Electronic Privacy Information Center  

National ID Cards and REAL ID Act

History | REAL ID Act | News Items | Resources | Reports | State Legislation Rejecting REAL ID | Previous Top News

EPIC Report: "REAL ID Implementation Review: Few Benefits, Staggering Costs" (May 2008)

EPIC Press Release: "Homeland Security Department Announces
Deeply Flawed Regulations For National ID System" (January 11, 2008)

EPIC Comments on REAL ID Draft Regulations (May 8, 2007)

CAMPAIGN



Stop REAL ID: Reject National Identification

Latest News/Events

History of National Identification Cards

National ID cards have long been advocated as a means to enhance national security, unmask potential terrorists, and guard against illegal immigrants. They are in use in many countries around the world including most European countries, Hong Kong, Malaysia, Singapore and Thailand. Currently, the United States and the United Kingdom have continued to debate the merits of adopting national ID cards. The types of card, their functions, and privacy safeguards vary widely.

Americans have rejected the idea of a national ID card. When the Social Security Number (SSN) was created in 1936, it was meant to be used only as an account number associated with the administration of the Social Security system. Though use of the SSN has expanded considerably, it is not a universal identifier and efforts to make it one have been consistently rejected. In 1971, the Social Security Administration task force on the SSN rejected the extension of the Social Security Number to the status of an ID card. In 1973, the Health, Education and Welfare Secretary's Advisory Committee on Automated Personal Data Systems concluded that a national identifier was not desirable. In 1976, the Federal Advisory Committee on False Identification rejected the idea of an identifier.

In 1977, the Carter Administration reiterated that the SSN was not to become an identifier, and in 1981 the Reagan Administration stated that it was "explicitly opposed" to the creation of a national ID card. The Clinton administration advocated a "Health Security Card" in 1993 and assured the public that the card, issued to every American, would have "full protection for privacy and confidentiality." Still, the idea was rejected and the health security card was never created. In 1999 Congress repealed a controversial provision in the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 which gave authorization to include Social Security Numbers on driver's licenses.

In response to the tragic events of Sept. 11, 2001, there has been renewed interest in the creation of national ID cards. Soon after the attacks, Larry Ellison, head of California-based software company Oracle Corporation, called for the development of a national identification system and offered to donate the technology to make this possible. He proposed ID cards with embedded digitized thumbprints and photographs of all legal residents in the U.S. There was much public debate about the issue, and Congressional hearings were held. Former House Speaker Newt Gingrich testified that he "would not institute a national ID card because you do get into civil liberties issues." When it created the Department of Homeland Security, Congress made clear in the enabling legislation that the agency could not create a national ID system. In September 2004, then-DHS Secretary Tom Ridge reiterated, "[t]he legislation that created the Department of Homeland Security was very specific on the question of a national ID card. They said there will be no national ID card."

The public continues to debate the issue, and there have been many other proposals for the creation of a national identification system, some through the standardization of state driver's licenses. The debate remains in the international spotlight -- several nations are considering implementing such systems. The U.S. Congress has passed the REAL ID Act of 2005, which mandates federal requirements for driver's licenses. Critics argue that it would make driver's licenses into de facto national IDs. EPIC and others have called for the repeal of this ill-conceived national identification law.

The REAL ID Act of 2005

History

The REAL ID Act of 2005 creates a de facto national identification card. Ostensibly voluntary, it would become mandatory as those without the card would face suspicion and increased scrutiny. It is a law imposing federal technological standards and verification procedures on state driver's licenses and identification cards, many of which are beyond the current capacity of the federal government, and mandating state compliance by May 2008. In fact, REAL ID turns state DMV workers into federal immigration officials, as they must verify the citizenship status of all those who want a REAL ID-approved state driver's license or identification cards. State DMVs would far move away from their core mission -- to license drivers.

REAL ID was appended to a bill providing tsunami relief and military appropriations, and passed with little debate and no hearings. The REAL ID Act repealed provisions in the Intelligence Reform and Terrorism Prevention Act of 2004, which contained "carefully crafted language -- bipartisan language -- to establish standards for States issuing driver's licenses," according to Sen. Richard Durbin. After more than two years, the Department of Homeland Security issued draft regulations for state compliance on March 1, 2007.

