Backgrounder -REAL ID Implementation - CIS Jan. 2011

8/8/2019 Backgrounder -REAL ID Implementation - CIS Jan. 2011

http://slidepdf.com/reader/full/backgrounder-real-id-implementation-cis-jan-2011 1/20

1

Center for Immigration StudiesBackgrounder January 2011

REAL ID ImplementationLess Expensive, Doable, and Helpful in Reducing Fraud

By Janice Kephart

Janice Kephart is the Director o National Security Policy at the Center or Immigration Studies. A special thanks or research support to the Coalition or a Secure Driver’s License.

“Raising the standards o state-issued identication is an important step toward enhancing national security. Because a driver’s license serves so many purposes (access to ederal buildings and nuclear power plants, boarding aircrat, etc.), criminals and terrorists actively seek raudulent state-issued identication. States that implement measures to increase their documents’ security make it more dicult or criminals to obtain these documents, while making it easier or law enorcement to detect alsied documents.

While many states have invested in improvements to their driver’s licenses and licensing processes, the lack o minimum perormance standards has made it possible or criminals and terrorists to exploit jurisdictions where standards are lower and raud is easier to commit. Tat is why the 9/11 Commission

recommended that the ederal government issue minimum perormance standards that all states could measure themselves against.” -Department o Homeland Security, REAL ID Web page1

he implementation o laws providing or minimum security standards or driver’s license issuance is livingup to the claims o its supporters, primarily the Department o Homeland Security (DHS), which assertsthat driver’s license security is an important step toward national security and reduced raud at the state

level. Equally important, this same 2005 REAL ID law described above, based on recommendations o the 9/11Commission, is proving to be easier to implement and less expensive than critics have alleged or years. In act, 11states have already ullled the rst stage o REAL ID compliance — meaning they have ullled all 18 REAL IDsecurity benchmarks — ahead o the May 2011 deadline. Te next stage, in December 2014, requires all those who have reached the age o 50 by that date to be issued a license that complies with the 18 benchmarks. Te nalstage requires all eligible individuals to be enrolled with REAL ID-compliant licenses by December 2017.

Tis Backgrounder is an attempt to (1) analyze and bring up to date inormation on REAL IDimplementation and (2) discuss potential regulatory suggestions by the National Governors Association (NGA),National Conerence o State Legislatures (NCSL), and the American Association o Motor Vehicle Administrators(AAMVA) slated or an upcoming lobbying campaign. Many o these proposed changes incorporate languagerom the ailed 2009 PASS ID Act.2 One o the lobbyists’ suggestions is to use the regulatory process to delete the“ocial purposes” requirement, which requires REAL ID-compliant documents to board a commercial aircrator enter a ederal building and or other “ocial purposes,” in essence potentially negating the ederal nexus tothe law as a whole. Below is an attempt to lay a oundation or a more grounded review o the law, with as muchcurrent inormation regarding implementation as possible. Te goal is to determine the value o the upcominglobbying eort to dumb down REAL ID regulations in light o the act that one-third o states are either already

ully compliant with REAL ID or close to it.

Part I: Current Status of Real ID Implementation

Background REAL ID driver’s license provisions derive rom two sources. First, the 9/11 Commission recommended in2004 that Congress set minimum standards or more secure issuance o driver’s licenses and birth records. TeCommission made this recommendation based on the nding that terrorists’ easy access to state-issued IDs helpedthem embed in the United States, with 18 o the 19 hijackers having acquired a total o 30 state-issued IDs among



2

Center for Immigration Studies

them, documents that enabled them to board aircrat without additional scrutiny at check-in counters.3

Te second precursor (and oundation) orREAL ID was the 2004 AAMVA Security Framework, which stated that ensuring people are who they say they are requires identity verication and documentauthentication including date o birth, Social Security

number, passport inormation, and legal status.Tis Security Framework was based on detailedrecommendations o numerous task orces within AAMVA, whose basic tenets became the outline or thedetails contained in REAL ID.4

In 2006, a conglomeration o interests seekingto nulliy REAL ID and its security tenets put out areport stating that REAL ID implementation costs would be around $11 billion, $1 billion o which werenon-recurring costs, concluding the law was unduly burdensome and an ununded mandate. Much later, theCongressional Budget Oce estimated the total cost at

about $3 billion. o date, Congress has appropriated,and DHS has allocated, $176 million in ederal grants tothe states, some o which went unused and were returnedto the U.S. reasury. Compliance deadlines have twicebeen pushed out, and today states must be compliant with the 18 benchmarks by May 2011, but are notrequired to produce REAL ID-compliant licenses or alllegal residents until 2017.

In 2008, DHS issued REAL ID regulationsbased on extensive comments and input rom the statesand other interested parties, seeking to accommodate

issues related to easibility in terms o technology, cost,and inrastructure.5 Te crux o the REAL ID regulationsconsists o 18 security “benchmarks” states must meet tobe deemed compliant with REAL ID minimum standardsor driver’s license issuance. Tese IDs, in turn, are thento be presented at airports and ederal acilities or proo o identity upon entry, to better protect national security. Yet rom the 9/11 Commission’s perspective, the goal isalso to eliminate as much raud as possible rom statedriver’s license issuance systems in order to reduce theability o terrorists, criminals, and illegal aliens to embedin the United States with the support o state-issued IDs.

In 2009, there was a major push to repeal mucho REAL ID by Department o Homeland Security Secretary Janet Napolitano, who was supportinglegislation drated by the National Governors Association. While that lobbying eort with Congressailed, many states delayed implementation based onpromises o PASS ID passage (only three have laws notallowing their motor vehicle department to implementREAL ID). PASS ID would have essentially rolled back security standards to “as-is” operations and negated

some key 9/11 Commission recommendations. Becauseo the immense attention paid to PASS ID, some statesdecided to wait and see what would happen beoremoving orward with implementation.

Over the course o 2010, REAL ID hasremained in place. o date, ederal grant monies aremostly based on the number o licenses issued in each

state. Considering the political tenor o REAL ID, andthe assault it suered or years, it is unexpected thatmost states are quietly implementing the law. Pace andcommitment still dier among the states, but there is anoteworthy reduction in discussion as states are ndingout implementation, on the whole, is not as expensiveas they thought and is achievable. States like Marylandand Delaware, once committed, have completedimplementation o the 18 benchmarks within a yearor only twice the grant monies provided by the ederalgovernment. Extrapolated out, that puts total costsor implementing the 18 REAL ID benchmarks in

a range rom $350 million to $750 million, an ordero magnitude less than estimated previously. And withmetrics in place, the story o REAL ID’s value in securingagainst raud is beginning to take shape as not simply theory, but reality.

Despite REAL ID’s success, the NGA, theNCSL, and the AAMVA are seeking a watered-downversion o REAL ID that would negate some o the key identity verication and security provisions that arecurrently assuring a more secure driver’s license issuingsystem in compliant states. Increasingly, there appears

to be a divergence between the rhetoric o D.C.-basedspecial interests and the reality o implementation in thestates.

Identity Verifcation and Authentication Since 9/11 and the passage o the REAL ID Act in2005, there has been a surge in identity vericationand document authentication compliance in stateID-issuance systems (as well as in other ederal andstate programs across the country). In the realm o driver’s license issuance, identity verication requiresdigitizing birth records and providing connectivity soany vital record can be checked by any state or any driver’s license applicant. Authenticating inormationprovided to obtain a license includes checking with theSocial Security Administration; checking immigrationstatus through the immigration database known as theSystematic Alien Verication or Entitlements (SAVE)Program; and checking passport numbers and photos with the State Department. Te law also requires statesto require multiple proos o principal place o residence



3


— as opposed to a single utility bill, or example, oran adavit signed by the resident, as was the case inVirginia when six 9/11 hijackers raudulently obtainedIDs.

Tis year, or the rst time ever, all states arechecking Social Security numbers upon application or adriver’s license or non-driver ID. Michigan, Minnesota,

and Oklahoma all added SSN checks within the lastyear, closing that loophole.

Legal status checks are done in 28 more statesthan were checking legal presence in 2006, a tremendousstep orward in protecting against raud and illegal abuseo driver’s licenses. Veriying legal presence, originally controversial, is now done in all but two states; NewMexico and Washington State are the only ones letissuing licenses to illegal aliens without rst checkinglegal status.

