REAL ID continues to have 'real' challenges

I have been meaning to write something about "REAL ID" for a while now, so will attempt to provide an update on what's happening with this initiative and some additional food for thought. What is REAL ID you say?

Well, for those of you who haven't managed to hear about this identity card mandate, it started with the 9/11 Commission's recommendations (Recommendation #14 in fact) and became a matter of law in 2005 as the "REAL ID Act." The authors of the 9/11 recommendation and the subsequent legislation all were ostensibly aiming for the same thing: preventing the use of a fraudulent driver's license by terrorists through the development of safeguards that would help prevent tampering and use of such a document for false identification -- and that would also enable more effective and trustworthy authentication of individuals for purposes such as boarding a plane. (For more background on the history of the REAL ID program, see John Lehman's op-ed in the Washington Post of May 8, 2007 entitled "An Identity Crisis We Can Ease." Lehman is a former Secretary of the Navy under President Ronald Reagan and was a member of the September 11 Commission.)

Lehman and other 9/11 Commissioners, as well as key Congressional backers such as U.S. Representative Tom Davis (R-VA), have put forward a pretty compelling case over the years for moving forward with REAL ID. However, as respected as many of these proponents are in national public policy circles, their principal message of identity security being an important part of preventing future terrorist attacks has often been drowned out by the deafening criticism from privacy advocates, U.S. state government officials, and others. In his Washington Post column, Lehman writes that "...Current efforts to gut the law are based on two concerns: Some object to denying illegal immigrants the right to drive legally, citing safety and compassionate concerns. Others see the Real ID Act as the thin end of the wedge of a national identity card." Lehman goes on to state in the column that: "Neither objection is valid." He does, however, acknowledge that one objection is "legitimate" -- and this is the central argument against REAL ID that I have heard frequently from the states -- that it is an "unfunded mandate."

Whether you agree or disagree with privacy advocates in their criticism of REAL ID, or proponents such as Lehman or Congressman Davis, I have heard little disagreement about one fundamental point: that something needs to be done to provide more secure identity credentials in order to enhance national security. The other principle that many key voices seem to agree on is that a so-called "National ID Card" is probably not going to go far in this country either. And while, some opponents of the REAL ID card would argue that, if implemented correctly, this would indeed be the first step toward a national identity card, many others would argue just the opposite -- that if properly implemented, REAL ID will effectively replace any future need for a centralized, federal ID card.

So where does that leave us?

Right now, it appears that while REAL ID will be implemented in some states, it will continue to proceed very slowly, with some state legislatures and governors engaged in an outright "rebellion" against this federal mandate, largely based on funding issues. While the U.S. Department of Homeland Security (DHS) has some funding available for REAL ID pilots and the U.S. Congress is currently debating whether to make additional funding available in 2008 spending bills, it appears that only a fraction of the overall funding needed by states to fully implement REAL ID will be realized any time soon. In addition, it also appears that the privacy community will continue to be critical of REAL ID. Also, with Congress in a full-blown debate over immigration policy, who knows where this issue will turn out in that context.

Perhaps, in hindsight, one of the things that proponents of REAL ID might have done better from the outset -- in addition to directly addressing funding and privacy concerns -- would have been to lay out additional benefits that could be realized from an identity card initiative -- that did not just point to national security concerns, but would also include other uses that would provide additional value to citizens as well as state and local governments (other than just a driver's license document). That theme came up a lot during an international panel on what works and what doesn't in government ID card initiatives that I hosted at the 2007 RSA Conference in San Francisco. Toby Stevens of the U.K.-based Enterprise Privacy Group hit the nail on the head: he said that while he is a big fan of ID cards, "...It is inconceivable that we can move forward in the electronic age without some form of strong authentication," and that the long-stalled U.K. ID card was, "built around national security rather than citizen convenience."

Taking Mr. Stevens' idea and building on it, if the REAL ID card were to be used by U.S. states for other purposes -- applications such as applying for or collecting welfare or medical benefits, or for state employees' access to government buildings or information systems -- then it is arguable that this type of credential could pay for itself over time. Of course, that would mean re-working the federal REAL ID standards to allow for the use of more smart card technology -- not an unreasonable path forward, especially since a smart card would have more security features built in than the current specifications for REAL ID released by the DHS. More security features would also likely mean addressing a lot of the concerns that privacy advocates have about REAL ID today.

Other federal government initiatives could benefit from this approach as well, such as the oft-criticized PASS card program, which is part of the Western Hemisphere Travel Initiative that is co-administered by DHS and the U.S. Department of State. That program is under attack because of the use of RFID in the PASS card, related security and privacy concerns, and worries from lawmakers and others about the associated costs that residents of the border regions may have to absorb as a result of the initiative. Again, why not do more with the card? Utilize technology so that the security and privacy of the individual will be enhanced and more applications can be enabled for use now and in the future.

I am not trying to diminish the range of concerns that have been voiced about REAL ID and other initiatives, including the financial costs involved and legitimate privacy concerns. But, given the national security stakes and the prospective benefits that can be reaped by identity card initiatives that provide additional value to citizens and states alike, we might be able to more quickly get through the current national debate about REAL ID and move forward to implement a secure credential that can help deter terrorism, identity theft, and also enable more secure electronic transactions between the government and its citizens.

What do you think?

-S.L. Kellogg

Post A Comment

Your Name
Your Email	Publish email?: Yes No
Your Blog
Subject
Comment
Verification Word