAL ID and the States,” April 2007, http://www.cis.org/sites/cis.org/files/articles/2011/IDSecurityStateWhit....
5 See Janice Kephart, “REAL ID Final Rules: a Summary,” March 2008, http://www.cis.org/sites/cis.org/files/articles/2011/REAL-ID-White-Paper....
6 Arizona IndyMedia, “Illegal immigrants flocking to 3 states to obtain identification: Washington, New Mexico and Utah don’t require citizenship proof for a driver’s license,” August 14, 2010, http://arizona.indymedia.org/news/2010/08/77697.php.
7 http://publicsafety.utah.gov/dld/.
8 Tony Semonti, DL Blog, “New license design, facial recognition to play latest role in stemming ID theft,” April 27, 2010, http://licensingexpress.wordpress.com/2010/04/27/new-license-design-faci....
9 Chelsea Kopta KEPR-TV, Pasco, Washington, “DOL’s Technology Thwarting ID Thieves,” November 11, 2010, http://www.keprtv.com/news/tech/107395203.html.
10 DL Blog, “Policy change for first time driver’s license applicants will reduce fraud,” November 4, 2010, http://licensingexpress.wordpress.com/2010/11/04/policy-change-for-first....
11 “The Real ID Act: National Impact Analysis,” National Governors Association, National Conference of State Legislatures, American Association of Motor Vehicle Administrators, September 2006, http://www.nga.org/Files/pdf/0609REALID.pdf.
12 Jennifer Cohan, Director Delaware Division of Motor Vehicles, AAMVA Region Annual Conference Presentation, July 25, 2008.
13 “Maryland Motor Vehicle Administration Capital Program Summary,” FY09 Total Accumulated Expenditures to comply with “The Real ID Act.”
14 Florida Department of Highway Safety and Motor Vehicles, “Fiscal Year 2009-2010 Legislative Budget Request,” September 22, 2008, http://www.flhsmv.gov/agenda/2008/093008Agenda.pdf.
15 Department of Public Safety, State of Alabama, “Special Report on the State’s Compliance with Public Law 109-13 (the “REAL ID Act of 2005”),” July 25, 2008.
16 “Iowa - An Act Relating to and Making Transportation and Other Infra-Structure-related Appropriations to the Department of Transportation,” 2009.
17 KXJZ 90.9 Sacramento, “California Licenses Get a Makeover,” October 6, 2010, http://www.capradio.org/articles/2010/10/06/california-licenses-get-a-ma....
18 http://www.cis.org/Kephart/MDHouseBill387-REALID.
19 New York Department of Fraud Investigation Arrests by Year, 2010 Presentation, New York DMV, July 2010; data obtained by the Coalition for a Secure Driver’s License.
20 http://cis.org/kephart/NYSecureDocuments.
21 Press release, “Governor eases compliance for secure driver’s licenses, identification cards,” August 12, 2009, http://www.in.gov/portal/news_events/41390.htm.
22 Devon Scott, WIBC 93.1 FM, “BMV Pleased with New Driver’s License Process,” July 12, 2010, http://www.wibc.com/news/Story.aspx?id=1251608.
23 Jim McKay, Government Technology, “Facial Recognition Helps Indiana Secure Drivers’ Licenses,” pp. 30-31, April 2009, http://www.govtech.com/gt/627236.
24 BMV press release, “Identity Theft Suspect Apprehended,” August 5, 2009, http://www.in.gov/portal/news_events/41787.htm.
25 https://myweb.in.gov/BMV/mybmvportal/InformationFor/InformationForMedia/....
26 Sandra Chapman, Channel 13 Eyewitness News, “Indiana BMV gets top honors,” September 27, 2010, http://www.wthr.com/story/13225281/indiana-bmv-gets-top-honors.
27 See “Repealing REAL ID? Rolling Back Driver’s License Security,” op.cit.
28 http://www.cis.org/Flores-Figueroa.
29 Bill introduced Sept. 29, 2010. Seehttp://www.govtrack.us/congress/bill.xpd?bill=s111-3901. See Janice Kephart, “Senator Hatch Drops a Helpful and Thoughtful Border Security Bill” (Oct. 3, 2010) at http://www.cis.org/kephart/hatch-bill .
30 Notary Bulletin, “Facial Technology Is A Powerful Tool Against Identity Theft,” September 8, 2009, http://www.nationalnotary.org/bulletin/newsNotary.cfm?newsid=2171.
No comments:
Post a Comment