Despite still not requiring legal presence ora license, Washington State has managed to secure

its driver’s license issuance and close its most well-known loopholes — moving much closer to REAL IDcompliance — despite being one o three states that hasprohibited REAL ID implementation. Washington wasthe rst state to implement a REAL ID alternative orcross-border travel in the orm o the Enhanced Driver’slicense (EDL). Only U.S. citizens can apply or an EDL, which requires proo o legal presence, and Washingtonhas done a tremendous amount to root out raud in theEDL process. However, the state has continually goneback and orth on REAL ID implementation. In act,

New Mexico, Washington, and Utah all suered rom Arizona illegal-alien transplants upon the passage o thatstate’s controversial S.B. 1070 immigration law in 2010.6

Utah and Hawaii are new add-ons to “lawulpresence” requirements. Utah’s two-tiered systemincludes a “driving privilege card” or illegal aliens thatis “not or ederal purposes.” However, the change issignicant enough that Utah has placed on its driver’slicense website its stated change as ollows7:

“Eective January 1, 2010, Utah DriverLicense Division has big changes that aect

EVERYONE:

ALL applicants will be required to provide theollowing when needing a duplicate (includingapplying or an endorsement), applying or orrenewing a Utah Driver’s license, Original UtahDriver’s license, Utah Driving Privilege Card, orUtah Identication Card:

* Proo o identity (birth certicate in Englishor accompanied by a translated copy i inanother language) by showing evidence o original or copies certied by the issuingagency;

* Proo o Legal/lawul presence;* Proo o Social Security number or IIN;

* wo proos o Utah residence address, i itis dierent than the address on your currentUtah record; and

* Evidence o name change, i applicable”

Vital Record Digitization Vital records digitization is perhaps the single mostimportant raud-prevention step in identity verication.No matter what other documents or inormation anapplicant or a driver’s license or ID submits, everyonesubmits a birth date. Veriying date o birth is thus

absolutely vital to a secure driver’s license issuance process.Tat is why the 9/11 Commission recommended birthrecord digitization and why this requirement was madelaw and unded by the REAL ID Act.

Four years ago, only three states had digitizedand created connectivity to access vital records inother states. oday, vital records digitization has beencompleted in 21 states and another seven will be in placeshortly. Te goal o the Electronic Verication o VitalEvents (EVVE) system, an initiative by the associationrepresenting state vital statistics directors, is to have all50 states ully on board by the May 2011 REAL ID

compliance deadline. While identity verication is a coreelement o REAL ID’s 18 security benchmarks, digitalbirth record verication is not specically requiredin those benchmarks. Despite this, e-verication o birth (and death) dates is already reducing raud in thehealthcare, welare, and state employment arenas, and will do so in driver’s license issuance as well. Tere is thusa strong incentive or willing states to use e-verication,rather than paper birth certicates that have no way tobe authenticated.

Unortunately, only the same three states thathad completed interstate connectivity our years ago— North Dakota, South Dakota, and Iowa — arecurrently checking both their own and other state’s vitalrecords or residents claiming out-o-state birth whenapplying or a driver’s license. Tis remains the casedespite the availability o ederal unding or establishingconnectivity between a state’s vital records database andthat same state’s motor vehicle administration, as well asinterstate data sharing. Tis also remains the case eventhough DMV users are nding use o EVVE quick and



4


easy, with queries only requiring ve to seven seconds.Te EVVE oce described its mission in an

e-mail to me as ollows:

“Te National Association or Public HealthStatistics and Inormation Systems (NAPHSIS)has developed and implemented an electronic

verication o vital events (EVVE) systemthat allows immediate conrmation o theinormation on a birth certicate presented by an applicant to a government oce anywherein the nation irrespective o the place or dateo issuance. Authorized Federal and Stateagency users via a single interace can generatean electronic query to any participating vitalrecords jurisdiction throughout the country toveriy the contents o a paper birth certicateor to request an electronic certication (in lieuo the paper birth certicate). An electronic

response rom the participating vital records jurisdiction either veries or denies the match with ocial state or jurisdiction records. It willalso fag positive responses where the personmatched is now deceased. Te EVVE systemis also capable o supporting the electronicverication and/or electronic certication o

death records.”

Some states have indicated they preer to waituntil all 50 states are on board beore establishingconnectivity, even i any replacement o digital versuspaper birth certicate checks or the 21 states onlinenow would be a signicant improvement to moststate operations. Te jurisdictions currently online are: Alabama, Arkansas, Caliornia, Connecticut, Hawaii,Iowa, Kansas, Kentucky, Minnesota, Mississippi,Missouri, Montana, New Jersey, New York City, NorthDakota, Ohio, Oklahoma, Oregon, Rhode Island, South

Kentucky: Example of Time/Cost Constraints of Records Clean-Up

• Kentuckyhadapoorelectronicdatabaseofbirthrecords.

• In2008,ittookaboutthreemonthsforthreetofourstatocleanuperrorsandphysicallypulltheoriginalcopy o the Certicate o Live Birth to determine i a keying error was made and subsequently manually update these les.

• Intheendamassivedatamigrationandcleanuptookplacetomigrateoversixmillionbirthrecordsdating

back to 1911.

• AfterarrivalofthenewdedicatedserverfromNAPHSIS,KentuckyRegistrarofVitalEventsnotedthattoget EVVE up and running took about two days.

• Experiencingaboutan85percentmatchrateindicatingthatexistingvitalrecordsmatchinbothrstandlast names, date o birth and, i applicable, date o death.*

• No-matchesareresolvedinabout30minutes.

* Rose rasatti, Project Manager , NAPHSIS EVVE Update Powerpoint, 2007,http://www.aamva.org/aamva/DocumentDisplay.aspx?id=%7B4F77C199-281E-4537-B858-BF609E8986C4%7D. In

2006, the ollowing match rates exist or states actively using EVVE:Birth Verication match rates on average (01/01/06 – 06/30/06)Iowa: 86 percent match rateMinnesota: 89 percent match rate

Missouri: 67 percent match rateNorth Dakota: 81 percent match rateSouth Dakota: 93 percent match rateDMV user response times 5 to 7 seconds on average; downtime has been minimal.



5


Dakota, and Utah. Nine more states and territoriesare in progress: Arizona, Colorado, Guam, Indiana,Massachusetts, Michigan, New York State, NorthernMariana Islands, and Pennsylvania.

Te total cost or connecting all state andterritorial vital records comes in at a low $3.8 million,unds already provided or in prior scal years and beingused now. Te total cost o digitizing and cleaning

Benchmarks for Material Compliance

1. Mandatory acial image capture and retention o such image

2. Sign declaration under penalty o perjury and retain declaration

3. Require applicant to present identity source documents that include a digital photo and a veriedgovernment-issued identity document

4. Require documentation o DOB, SSN, address o principle residence, and lawul status

5. Have a documented exceptions process in place

6. Make reasonable eorts to ensure that applicant does not have more than one DL or ID card under adierent identity

7. Veriy lawul status via SAVE, the Systematic Alien Verication o Entitlements System

8. Veriy SSN via Social Security Administration

9. Tree levels o security are required to detect alse cards (Level 1 is an “easily identiable visual or tactileeature” or cursory examination without any aids. Level 2 is a eature detected by “trained inspectors withsimple equipment.” Level 3 is a eature only detectable by orensic inspectors pursuant to 6 CFR 37.15)

10. Specied data on ace o cards

11. Mark materially compliant driver’s licenses with a DHS-approved security mark

12. Issue temporary or limited‐term licenses to all individuals with temporary lawul status and match validity

o license to end o lawul status13. Have a documented security plan in place to protect physical security o production and storage acilities,

privacy o personally identiable inormation, document and physical security eatures o the cards;employee access control; and a separate report on coordination with government and law enorcemententities

14. Require covered employees to attend American Association o Motor Vehicle Administrators (AAMVA) orequivalent raudulent document recognition training

15. Conduct name- and ngerprint-based criminal history and employment eligibility checks on all coveredemployees

16. Commit to material compliance by May 11, 2011 (two extensions have been granted so ar)

17. Clearly state on the ace o non‐compliant licenses or IDs that they are not acceptable or ocial ederalpurposes

18. Retain copies o the application, declaration, and source documents. Paper copies and microche must beretained or a minimum o seven years. Digital images must be retained or a minimum o 10 years.

For a more detailed explanation see “REAL ID Final Rules: A Summary” (March 25, 2008) by JaniceKephart, http://www.cis.org/articles/2011/ Kephart-REAL-ID-Final-Rules-Summary.pd. Tis paper wasreviewed by the Department o Homeland Security or accuracy prior to publication.



6


up e-records in all states is less than $102.5 million(probably about $75 million), estimated by the National Association or Public Health Statistics and InormationSystems (NAPHSIS) upon completion o a survey o thestates three years ago.

