The Real ID Act: Real Problems

by William S. Statler, last revised 2005-05-20 (see changelog at bottom)

ARCHIVED:
This article is years out-of-date, and will not be updated.

What is the "Real ID Act of 2005"?

You can find the text of the Real ID Act in H.R.1268.ENR, which you can download here (255 KB PDF file):

http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=109_cong_bills&docid=f:h1268enr.txt.pdf

(The Real ID Act is "Division B" of this bill, pages 72 - 93 of the PDF file.)

The name "Real ID" comes from a part of the bill which establishes new Federal standards for State-issued drivers' licenses and identification cards. Other sections make changes in immigration law, and attempt to improve border security.

It was signed into law by President Bush on May 11, 2005, and is now part of Public Law 109-13. The new standards for State drivers' licenses and IDs must be implemented by the States over the next three years, because after May 11, 2008...

"...a Federal agency may not accept, for any official purpose, a driver's license or identification card issued by a State to any person unless the State is meeting the requirements of this section."

This means you will need a Federally-approved ID, not just for interacting with the Federal government (e.g., entering a Federal building), but for any situation where the Federal government demands you show an ID card (e.g., boarding an airplane),

"...and any other purposes that the Secretary [of Homeland Security] shall determine."

The new law also revises the rules for the admission and deportation of aliens, in particular asylum-seekers. And it overrides any laws standing in the way of completing new border fences, raising some troubling Constitutional issues.

There are many serious problems with the Real ID Act of 2005 -- problems caused by the haste and inadequate debate with which it was passed by the House and the Senate, and problems caused by a myopic focus on "security" without attention to either the minimal benefits or the major collateral damage from the proposed fix.

Data that must be included on the license or ID card

New requirements:

The Real ID Act requires that all State drivers' licenses and ID's contain at least the following data, in order to be Federally-approved:

In addition, there must be:

"Physical security features designed to prevent tampering, counterfeiting, or duplication of the document for fraudulent purposes"

and:

"A common machine-readable technology, with defined minimum data elements"

...the details of which are not spelled out, but left to the Secretary of Homeland Security (in consultation with the Secretary of Transportation and the States) to regulate.

[Strictly speaking, these requirements are not new. They replace nearly identical language in Section 7212 of the Intelligence Reform and Terrorism Prevention Act of 2004 (Public Law 108-458), which had not yet gone into effect before being repealed by the Real ID Act.]

Problems:

Privacy advocates have expressed concern about the "common machine-readable technology", which could make it easy for government agencies and private companies alike to collect ID data and establish their own huge databases. It would be particularly alarming if Homeland Security chooses an RFID (radio frequency identification) device for this purpose, since these can be read from a short distance while still in your purse or pocket.

Also of concern are the undefined "defined minimum data elements" in the machine-readable data. Will Homeland Security require additional data besides what's displayed on the front of the card? Will they, for example, demand a digitized thumbprint as an anti-fraud device?

And there is a no-exceptions requirement for your home address, displayed on the card. For some people, such as judges, police officers, or victims of domestic violence, the privacy of their home address is an important matter of personal safety for themselves and their families.

Documentation required before issuing a license or ID card

New requirements:

The Real ID Act requires that you provide all of the following documentation:

The State must verify all of the above documents with the issuing agency before you can receive your license or ID card. The only foreign document that may be accepted for any of the above items is an official passport.

[Again, these requirements aren't entirely new. The now-repealed Section 7212 of PL 108-458 contained similar language. But it also said that the Federal rules could not infringe on the "State's power to set criteria concerning what categories of individuals are eligible" for a driver's license or ID card, nor could they require a State to do anything that "conflicts with or otherwise interferes with the full enforcement of State criteria" for eligibility. This would presumably have allowed States to issue licenses to undocumented aliens, people without Social Security Numbers, etc.]

The Real ID Act does allow States to issue second-tier licenses and IDs to people who can't meet the new documentation requirements. These must have a unique design and a clear statement that they cannot be accepted for any Federal identification purpose.

Problems:

Clearly, these requirements will prohibit States from issuing Federally-approved licenses and ID cards to illegal or undocumented aliens. Whether this will lead to a surge of unlicensed, uninsured illegal alien drivers on our roads is unknown. In States that allow it, they will be able to apply for the second-tier "Not For Federal ID Purposes" license. But how many immigrants will do so, knowing that it will appear to be an admission of illegal status?

Even legal aliens may find it difficult to meet these documentation requirements. Note that passports are the only foreign documentation that can be accepted. Foreign birth certificates or drivers' licenses are worthless.

Those who are homeless by choice or by necessity may also face difficulty. The retired couple who live in their RV full-time, whose only address is "General Delivery" in whatever town they're currently camped near -- how will they document their "address of principal residence"?

There is also no provision for folks who are eligible for a Social Security Number, but don't have one, for religious or other reasons.

Each item of documentation must be verified with the agency that issued it. So the issuance of your license or ID could be delayed or prevented by a tardy clerk on the other side of the country or the other side of the planet.

In addition, there is a Constitutional issue: the Supreme Court has previously ruled that the Federal government may not "commandeer" a State regulatory process in order to implement a Federal regulatory program. (It's not clear whether this decision applies here, since the Real ID Act only prescribes what the States must do to meet Federal standards -- it doesn't literally order them to do it.)

