License to pry

It's called the Real ID Act, but the way things are right now, it might more accurately be called the Really No IDea Act.

More than a year after President George W. Bush signed into law the legislation touted as a tool to combat terrorism, Michigan officials and their counterparts in other states still don't know exactly what will be required for them to comply with the far-reaching measure that's to take effect in less than two years.

"Unfortunately, we are in a bit of a holding pattern, awaiting instructions from the Department of Homeland Security," says Kelly Chesney, spokeswoman for the Michigan Department of State.

Meanwhile, as the Department of Homeland Security attempts to determine the specifics of how the act will be implemented, questions about potential costs — both in terms of the dollar burden to states and the toll on individual privacy — continue to be raised about what amounts to a national ID program that will consolidate detailed personal information on a vast computer database.

Passed without congressional debate as a rider tucked into the 2005 Emergency Supplemental Appropriations for Defense, the Global War on Terror and Tsunami Relief, the act seeks to have states drastically overhaul procedures for issuing drivers' licenses by increasing the amount of documentation required to prove citizenship or legal residency and boosting the personal information contained on each card, including the addition of biometric identifiers such as fingerprints or retinal scans.

The new cards will be required for U.S. citizens and legal foreign residents in any situation requiring federally approved ID. That includes everything from boarding a plane to receiving Social Security to entering a U.S. government building or crossing the border into Canada.

Particularly upsetting for civil libertarians concerned about the Big Brother capabilities of both government and corporations is the amount of information to be contained on a single card. One requirement of the new ID will be that it use "common machine-readable technology" to store information about a person. That could mean a bar code, a magnetic strip or, more ominously, what's known as a radio frequency identification tag (RFID). As University of Washington School of Law professor Anita Ramasastry reported in a column for CNN.com, such tags emit radio frequency signals that would "allow the government to track the movement of our cards and us."

"Private businesses," Ramasastry adds, "may be able to use remote scanners to read RFID tags too, and add to the digital dossiers they may already be compiling. If different merchants combine their data — you can imagine the sorts of profiles that will develop. And unlike with a grocery store checkout, we may have no idea the scan is even occurring; no telltale beep will alert us."

Given all this, it's not surprising that concerns about the program are widespread. Ramasastry noted that more than 600 organizations have voiced concerns about the Real ID Act. Detractors ranging from the ACLU to the Gun Owners of America say the whole plan should either be scrapped or overhauled. They claim it will cost billions of taxpayer dollars — almost all of which will come out of state budgets — and make citizens more susceptible to identity theft. One thing it won't do, some say, is significantly increase national security.

Counting costs

The Congressional Budget Office says that by 2010 the country's collective DMVs will pay about $100 million to implement Real ID systems. Officials at the National Conference of State Legislatures, a Washington, D.C.-based group that analyzes legislation, say that figure doesn't come close to reflecting the reality they see coming.

"That estimate is low, really, really low," says group spokeswoman Melissa Savage.

"Cost is the big issue of many states, because they don't know what's expected of them yet," Savage says. "Are they going to have to get new computers? Are they going to have to hire additional employees? How much will it cost to retain documents?"

Washington state officials have estimated that compliance with the act could cost their state alone $150 million over three years. Savage's group predicts the costs will reach billions of dollars. How much of that will come directly out of your wallet in the form of increased fees is another of the big unknowns.

But the direct costs to states and individuals are only part of the mystery. Another huge question mark tagged to the Real ID Act concerns the issue of identity theft.

Shelli Weisberg, legislative director at the ACLU of Michigan, says that if DMVs electronically store all the information brought in as proof of identity as well as biometric descriptions, it would create a digital goldmine for identity thieves. And the requirement that each state link its system to every other state's only makes the information more prone to compromise. A hacker breaking into one state's DMV computer could steal the information belonging to anyone anywhere in the country.

"If you think about all that information ... it all gets put into one database that is then shared across the nation," says Weisberg. "It's billions and billions of records that can be tapped into for identity theft reasons."

Weisberg is also concerned about the potential for abuse posed by the use of RFID tags.

"The RFID technology is so unsecured, you could go into a protest area and someone can do a simple scan of who's there and put it in a database," Weisberg says. "We're also worried about it being picked up by businesses for commercial uses."

Margaret Stock, an associate professor at the United States Military Academy who specializes in national security law, is also concerned about the threat the Real ID Act poses to individual security.

"You're going to see more identify theft," she predicts. The federal government is "telling the states to collect all the ID documents for people and store them. People dumpster dive outside the secretary of state's office for social security numbers, birthdates, etc., but now they're actually going to able to get the actual documents. And it just takes one bad employee to swipe ID documents for everyone and start selling them."

What's more, Stock contends, storing all that information wouldn't improve national security, since the database would only include the addresses of U.S. citizens and foreigners who have their documents in order. In cases involving illegal immigrants, police who normally use the driver's license database to find the whereabouts of suspects would have one less resource.

"It's going to discourage a ton of people who are in the country illegally," she says. "That's a bad idea, because I see the driver license databases as a law enforcement database. Refusing to give drivers license's to illegal immigrants means taking 20 million illegal immigrants out of the largest law enforcement database in the country."

Addressing concerns

Homeland Security spokesman Jarrod Agen says the department has heard the concerns during its consultations with the National Council of Governors and state DMVs.

"There are issues with privacy and costs, and those are areas that we'll look to address as we prepare the regulations," he says.

However, he adds, he can't provide specific details until the department issues those regulations, which it plans to do during "the latter half of this year."

The American Association of Motor Vehicle Administrators, a group representing DMVs, created its Real ID Task Force to identify the states' concerns about the program. Association spokesman Jason King says the group plans to present a list of issues to Homeland Security this summer.

King admits that cost is a major concern for most states, but dismisses civil liberty groups' fears about increased identity theft as "an argument of fear used to sell memberships." He says state DMVs will do their utmost to protect the information they collect and store in the new computer system, whatever that system may be.

Not all states are satisfied by the AAMVA's reassurances however. New Hampshire, Kentucky and Washington have already issued resolutions opposing the Real ID mandate and are currently working on legislation that would exempt them from the program. But it's uncertain whether such legislation would cause the federal government to rethink the program or just bring sanctions against the states.

Weisberg says the ACLU is waiting to see what Homeland Security does before taking its next step. Until then, she has been meeting with Michigan lawmakers to educate them on the program's implications.

"We have given legislators the lowdown on Real ID and asked them to start asking about it," she says. "But how the feds will respond is a mystery at this point."