Te success o EVVE implementation — whichhas served to signicantly reduce raud and identity

thet traditionally plaguing state health, welare, andemployment benets and applications — can beattributed to the work o NAPHSIS, which envisionedEVVE as recently as 2005.

The 18 Benchmarks Required or Compliance Secretary Napolitano’s eort to replace REAL ID withPASS ID ailed, but delayed by nearly a year REAL IDimplementation in some states awaiting a congressionaldecision beore moving orward with implementation.Despite that delay, 11 states are already ully compliant

with all 18 o the REAL ID benchmarks: Alabama,Colorado, Delaware, Florida, Indiana, Kansas,Kentucky, Maryland, Mississippi, South Dakota, andUtah. Another eight states are within one to threebenchmarks o ull compliance: Arkansas, Connecticut,Georgia, Nebraska, Nevada, New York, North Dakota,and Wyoming.

States that are at 50 percent compliance orless are Alaska, Illinois, Massachusetts, Montana, New Jersey, Oklahoma, Rhode Island, Vermont, Virginia,and Washington. Maine and Hawaii were holdoutsagainst REAL ID implementation until recently, and

both were noted or having relatively insecure driver’slicense issuance procedures. Both had serious politicalobjections to REAL ID, especially the “legal presence”checks. Yet both states are now on board.

Maryland, which had reused REAL IDcompliance until April 2008, is now ully compliant.Examples like Maryland make clear that REALID compliance is doable, and relatively quickly.Montana, Oklahoma, and Washington prohibit REALID compliance. Illinois has only nine benchmarkscompleted, but is working toward compliance on theremaining nine benchmarks. Virginia only has vebenchmarks met, but is working towards compliance on10 others. Vermont has nine benchmarks in place andve partially completed. Montana is considered to haveone o the best issuance systems in the nation, whetherconsidered REAL ID-compliant or not. WashingtonState is eatured in more detail later in this paper.

However, even states with political troubles with REAL ID implementation, like Washington, aregetting around legal prohibitions and adjusting their

processes to eliminate the worst o their raud problemsin a manner that coincidentally makes them much closerto REAL ID compliance.

For instance, in April 2010, WashingtonState announced an expansion o its acial recognitioncapture rom the Enhanced Driver’s License proceduresto all license applicants, ullling Benchmark 1, one o

the most costly and dicult benchmarks to achieve. Washington had already ound a signicant array o identity thet using the technology, including oneindividual with 36 dierent identities. Te agency doesnot collect any more data than the typical license photoin the process, ullling REAL ID privacy requirements.Moreover, “only investigators with the Department o Licensing who have gone through extensive backgroundchecks”8 have access to the images. On November 11,2010, acial recognition was credited with stoppingidentity thieves:

“Department o Licensing spokesman ony Sermonti explained that identity thet is ‘ahugely expensive crime.’

o combat the ever-increasing crime, theDepartment o Licensing started using a newtool, close to six months ago, called acialrecognition technology. It’s designed to unmask criminals who use a drivers license photo orany sort o raudulent activity, such as usingsomeone photo under a ake name.

‘We’re trying to protect (people’s) identities,

we’re trying to protect their nances,’ Sermontisaid.”9

In addition, on November 4, 2010, Washingtoneliminated the worst o its loopholes pertaining toresidency by requiring authentication o addresses asrequired by Benchmark 4. Washington’s lax residency policies had resulted in alien smugglers shipping inbusloads o illegal aliens who would take up residency in Washington or a couple weeks, claim residency andobtain licenses, and leave again. Te problem becameexacerbated when Arizona passed its S.B. 1070. Te

new requirement to prove residency is described in Washington State’s Department o Licensing blog asollows:

“Te Department o Licensing is updating itsproo o residence policy in an eort aimedat reducing the numbers o individuals thatraudulently receive a Washington driver’slicense.



7


State law requires individuals to have avalid Washington residence address to obtain a Washington driver’s license or ID card.

Te agency will require proo o a Washington residence address i an applicantdoes not provide a veried Social Security number at a driver licensing oce. Te

documents provided will be copied and laterveried by agency sta to ensure that they arevalid. Ater that validation, a permanent license will be issued.

Te change is eective Monday, Nov. 8.Tis is another in a series o steps we’ve

taken to clamp down on license raud andensure that people are Washington residents i they’re getting a license,’ said DOL director LizLuce.”10

States like Washington make clear that even

with a law in place that prohibits REAL ID compliance,achieving the REAL ID benchmarks is benecial enoughor the state DMV to work around the legal prohibition.Benchmarks can continue to be accomplished in thismanner where state legislators or governors may beresistant, but the DMVs are capable o bureaucraticchanges that are in line with REAL ID benchmarks thatincrease customer satisaction and decrease raud.

REAL ID Compliance Costs Perhaps most remarkable about REAL ID implementation

to date, rom the states whose REAL ID expenditureshave been made public, is that the costs or complianceare coming in nowhere near the $11 billion price tagthat the NGA, NCSL, and AAMVA presented in the2006 National Impact Statement. Tis $11 billion pricetage, including $1 billion in non-recurring costs, becamea key talking point, and key complaint, about REAL IDimplementation; the rst o the impact statement’s “key ndings” was, simply, “REAL ID will cost more than$1 billion to implement.”11 Tis number now appears tohave been grossly exaggerated.

A quick look at expenditures or REAL IDimplementation shows that those in two states wereabout twice the ederal grant allocation (i.e., the statehad to cover about hal the cost, with the other hal coming rom the ederal government). Iowa’s came in at just a little less than the ederal grant monies, meaningthey did not even need all the ederal dollars providedto reach the 18 benchmarks. Delaware and Marylandound that ederal REAL ID grants covered a tad more(Delaware) or a tad less (Maryland) than the state layout.

Delaware’s total costs amounted to $3,075,00012 andMaryland’s $5,872,00013.

Florida, a large issuing state with $7,056,175in ederal grants and a relatively good driver’s licensesystem prior to REAL ID, only had to spend $945,030to become ully compliant.14 Alabama, on the otherhand, began its implementation process with only two

benchmarks in place and had to develop the remaining16. However, mostly on its own dime, the state is already compliant. It cost Alabama $15,061,141 to becomeREAL ID-compliant with only $2,209,050 o thosemonies provided by ederal REAL ID grant allocations.15

Extrapolating only Alabama’s numbers, whereby non-recurring costs are approximately seventimes ederal grant monies or each state, costs doseem to rise to the estimate o $11 billion as the 2006Impact Analysis Statement concluded. But Alabama islikely an anomaly, as is Florida (whose experience wouldsuggest the states had been over-granted or REAL ID

compliance seven times over). Florida and Alabamaappear to average out the numbers, so that between thetwo states, REAL ID implementation would come in atabout the current REAL ID grant allocations to date, orthe $176.45 million that has already been distributedto the states. (Note that these REAL ID numbers donot take into account EVVE implementation, which theederal government is paying or as well outside o theDHS REAL ID grant process.)

What seems more likely is that REAL IDimplementation costs will be akin to those in Delaware

and Maryland, about twice the current grant allocation,or about $350 million or the upront costs. However,i Iowa is an accurate indicator, costs in some states willturn out about even with ederal grants: REAL ID costIowa $2,093,000, or which it received rom the ederaltreasury $2,767,990.16

I Congress eels that splitting the costs with thestates is sucient, then the ederal government has ully unded REAL ID at this point except perhaps or sideprojects such as ullling the one driver/one license REALID requirement or which Mississippi is the lead stateand has already received grant money or developing this

project. I states successully seek ull unding, Congressis halway there, and ull REAL ID implementation is— at least rom a nancial and technical point o view— doable and in sight. Congress should be careul tolook at real cost gures rom state Departments o MotorVehicles beore making a decision.

While many states are quietly implementingREAL ID and costs are hard to nd, other states, likeCaliornia, are still claiming REAL ID is an unundedmandate. As recently as this past year, the Caliornia



8


governor’s budget analysts rejected a $4.2 million requestrom their Motor Vehicle Administrators to comply with REAL ID, claiming the law remained an unundedmandate, despite the ederal government having already allocated over $6.5 million or exactly such compliance.Caliornia analysts stated clearly that while well awarethat REAL ID implementation is doable in a relatively

short time rame, they decided to use unding issues asan excuse not to implement REAL ID. Instead, analystsignored the series o ederal grants already made availableto the states. Ironically, accepting the Caliornia MVA request would have put Caliornia, like Florida, in thecategory o having letover taxpayer dollars to send back the U.S. reasury.