The National Conference of State Legislatures estimates (pdf) that the cost to the states will be more than $11 billion over five years. This is more than 100 times the $100 million cost that Congress initially estimated. For 2006, $40 million was allocated for start-up costs. It is likely that the cost will be shouldered by the public. The Department of Homeland Security originally estimated that REAL ID will cost $23.1 billion over 10 years. But, when the agency released the final rule in January 2008, it made dubious assumptions and claimed that the national ID system would only cost $9.9 billion.

EPIC and 24 experts in privacy and technology submitted detailed comments (pdf) in May 2007 on the draft regulations explaining the many privacy and security threats raised by the REAL ID Act. The fundamentally flawed national identification system is unworkable and the REAL ID Act must be repealed. In particular, the group admonishes DHS for its failure to include adequate privacy and security safeguards for this massive national identification database. DHS's own Data Privacy and Integrity Advisory Committee has refused (pdf) to endorse the agency's plan. "The Committee feels it is important that the following comments do not constitute an endorsement of REAL ID or the regulations as workable or appropriate."

DHS's Final Rule to Implement REAL ID

Department of Homeland Security Secretary Michael Chertoff released the agency's final regulations for REAL ID on January 11, 2008. The
Secretary scaled back some of the requirements, reduced the cost, and extended the deadline for state compliance. However, Secretary Chertoff also indicated that the REAL ID card would be used for a wide variety of purposes, unrelated to the law that authorized the system, including employment verification and immigration determination. He also indicated that the agency would not prevent the use of the card by private parties for non-government purposes. As part of the cost-saving effort, Homeland Security has decided not to encrypt the data that will be stored on the card.

In an opinion column written by Secretary Chertoff after the publication of the final rule, he said, "embracing REAL ID" would mean it would be used to "cash a check, hire a baby sitter, board a plane or engage in countless other activities." This is a description of a national identification system, which is illegal in the United States. When it created the Department of Homeland Security, Congress made clear in the enabling legislation that the agency could not create a national ID system. In September 2004, then-DHS Secretary Tom Ridge reiterated, "[t]he legislation that created the Department of Homeland Security was very specific on the question of a national ID card. They said there will be no national ID card."

EPIC Analysis of Final Rule to Implement REAL ID

In a detailed analysis (pdf) of the final rule, EPIC explained that the Department of Homeland Security's REAL ID system includes few protections for individual privacy and security in its massive national identification database. It harms national security by creating yet another "trusted" credential for criminals to exploit. The Department of Homeland Security has faced so many obstacles with the REAL ID system that the agency now plans an implementation deadline of 2017 -- nine years later than the 2008 statutory deadline. It is an unfunded mandate that would cost billions, with the burden ultimately being placed on the individual taxpayer.

Technical experts familiar with the challenges of privacy protection and identification presented the Department of Homeland Security with a variety of recommendations that would have minimized the risks of the REAL ID system. The DHS made some modifications, but left the essential system in place. As REAL ID currently stands, the costs are many and the benefits are few. EPIC also detailed the State rebellion against REAL ID.

EPIC urged the alternative model of a system of decentralized identification. This reduces the risks associated with security breaches and the misuse of personal information. Technological innovation can enable the development of context-dependent identifiers. A decentralized approach to identification is consistent with our commonsense understanding of identification. If you are banking, you should have a bank account number. If go to the library, you should have a library card number. If you rent videos from a store, you should have a video rental store card number. Utility bills, telephone bills, insurance, the list goes on. These context-dependent usernames and passwords enable authentication without the risk of a universal identification system. That way, if one number is compromised, all of the numbers are not spoiled and identity thieves cannot access all of your accounts. All of your accounts can become compartmentalized, enhancing their security. View the full report: Marc Rotenberg & Melissa Ngo, EPIC, REAL ID Implementation Review: Few Benefits, Staggering Costs (pdf) (May 2008).

News Items

Resources