Yet despite the reusal to und REALID implementation, Caliornia’s Motor Vehicle Administration on October 6, 2010, went ahead andimplemented new physical security eatures that comply with Benchmark 9 pertaining to the physical security

o the license. Under the AAMVA Security Framework, AAMVA dened — and REAL ID incorporated —levels o security as ollows:

• Level1:inspectionvisibletothehumaneyeorapparent to touch

• Level2:inspectionrequiringtheuseofatoolor instrument (e.g. magniying glass, UV light)

• Level3:inspectionrequiringhigherlevelof

inspection (e.g., microscope)

Caliornia media reported: “Te new driverslicenses will eature a raised signature, photos that areonly visible by UV light, and an image o the Caliornia

brown bear that can only been seen with a fashlightrom behind. Steve Haskins with the Department o Motor Vehicles says the changes will make it harder toorge Caliornia licenses.”17

Fraud Reduction, Law Enorcement, and

Enhanced National Security ightening procedures or identity verication anddriver’s license issuance has an additional benet orstates. Notably, REAL ID implementation is helpingstates reduce raud, enorce the law, and enhancenational security. Te Department o Homeland Security promoted this aspect o REAL ID implementation in a2010 power point presentation:

“REAL ID Improves Our Security : op 5Reasons to Adopt REAL ID

1. Deters terrorists rom using raudulentidentication to commit terrorist attacks

2. Prevents illegal immigrants rom using youridentity to violate immigration laws

3. Stops identity thieves rom assuming youridentity to commit crimes

4. Ensures aliens do not get secure licenses orlonger than their lawul stay

5. Gives employers greater condence indocuments presented by job applicants”

States that had chosen not to comply with REAL

ID and not require legal presence ound themselves,like Maryland in 2008, overwhelmed with illegal alienapplications at their DMVs. Te education, health, andhuman resources budgets were being run into the redrom illegal aliens embedding in Maryland because o lax driver’s license standards, according to senior state

California Budget Analysts Rejected a 2009-2010 Request for $4.2 million.*

Te request: “Administration Proposes to Issue Real ID Cards in 2010. Te Caliornia Governor’s budget

requests $4.2 million rom MVA (and 45 positions) specically to implement Real ID in 2009–10. Under theadministration’s plan, DMV would start issuing Real ID cards beginning in January 2010.”

Te response: “Given the change in the ederal administration, we think it makes sense to hold o on implementation o Real ID until more is known about the new administration’s position on this hugely expensive and ununded ederal mandate [emphasis added]. Finally, states are not required to begin issuing RealID compliant licenses until May 2011. Tere would still be time or the state to come into compliance with thisrequirement by the ederal deadline i the Legislature chose to reconsider this budget request next year.”

* http://www.lao.ca.gov/analysis_2009/transportation/trans_anl09004010.aspx



9


ocials, and the DMVs were overloaded with out-o-state and out-o-country requests or license applicationinterviews.

In act, Maryland, originally quite vocal inspeaking out against REAL ID implementation, decidedinstead, in 2008, with a push rom Democratic Gov.Martin O’Malley in a late-night legislative session,

to orce REAL ID compliance language through theMaryland General Assembly; the details are described inmy April 22, 2009 blog, “MD Faces Music on DriversLicenses.”18 Maryland is now 100 percent compliant lessthan a year and a hal later, and is no longer hearingcomplaints about raud and waste rom its DMV. In act,the rst day o implementation o lawul status rules sawthe cancellation o 8,000 application interviews.

New York DMV document raud investigatorshave seen a rise in identity thet and countereit arrestsas the state moves toward stricter standards or identity verication and document issuance, rom 140 arrests

in 2000 and 216 in 2001 to 826 in 2008 and 789 in2009.19 New York was an original driver o the AAMVA Security Framework that was the basis or REAL ID, andhas been instituting groundbreaking security measuresever since September 11 — without prodding rom theederal government. Tese improvements were reviewedin detail in my December 2008 piece, “An Example toFollow: New York State’s Secure Document Measures.”20

Indiana began issuing REAL ID-compliantlicenses in January 2010.21 With REAL ID identity verication requirements in place and streamlined

and more secure processes, the state has witnessed a50 percent reduction in identity thet.22 Te acialrecognition technology deployed to all Bureau o MotorVehicle (BMV) locations in November 2008 has beena signicant actor in reducing identity thet. Within amonth, all BMV locations were being serviced by acialrecognition technology, and about two cases a day werebeing fagged or raud investigation. (About two thirdso states are employing acial recognition technology today.23) One Indiana identity thie nabbed at the BMV was George Henry Helms.

“An alert customer service representative atthe Hobart license branch and the IndianaBureau o Motor Vehicles’ (BMV) new acialrecognition technology combined to nab acustomer committing an alleged identity thetcrime. When the branch employee recognizedGeorge Henry Helms rom a BMV ‘wanted’poster, authorities were notied and Helms wasdetained by Hobart police.

Te Hobart Police Department conrmedthat Helms already had an active warrant orcheck deception in Hammond. Helms has beencharged with seven counts o orgery and isbeing held in the Lake County Jail.

BMV ocials believe that Helms potentially had 10 dierent identities and was attempting

to get an 11th credential. Helms also allegedly has 15 dierent identities in Illinois.

BMV Commissioner Andy Miller said, ‘Wehave implemented a number o tools to protectthe security and integrity o the Indiana driver’slicense and ID card. In this case, our acialrecognition technology identied the suspect with multiple identities combined with thevigilance o our branch sta led to the captureo this identity thie.’

‘Our SecureID program will help addother ways to protect Indiana credentials and

ultimately reduce identity thet or Hoosiers.’”24

A “History o the Indiana BMV” page, while notmentioning REAL ID explicitly, highlights benchmarks1 (acial imaging), 3, 4, and 5 (identity verication anddocument authentication), 8 (SSN checks), and 18 and19 (controlled access and physical security o driver’slicense credentialing):

“While improving customer service, the BMV also ocused on improving security. In 2007

the BMV began to check i names and SocialSecurity numbers o individuals applyingor credentials matched with Social Security Administration records. Ater scanning thedriver BMV database, over 19,000 credentials were invalidated because customers could notveriy why their name was dierent rom therecords with the Social Security Administration.

Beginning in the all o 2008, the BMV began screening all applicants with acialrecognition technology. Te sotware scans theentire BMV database o photos to determine i

the same ace was on multiple driver’s licensesor identication cards. In 2009, the BMV investigated over 2,200 cases o potentialidentity thet, most o which were discoveredbecause o the acial recognition sotware.

In 2010, the BMV introduced the SecureIDinitiative to combat identity thet and enhancethe security o driver’s licenses and identicationcards. Te new rules required customers to meetederal standards when supplying documents to



10


Driver License Security Implementation: System Connectivity and Grant Allocation by Jurisdiction

Jurisdiction

Alabama Alaska American Samoa10 Arizona ArkansasCaliorniaColoradoConnecticutDelawareDistrict o ColumbiaFloridaGeorgiaGuamHawaiiIdahoIllinoisIndianaIowaKansasKentucky LouisianaMaineMarylandMassachusettsMichiganMinnesotaMississippiMissouriMontanaNebraskaNevadaNew HampshireNew Jersey New MexicoNew York North CarolinaNorth DakotaNorthern Mariana IslandsOhioOklahomaOregonPennsylvaniaPuerto RicoRhode IslandSouth CarolinaSouth DakotaennesseeexasUS Virgin IslandsUtahVermontVirginia

Washington West Virginia Wisconsin Wyoming

REAL IDBenchmarks Met to Date

-18 by May 11, 2011-all enrolled by 20171

18 + compliance mark 79

12 (+1 partial)17

11 (+3 partial)1817



3 (+2 partial)13 (+3 partial)9 (+ 9 partial)



9 (+4 partial)8 (+3 partial)

186 (+2 partial)

121118

13 (+2 partial)920

16 (+2 partial)17

11 (+4 partial)9

10 (+3 partial)16

12 (+2 partial)15

N/A 13820

1313139

13 (+1 partial)18 + compliance mark

1410 (+3 partial)

418 + compliance mark

9 (+5 partial)5 (+ 10 partial)

920

141417

CDLIS2 & NDR Commercial DL and Nat’l

Driver Registry (problem driver)

3

33

3

3

3

3

3

3

3

33

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

3

33

3

3

3

33

3

3

3

3

3

3

SSOLV 3 (SSN check)

3

33

3

3

3

3

3

3

3

33

3

3

3

3

3

3

3

3

3

3

311

311

3

3

3

3

3

3

3

3

3

3

3

3

311

3

33

3

3

3

33

3

3

3

3

3

3

SAVE4 (lawul presence required)

*ID expires at end o authorized stay

3*3

3*3*3*3*3

3*3*3*3*

311

3*3

3*3*3

3*3*3*3*113

3*3*3

3*3*3

3*3

3*

3

3*3*3*3*3

3*3

3*3*3*3*3*11

3*3*3*3*3*



11


EVVE5 (digitized vital records)

*DMV checks EVVE records 3

3(partial)11

3

311

3(partial)11

3

3(partial)11

33(partial)11

3*3

3

3(partial)11

3(partial)11

3

311

3

3

311

3(NYC only)

3*311

311

3

311

3(partial)11

311

3*

3

Grant AllocationFY08

($79.875 mil.)6

$500,00009

$300,000$2,721,110$891,887

$3,200,000$1,169,678$1,901,846$500,000$500,000

$3,750,92613 $2,478,043$300,000$470,000

0$2,307,808

$3,149,63715 $1,211,326$925,026

$1,003,08717 0

$1,023,911$1,138,000$1,609,635$2,495,000$694,060

$17,718,42419 $548,293

0$687,188

$2,893,60721

0$1,287,489$500,000

$2,255,748$1,799,000$500,000

0$1,200,000

0$1,169,678$2,042,800$300,000$500,000$500,000$300,000$694,060

$3,200,000$300,000

$1,006,418$500,000

$2,660,2520

$500,000$2,071,06322

$500,000

Grant AllocationFY09 Part I

($48.575 mil.)7

$1,060,774$600,000$600,000

$1,060,774$755,987

$1,648,250$755,987$755,987$600,000$600,000

$1,648,250$1,060,774$600,000$755,987$755,987

$1,648,250$1,060,774$755,987$755,987$755,987

$1,060,774$755,987$755,987

$1,060,774$1,060,774$755,987$755,987$755,987$600,000$755,987$755,987$755,987

$1,060,774$755,987

$1,648,250$1,060,774$600,000$600,000

$1,060,774$755,987$755,987

$1,060,774$600,000$600,000$755,987$600,000$755,987

$1,648,250$600,000$755,987$600,000

$1,060,774$1,060,774$755,987$755,987$600,000

Grant AllocationFY10 Part II

($48.000 mil.)

$1,098,276N/A

$651,877$1,098,276$800,677

$1,656,999$800,677$800,677$651,877$651,877

$1,656,999$1,098,276$651,877$800,677$800,677

$1,656,999$1,098,276$800,677$800,677$800,677

$1,098,276$800,677$800,677

$1,098,276$1,098,276

N/A $800,677$800,677

N/A $800,677$800,677$800,677

$1,098,276$800,677

$1,656,999$1,098,276$651,877$651,877

$1,098,276N/A

$800,677$1,098,276$651,877$651,877$800,677$651,877$800,677

$1,656,999$651,877$800,677$651,877

$1,098,276$1,098,276$800,677$800,677$651,877

otal Grant Allocation toDate ($176.45 mil.)

[total expenditure to comply with 18 benchmarks]

$2,209,050 [$15,061,141]8

$600,000$1,551,877$4,880,160$2,448,551$6,505,249$2,726,342$3,458,510

$1,751,877 [$3,075,000]12 $1,751,877

$7,056,175 [$945,030]14 $4,637,093$1,551,877$2,026,664$1,556,664$5,613,057$5,308,687

$2,767,990 [$2,093,000]16 $2,481,690$2,559,751$2,159,050$2,580,575

$2,694,664 [$5,872,000]18 $3,768,685$4,654,050$1,450,047$19,275,088$2,104,957$600,000

$2,243,852$4,450,271$1,556,664$3,446,539$2,056,664$5,560,997$3,958,050$1,751,877$1,251,877$3,359,050$755,987

$2,726,342$4,201,850$1,551,877$1,751,877$2,056,664$1,551,877$2,250,724$6,505,249$1,551,877$2,563,082$1,301,877$4,819,302$2,159,050$2,056,664

$3,627,72723 $1,751,877



12


Driver License Security Implementation: Notes

1 Data compiled by the Coalition or a Secure Driver’s License, see http://www.secure-license.org/.2 CDLIS-Commercial Driver’s License Inormation System administered by American Association o Motor Vehicle Administrators(AAMVA), alongside the National Driver Registry.3 SSOLV-Social Security On-Line Verication administered by the Social Security Administration.4 SAVE-Systematic Alien Verication or Entitlements developed by the National Association or Public Health Statistics andInormation Systems (NAPHSIS) and administered by the US Citizenship and Immigration Services Agency o DHS.5 EVVE-Electronic Verication o Vital Events administered by AAMVA.6 In FY08, DHS awarded competitive grants with priority to states seeking to be the “hub” or ID verication networking among thestates and with the ederal government. Tis used a combined pool o 2005 and 2007 unding or the Driver License Security GrantProgram created under the REAL ID law.7 In FY09 and FY10, DHS is conducted a two-part grant process per total o $100M ($50M more than the 2007 unding) allocatedunder the Consolidated Security, Disaster Assistance and Continuing Appropriations Act o 2009. Tese were noncompetitive grantsbased on licenses issued in state. Tere was a decision to orego allocation as a competitive process awarding to states or proposals“that improve state capabilities consistent with the requirements o the REAL ID rule.”8 Alabama Department o Public Saety, “Special Report on the State’s Compliance with Public Law 109-13” (July 25, 2008). Dataobtained by the Coalition or a Secure Driver’s License.9 o receive a competitive grant rom DHS in FY08, states had to submit a grant proposal stating how the unding would be used orREAL ID implementation. States that ailed to submit a proposal did not receive unding.10

Connectivity inormation was unavailable or U.S. jurisdictions Am. Samoa, Guam, N. Marinara Islands, Puerto Rico and U.S.Virgin Islands.11 New since January 2009; (partial) = in the process o implementation now.12 Jennier Cohan, Director, Delaware Division o Motor Vehicles, AMMVA Region/Annual Conerence Presentation (July 25, 2008).Obtained by Coalition or a Secure Driver’s License.13 O this amount, Florida received $1.2M to partner with the lead hub State Mississippi or pilot implementation and vericationtesting.14 Florida Department o Highway Saety and Motor Vehicles, “Fiscal Year 2009-2010 Legislative Budget Request” (Sept. 22, 2008).Data obtained by Coalition or a Secure Driver’s License.15 O this amount, Indiana received $1.2M to partner with the lead hub State Mississippi or pilot implementation and vericationtesting.16 “Iowa- An Act Relating to and Making ransportation and Other Inra-Structure-related Appropriations to the Department o ransportation” (2009): “Motor vehicles:

3 20 .................................................. $ 1,555,005

3 21 ............................................... FEs 498.00

3 22 O the total amount appropriated in this paragraph and the

3 23 total ull=time equivalent positions authorized in this

3 24 paragraph, the expenditure o $1,148,000 and the lling o 20

3 25 ull=time equivalent positions are contingent upon the need o

3 26 the department or the additional positions in order to

3 27 implement ederal requirements pursuant to the ederal REAL ID

3 28 Act o 2005 and successor legislation.”

http://search.legis.state.ia.us/NX/gateway.dll/cl/Current%20Legislation/enrolled/2009/h/h805?=templates$n=document-rameset.htm$q=[rank%3A[sum%3A[orderedprox,0%3A[stem%3Areal][stem%3Aid]]]]$x=server$3.0#LPHit1.17 In a separate grant or EVVE, Kentucky received was awarded a $3M pilot grant in Dec. 2006. Te purpose o the grant was toprepare or the nationwide deployment o electronic birth record verication.18 “Maryland Motor Vehicle Administration Capital Program Summary,” (FY09 otal Accumulated Expenditures to comply with“Te Real ID Act”).19 Mississippi received $17M as lead state or verication hub requirements and development.20 States with laws prohibiting REAL ID implementation.21 O this amount, Nevada received $1.2M to partner with the lead hub State Mississippi or pilot implementation and vericationtesting.22 O this amount, Wisconsin received$1.2M to partner with the lead hub State Mississippi or pilot implementation and vericationtesting.23 Te Wisconsin Legislature allocated $9.8 million or FY 2008 and $12.2 million or FY 2009 to assure REAL ID compliance.Legislative Reerence Bureau, “Wisconsin Bries No. 08-3 REAL ID” (March 2008).



13


receive a credential. Additionally, all credentials would be printed at the government center andmailed to customers. Tis new process alloweda more thorough verication o the driver’slicense and identication card applications.

By 2010, Indiana had approximately 5.6 million credentials and over 6.6 million

registered vehicles. Te BMV processed over 13million transactions in 2009.25

Tese changes resulted in AAMVA presentingIndiana an award or “best customer service inNorth America” on September 27, 2010. Indianahad been considered one o the worst agencies dueto long wait times, poor service, and extensive raud,according to AAMVA:

“For the second time in three years, rst timeor any state has ever achieved this, this year’s

winner o the International Customer Service Award, best BMV anywhere on the planet isthe Indiana Bureau o Motor Vehicles,” Gov.Mitch Daniels announced to a cheering crowdo employees.

Tere were cheers or lower wait times. Teaverage service transaction was down rom 12minutes 15 seconds in 2007, to about eightminutes, 10 seconds in 2010. A decline despite Indiana’s move to a more Secure ID process. [emphasis added]

Te BMV has also processed more than860,000 credentials, with new acial recognitiontechnology and survived a lawsuit over its use o Social Security numbers or verication.”26

It is not likely that Indiana would haveundertaken such positive change had it not been orthe prodding o REAL ID.

Part II: Analysis of Proposed Changes to REAL ID While implementation o REAL ID appears to besignicantly less expensive and time-consuming thanpreviously thought, the proponents o the unsuccessulattempts to repeal REAL ID and adopt PASS ID arenow quietly suggesting regulatory changes. Some o these changes require Congress to pass signicantamendments to the REAL ID law. Tese suggestionsare proposed by the authors o the same NationalImpact Statement that claimed a price tag or REAL

ID o $11 billion: the National Governors Association,the National Conerence o State Legislatures, and the American Association o Motor Vehicle Administrators.

Many o these changes incorporate languagerom the ailed 2009 PASS ID Act.27 Others hold littleto no value and are not refective o the current status o REAL ID implementation. A ew suggestions cut at the

very core o the identity verication and authenticationelements o REAL ID that are aimed at improvingnational and economic security.

In AAMVA’s publication MOVE, publishedor their 77th Annual International Conerence inSeptember 2010, a list o “Recommendations to REALID Rule” was published with the ollowing lead:

“Now that PASS ID appears to be all but dead inthe Congress, AAMVA, along with the NationalGovernors Association and the NationalConerence o State Legislatures, is considering

other options to relieve REAL ID pressure onstates. Tough REAL ID remains, AAMVA is hopeul that the Department o HomelandSecurity may consider revisiting the REAL IDFinal Rule and amending some burdensomeportions. Tough this mechanism would notalter provisions o the original statute, it couldalter some o implementation details that arethe troublesome or many states.” [Grammar aspublished]

AAMVA’s recommendations would alter someprovisions o the original statute. Te recommendationsare also contrary to AAMVA’s 2004 Security Framework, which laid the oundation or the 2005 REAL ID law. Inaddition, many o these recommendations are not basedon implementation to date. One recommendation haspotential or consideration. On the whole, however,these recommendations contribute little to the securingo driver’s license issuance. Detailed explanations arebelow.

AAMVA recommendation on REAL ID that would

signifcantly devalue REAL ID’s identity verifcationrequirements:

Remove the burden o having to provide additional documentation to prove a name change and instead rely onthe Social Security number match to identiy verications.

A core element o a secure driver’s license issuance systemis identity verication. I all anyone has to do is to rely on SSN matches, then countereiters will have an easy



14


solution or those trying to game the system. Tis methodo relying solely on an SSN has been used or years tocommit identity thet against children or the deceased.Te combination o both the legal presence database,SAVE, and the SSN database access tool, SSOLV, hasorced countereiters to steal entire identities, both thename and SSN o an American citizen, a much harder

task. Such a requirement seems minor — it applies, aterall, only to the small number o people who change theirnames — but it actually helps address the serious raudproblem identied by the 9/11 Commission and theREAL ID Act, and is proving to do so in REAL ID-compliant states.

Conclusion: Tis recommendation should be deletedas it devalues a key identity verication and documentauthentication requirement.

AAMVA recommendations based on inaccurate or

incomplete REAL ID acts:

Implementation deadlines and license enrollment cycles should be altered to accommodate the existing state cycles or issuance.

Implementation deadlines to meet minimum driver’slicense issuance standards under REAL ID are a completely dierent issue rom state license enrollment cycles. Evenso, the deadlines or REAL ID implementation havealready been pushed back twice and states that have

pushed to meet the 18 benchmarks have done so in aslittle as a year. Enrollment cycles are pushed out now to2017, so that those obtaining learner’s permits that yearmight not even have been born on 9/11. In short, ullcompliance with a 9/11 Commission recommendation will already be 16 years out rom the event that spurredpassage o the REAL ID law.

“Altered to accommodate the existing statecycles” should not be necessary considering thestaggered time rames already provided under REAL IDregulations.

Te purpose o this recommendation is to enable

the Secretary o Homeland Security to pick and choose what states receive what time rames. What shouldbe a technical requirement would automatically turnpolitical. Tis result would not be a good-governmentoutcome and opens up REAL ID implementation toabuse o power and unair treatment o the states by theederal government.

Conclusion: Tis recommendation should be deleted asit unnecessarily delays REAL ID implementation basedon misstatement o acts and also promotes poor policy.

Te rule should not go into ull eect until all the necessary ederal systems are in place. REAL ID mandates the creationo a number o verication systems, including “state-to-state

verication.” Tis suggested change would mean DHS could not hold states accountable or using these systems until they (DHS) build the systems.

In the case o Social Security number checks (SSOLV)and immigration legal status (SAVE), the systemsreerred to are already in place and used by the ederalgovernment. All states are checking SSNs and all but twoare checking legal status. Te only remaining databaserequired is connectivity to the passport database held by the State Department, which is in the works and shouldbe online by May 2011. o suggest that “DHS has to

build them” is inaccurate. Birth record systems are state systems, not

ederal systems. Currently 21 states and New York City have ully digitized vital records known as the EVVEprogram. Eight states are near completion o EVVEimplementation. Te EVVE schedule requires ullimplementation o all states and jurisdictions by May 2011, although not all states may meet that deadline.DHS does not require EVVE use until nally operationaland deployed.

It is unclear what the reerence to “state-to-state”

systems is here. State-to-state digital image vericationsystems are not required by REAL ID, but do supportREAL ID. Tus, these verication systems have neverhad to be completed prior to REAL ID implementation.

On the other hand, REAL ID does require thatstates be able to sustain a “one driver/one license” rule, which will conduct state-to-state checks o prior driver’slicenses issued to applicants. Tis recommendationthereore would accurately read “DHS should nothold states accountable or using the one driver/onelicense identication hub actively being developed by Mississippi under a $17 million ederal grant until it is

complete and DHS has deemed the hub sucient tomeet this REAL ID requirement.”

Conclusion: Tis AAMVA recommendation is overly broad and not based on current state operations. Tisrecommendation needs to be signicantly narrowed toadd value, and limited only to the one driver/one licenseverication requirement. wo suggestions: (1) Clariy what “verication systems” are being reerenced, andrequest a carve-out only or the systems necessary. In



15


this instance, carve-out ull compliance deadlines or the“one driver/one license” rule or states while providingaccountability or building and completing this system;and (2) Encourage DMVs to provide connectivity toEVVE as soon as operational within their state so that,at minimum, checks can be made on lielong residentso that state. NAPHSIS, which runs the EVVE program,

has monies available or states to obtain this connectivity.No new ederal appropriation would be required.

DHS should provide resources and unding to make SAVE work the way it should or it to be the tool it was meant tobe.

Te SAVE system already is being used in all but threestates. REAL ID is currently unding or SAVE systemenhancements.

Conclusion: Tis AAMVA recommendation is not

based on the current status o the SAVE program nor itsunding. Tis recommendation should be deleted.

Inject state fexibility in acilities security. Te new language would outline broad security principles, but not be as prescriptive as past language. Tis will allow DHS toapprove security plans on a state-by-state basis, allowing or the unique characteristics that may vary not only state tostate, but within regions o a state.

Te states already have fexibility in acilities security. In

act, states are encouraged to accommodate their ownrisks and vulnerabilities and the current guidance is justthat, guidance.

Conclusion: Tis AAMVA recommendation is not basedon the current requirements. Tis recommendationshould be deleted.

Te key AAMVA recommendation regarding REAL ID that would require congressional action:

Remove branding clauses.

“Branding” clauses reer to (1) the “gold star” axedin the upper right hand corner o the driver’s license orstate-issued ID overtly showing that the state is issuingcards that meet the 18 benchmarks set out in REALID and thus is available or “ocial purposes” to enterederal acilities and airports (this is not a REAL IDrequirement, but a regulatory one); (2) the REAL ID Act requires states to put on non-compliant license or

ID issued ater REAL ID is in eect “Not or ederalpurposes.”

Deleting the “Ocial Purposes” or “Not orFederal Purposes” requirement — which requires aREAL ID-compliant document to board a commercialaircrat or enter a ederal building and or other “ocialpurposes” — negates the whole ederal purpose behind

the REAL ID Act. It makes any license, once again,sucient to access secure acilities and airports. It ails todistinguish between REAL ID-compliant state licenses,and those licenses or IDs provided by states but only on provisional bases. Without overt indicators o REALID compliance, an underlying purpose o the law — toassure a baseline o identity verication or state-issuedIDs — would be negated. No ocer in a secure buildingor SA screener at an airport could distinguish a REALID-compliant license rom a non-compliant one.

Conclusion: Tis AAMVA recommendation negates the

underlying aviation and ederal acility security aspect o the law. Tis recommendation should be deleted.

Recommendations DHS needs to be empowered to address the ever-changing dynamic o raud by not allowing REAL IDto stagnate in the current rules, but rather asserting aset o best practices that addresses changes and updatesto raudulent activity. Tese need not be requirementso REAL ID, but rather a dynamic set o best practicesentered into with the state DMVs based on the trendsthey are seeing, enabled by the rules. One prescriptionremains inevitable: as REAL ID security measures widen,driver’s licenses will be harder to obtain or those seekingto change or steal identities or criminal, terrorist, orillegal immigration purposes. As this happens, the natureo identity thet will change rom stealing just identity inormation such as SSNs, to stealing entire identities,since only completely lited identities will make itthrough REAL ID identity verication and documentauthentication procedures.

Tat being said, identity thet needs to be

addressed head-on with robust measures to supportprosecutions, levy penalties, and prevent victimization.Prosecutions and penalties can be addressed by a smallchanges to the ederal criminal statutes pertainingto identity thet as laid out in detail in my January 2010 Backgrounder, “Fixing Flores: Assuring AdequatePenalties or Identity Tet and Fraud”28 and alsoproposed by Sen. Orrin Hatch in his September 2010bill, likely to be re-introduced in the 112th Congress,



16


“S.3901 - Strengthening Our Commitment to LegalImmigration and America’s Security Act.”29

More powerul means or individuals to protectthemselves rom identity thet are also needed. Oneexample would be to allow victims o identity thet to“lock” their personal inormation so that it cannot berecycled or a second driver’s license by someone else.

Since DMVs are already set up to check photos anddates o birth — which will be simpler and quickeras e-verication becomes standardized — it would berelatively easy to veriy, and process, a request that thesame identity be “unlocked.”

Tus, i John Doe locks his name and SSN while living in Alabama (it will not matter i he was bornin Alabama or not), but later moves rom Alabama toennessee, a quick look at a digital acial image and dateo birth will assure the ennessee DMV that Doe hasauthority to unlock his identity. Alabama’s license canbe canceled and ennessee can quickly and eciently

issue Doe a new license. State DMVs, or perhaps a morecentralized state institution responsible or vital records,could maintain a voluntary, central list o “locked”names and SSNs that the DMV would check beoreissuing the license or upon issuing an initial license(when date o birth would be checked as well), as justanother automatic query during identity verication.Other uses or the “locked” SSN, name, digital image,and date o birth rom an issued driver’s license couldinclude identity raud prevention under E-Veriy orin the health care arena, i the owner o the identity

is willing to provide access to locked data to potentialemployers or health care institutions.Tis is a possible alternative to setting up a

separate database or assuring only one license per driveracross the United States, although it is understood thatthe driver saety goals o making sure only sae drivers areon the road — not suspended or convicted drivers — isnot necessarily ullled under this rubric. As Mississippicontinues its work to dene and test its identicationhub in conjunction with stakeholders, assuring that ishas a similar identity “lock” asset — even i such an assetis secondary to its intended purpose — would be both

helpul and ecient.Underlying the identity thet protections

outlined above are other, equally importantrecommendations, such as:

1. Provide a nancial incentive or states reaching early compliance or going beyond REAL ID security requirements. For states that ail to meet compliancedeadlines, rather than their ederal grant monies beingreturned to the reasury, as has been the case to date,it would be better to turn those monies back aroundto help backll the coers o other states where REAL

ID monies were insucient to gain ull compliance.

2. Require all states to obtain and use connectivity to digitized vital records via EVVE as well asinterstate connectivity that incorporate vital recordschecks into the initial identity verication check.

3. Authorize DHS to organize and require statesto do in-state (at least 37 states are using acialrecognition technology under the InternationalCivil Aviation Organization passport photorequirements to drastically reduce raud)30 and

interstate state digital photo comparisons toidentiy drivers who have multiple licenses inseveral states under dierent identities. Te digitalphoto match, along with a name/SSN/DOB lock,could be a more eective way to enorce the onedriver/one license requirement o REAL ID.

4. Require states to report compromised security eatures to DHS in order that the DHS Secretary, inconjunction with a working group o state DMVs,can make recommendations to states to alter

practices to stay in ront o raudulent compromisesto secure IDs.

Conclusion States are nding that implementation o the 2005 REALID Act is much easier and less expensive than previously thought, and is a signicant actor in reducing raud. Incases like Indiana, REAL ID has signicantly improvedcustomer satisaction, resulting in that state receiving AAMVA’s “customer satisaction” award o the year.Tis is not just a win-win or national and economic

security, but a win (less expensive) -win (doable) -win(raud reduction) -win (improved customer satisaction)or ederal and state governments as well as individuals.Moreover, 11 states are already in ull compliance, wellahead o the May 2011 deadline or the 18 benchmarks. Another eight are close behind. Some states, like



17


Delaware and Maryland, have achieved REAL IDcompliance within a year. Washington State reusesREAL ID compliance, but has already implemented themost dicult benchmarks.

Perhaps most astonishing is that rom the costnumbers currently available, it looks like implementationo the 18 REAL ID benchmarks in all the states may end

up costing somewhere between $350 million and $750million, signicantly less than the $1 billion projectedby those still seeking to change the law.

Legal presence is being checked in all but twostates, up 28 states rom 2006. Only Washington andNew Mexico still do not require legal presence to obtaina license, but Washington so signicantly upgraded itslicense issuance in 2010 that the raudulent attempts togarner licenses in that state are now signicantly reduced.Every state is now checking Social Security numbers.

Four years ago, only three states had digitizedand created connectivity to access vital records in

other states. o date, vital records digitization has beencompleted in 21 states. Shortly, another seven will bein place. Unortunately, only the same three states thathad completed interstate connectivity our years ago arecurrently checking both their own and other states’ vitalrecords or residents claiming out-o-state birth whenapplying or a driver’s license. Tis remains the casedespite the availability o ederal unding or establishingconnectivity between a state’s vital records database andthat same state’s motor vehicle administration, as well asor interstate data sharing. E-verication o vital records,

and connectivity amongst the states, could be one o the

most important steps to reduce raud. With all statesdue to have completed vital records digitization by early 2011, they should jump on board to obtain ully ederally unded connectivity between e-vital records and DMVsor identity verication checks as soon as possible.

Unsurprisingly, the more robust theimplementation o the law, the more streamlined and

less raud-ridden the ID system is, saving money andtime, and reducing crime. Te hypothetical supportor REAL ID is becoming a reality, and vicious — and what are now baseless — attacks on REAL ID shouldbe ading. I the National Governors Association, theNational Conerence o State Legislatures, and the Association o American Motor Vehicle Administratorshad the best interests o their constituents in mind, they would be doing what they can to support bold states— like Indiana, Maryland, and others — and work with those struggling towards compliance and actively preventing identity thet. No changes are needed in

REAL ID regulations, except perhaps a realignment o the one driver/one license rule which perhaps can beachieved by creating an interactive identity “lock” rubricbetween name, SSN, digital photo and date o birth.However this assumes that identication hub beingdeveloped under REAL ID by Mississippi can not meetthat mandate; ar rom a air assumption at this point.

At this point, all that needs to happen is orthe work to go on and maintain fexibility with anti-raud measures. It is hard not to conclude that this9/11 Commission recommendation is proving more

benecial than anyone imagined.



18


End Notes 1 http://www.dhs.gov/les/programs/gc_1200062053842.shtm.

2 See Janice Kephart, “Repealing REAL ID? Rolling Back Driver’s License Security,” Center for Immigration Studies,

July 2009, http://www.cis.org/realid.

3 See Janice Kephart, “Identity Document Security: Moving

Beyond the 9/11 Staff Report on Identity DocumentSecurity,” January 2006, for the terrorist and criminal

backdrop to driver’s license fraud, http://www.cis.org/articles/2011/ IDSecurityStateWhitePaper0407.pdf.

4 The Security Framework and related 9/11 Commissionrecommendations are reviewed in detail by Janice Kephart,“The Appearance of Security: REAL ID Final Regulations

vs. PASS ID Act of 2009,” Center for ImmigrationStudies, April 2009, http://www.cis.org/PASSID. For a

detailed history of the AAMVA Security Framework, see

Janice Kephart, “Identity and Security: REAL ID and the

States,” April 2007, http://www.cis.org/articles/2011/IDSecurityStateWhitePaper0407.pdf.

5 See Janice Kephart, “REAL ID Final Rules: a Summary,”March 2008, http://www.cis.org/articles/2011/REAL-ID-

White-Paper-FINALv2.pdf.

6 Arizona IndyMedia, “Illegal immigrants ocking to 3states to obtain identication: Washington, New Mexico

and Utah don’t require citizenship proof for a driver’slicense,” August 14, 2010, http://arizona.indymedia.org/

news/2010/08/77697.php.

7 http://publicsafety.utah.gov/dld/.

8 Tony Semonti, DL Blog, “New license design, facialrecognition to play latest role in stemming ID theft,”

April 27, 2010, http://licensingexpress.wordpress.com/2010/04/27/new-license-design-facial-recognition-to-

play-latest-role-in-stemming-id-theft/.

9 Chelsea Kopta KEPR-TV, Pasco, Washington, “DOL’s

Technology Thwarting ID Thieves,” November 11, 2010,http://www.keprtv.com/news/tech/107395203.html .

10 DL Blog, “Policy change for rst time driver’s licenseapplicants will reduce fraud,” November 4, 2010, http://licensingexpress.wordpress.com/2010/11/04/policy-change-

for-rst-time-driver-license-applicants-will-reduce-fraud/.

11 “The Real ID Act: National Impact Analysis,” National

Governors Association, National Conference of StateLegislatures, American Association of Motor Vehicle

Administrators, September 2006, http://www.nga.org/Files/pdf/0609REALID.pdf .

12 Jennifer Cohan, Director Delaware Division of Motor Vehicles, AAMVA Region Annual Conference Presentation,

July 25, 2008.

13 “Maryland Motor Vehicle Administration Capital Program

Summary,” FY09 Total Accumulated Expenditures to

comply with “The Real ID Act.”

14 Florida Department of Highway Safety and Motor

Vehicles, “Fiscal Year 2009-2010 Legislative BudgetRequest,” September 22, 2008, http://www.hsmv.gov/

agenda/2008/093008Agenda.pdf .

15 Department of Public Safety, State of Alabama, “Special

Report on the State’s Compliance with Public Law 109-13(the “REAL ID Act of 2005”),” July 25, 2008.

16 “Iowa - An Act Relating to and Making Transportationand Other Infra-Structure-related Appropriations to theDepartment of Transportation,” 2009.

17 KXJZ 90.9 Sacramento, “California Licenses Get aMakeover,” October 6, 2010, http://www.capradio.org/

articles/2010/10/06/california-licenses-get-a-makeover.

18 http://www.cis.org/Kephart/MDHouseBill387-

REALID.

19 New York Department of Fraud Investigation Arrests by

Year, 2010 Presentation, New York DMV, July 2010; dataobtained by the Coalition for a Secure Driver’s License.

20 http://cis.org/kephart/NYSecureDocuments.

21 Press release, “Governor eases compliance for secure

driver’s licenses, identication cards,” August 12, 2009,http://www.in.gov/portal/news_events/41390.htm.

22 Devon Scott, WIBC 93.1 FM, “BMV Pleased with New Driver’s License Process,” July 12, 2010, http://www.wibc.

com/news/Story.aspx?id=1251608.

23 Jim McKay, Government Technology , “Facial Recognition

Helps Indiana Secure Drivers’ Licenses,” pp. 30-31, April

2009, http://www.govtech.com/gt/627236.24 BMV press release, “Identity Theft Suspect

Apprehended,” August 5, 2009, http://www.in.gov/portal/

news_events/41787.htm.

25 https://myweb.in.gov/BMV/mybmvportal/

InformationFor/InformationForMedia/HistoryoftheIndianaBMV.aspx .

26 Sandra Chapman, Channel 13 Eyewitness News, “IndianaBMV gets top honors,” September 27, 2010, http://www.

wthr.com/story/13225281/indiana-bmv-gets-top-honors.

27 See “Repealing REAL ID? Rolling Back Driver’s License

Security,” op.cit.28 http://www.cis.org/Flores-Figueroa .

29 Bill introduced Sept. 29, 2010. Seehttp://www.govtrack.us/congress/bill.xpd?bill=s111-3901. See Janice Kephart,

“Senator Hatch Drops a Helpful and Thoughtful BorderSecurity Bill” (Oct. 3, 2010) at http://www.cis.org/kephart/hatch-bill .

30 Notary Bulletin, “Facial Technology Is A Powerful Tool Against Identity Theft,” September 8, 2009, http://www.

nationalnotary.org/bulletin/newsNotary.cfm?newsid=2171.



19





B a c k g

r o u n d e r

Center for Immigration Studies 1522 K Street, NW, Suite 820 Washington, DC 20005-1202 (202) 466-8185 [email protected] www.cis.org

NON-PROU.S. POSTA

PAID PERMIT # 6

WASHINGTO

R E A L I D

I m p

l e m e n t a t i o n

s s E x p e n s i v e ,

D o a b l e , a n d H e l p f u l i n

R e d u c i n g F r a u d

B y J a n i c e

K e p h a r t

h e i m p l e m e n t a t i o n o l a w s p r o v

i d i n g o r m i n i m u m s e c u r i t y s t a n d a r d

s

o r d r i v e r ’ s l i c e n s e i s s u a n c e i s l i v i n g u p t o t h e c l a i m s o i t s s u p p o r t e r s ,

p r i m a r i l y t h e D e p a r t m e n t o

H o m e l a n d S e c u r i t y ( D H S ) , w h i c

h

t h a t d r i v e r ’ s l i c e n s e s e c u r i t y i s

a n i m p o r t a n t s t e p t o w a r d n a t i o n a l

y a n d r e d u c e d r a u d a t t h e s t a t e l e v e l . E q u a l l y i m p o r t a n t , t h i s s a m

e

R E A L I D l a w d e s c r i b e d a b o v e , b a s e d o n r e c o m m e n d a t i o n s o t h e 9 / 1

1

m i s s i o n , i s p r o v i n g t o b e e a s i e r t o i m p l e m e n t a n d l e s s e x p e n s i v e t h a n

h a v e a l l e g e d o r y e a r s . I n a c t , 1 1 s t a t e s h a v e a l r e a d y u l f l l e d t h e f r s t

o R E A L I D c o m p l i a n c e —

m e a

n i n g t h e y h a v e u l f l l e d a l l 1 8 R E A L

u r i t y b e n c h m a r k s — a h e a d o t h e M a y 2 0 1 1 d e a d l i n e . T e n e x t s t a g e ,

c e m b e r 2 0 1 4 , r e q u i r e s a l l t h o s e w

h o h a v e r e a c h e d t h e a g e o 5 0 b y t h a t

o b e i s s u e d a l i c e n s e t h a t c o m p l i e s w i t h t h e 1 8 b e n c h m a r k s . T e f n a l

e q u i r e s a l l e l i g i b l e i n d i v i d u a l s t o b e e n r o l l e d w i t h R E A L I D - c o m p l i a n

t

s b y D e c e m b e r 2 0 1 7 .

C e n t e r f o r I m m i g r a t i o n S t u d i e s

1 5 2 2 K S t r e e t , N W , S

u i t e 8 2 0

W a s h i n g t o n , D C 2 0 0 0 5 - 1 2 0 2

( 2 0 2 ) 4 6 6 - 8

1 8 5 •

( 2 0 2 ) 4 6 6 - 8

0 7 6

c e n t e r @ c i s . o r g

• w w w . c i s .

o r g

u p p o r t t h e C e n t e r t h r o u g h t h e C o m b i n e d F e d e r a l C a m -