These requirements move the driver's license further and further from its original purpose: simply an official certification that a person is competent to drive.

Linking of license and ID card databases

New requirements:

In order for a State's licenses and IDs to comply with Federal standards, the State must agree to share its motor vehicle database with all other States. This database must include, at a minimum, all the data printed on the State drivers' licenses and ID cards, plus drivers' histories (including motor vehicle violations, suspensions, and points on licenses).

Problems:

In fact, much of this data is shared already. But the new law standardizes the data-sharing and makes it effectively mandatory. The universal scope of the resulting database has raised alarm among those who value privacy.

A big, convenient database of nearly everyone in the country over age 16 means a big invitation to abuse it. The Real ID Act contains nothing to regulate who may have access to this database, or for what purpose. In light of the current furor over identity theft, and recent cases of unauthorized access to data from ChoicePoint and other corporations, the hazards of a huge and insecure government database should be obvious.

Waiving laws to install border barriers

This issue is legally convoluted. I'm discussing it in some detail because much coverage by the press and the Internet community has been incomplete or simply wrong. Bear with me.

Situation prior to the Real ID Act:

Section 102 of Public Law 104-208 (which is now part of 8 USC 1103) provides for improvements to physical barriers at the borders of the United States. Subsection (a) reads as follows:

"The Attorney General, in consultation with the Commissioner of Immigration and Naturalization, shall take such actions as may be necessary to install additional physical barriers and roads (including the removal of obstacles to detection of illegal entrants) in the vicinity of the United States border to deter illegal crossings in areas of high illegal entry into the United States."

(Note: It appears this responsibility still lies with the Attorney General; I have been unable to find any more-recent amendment which explicitly transferrs it to the Secretary of Homeland Security.)

Subsection (b) orders the Attorney General to commence work on specified improvements to a 14-mile section of the existing border fence near San Diego, and allocates funds for the project.

Subsection (c) provides for waivers of laws that interfere with the work described in subsections (a) and (b). Here is how subsection (c) used to read, before the Real ID Act:

"The provisions of the Endangered Species Act of 1973 [16 U.S.C. 1531 et seq.] and the National Environmental Policy Act of 1969 [42 U.S.C. 4321 et seq.] are waived to the extent the Attorney General determines necessary to ensure expeditious construction of the barriers and roads under this section [amending this section]."

Despite the ESA and NEPA waivers, construction of the San Diego border fence has still been bogged down in legal challenges.

New requirements:

Section 102 of the Real ID Act (which takes effect immediately) amends the language of subsection (c) to make the following changes:

Note that this applies to barriers anywhere on the US border, not just at San Diego.

In an earlier version of this bill, these law-waivers were not to be subject to any judicial review or appeal at all. Luckily, somewhat more moderate brains prevailed, and now the text reads as follows:

"The district courts of the United States shall have exclusive jurisdiction to hear all causes or claims arising from any action undertaken, or any decision made, by the Secretary of Homeland Security pursuant to paragraph (1). A cause of action or claim may only be brought alleging a violation of the Constitution of the United States. The court shall not have jurisdiction to hear any claim not specified in this subparagraph."

Claims are barred unless filed within 60 days, and cases may be appealed "only upon petition for a writ of certiorari to the Supreme Court".

Problems:

Congress has written a law prohibiting the Federal courts from hearing any claim on this issue, except for allegations that the Secretary of Homeland Security is violating the Constitution. And claims anywhere other than Federal District Courts are banned entirely. Can Congress do this?

The Constitution itself should answer that question, but its wording is confusing. Article III, Section 2 (as modified by the 11th Amendment) defines the powers of the Federal courts, listing the types of cases to which their judicial powers extend. It then distinguishes between cases where the Supreme Court has original jurisdiction or appellate jurisdiction, in these words:

"In all Cases affecting Ambassadors, other public Ministers and Consuls, and those in which a State shall be a Party, the supreme Court shall have original Jurisdiction. In all the other Cases before mentioned, the supreme Court shall have appellate Jurisdiction, both as to Law and Fact, with such Exceptions, and under such Regulations as the Congress shall make."

What sort of "exceptions" and "regulations" are allowed here? A strict reading would say that this clause only concerns original vs appellate jurisdiction, and Congress may regulate the appeals process, and may allow some cases to bypass appeals and be heard initially by the Supreme Court.

A more extreme interpretation is that Congress can make any "exceptions" and "regulations" that it wants, even declaring the Federal courts to have no authority whatsoever in particular cases. This is what Congress appears to have done in the Real ID Act. And although they have done it in a limited fashion, the precedent is alarming.

As regards the San Diego fence, it's not clear what the authors of the bill were thinking. Since the current dispute is between California and the Federal government, and since the Constitution clearly does not allow for any "exceptions" and "regulations" for cases involving a State, this attempt to waive California's environmental laws seems clearly to be unconstitutional.

There's another Constitutional issue as well: in authorizing the Secretary of Homeland Security to waive laws, Congress is delegating some of its law-making power (or law-unmaking power) to the Executive Branch. This may violate Constitutional separation of powers, and at the least is an unfortunate step towards government-by-decree.

Other provisions of the Real ID Act

The items discussed above comprise less than a quarter of the text of the Real ID Act. The rest of the legislation updates the laws on application for asylum and deportation of aliens for terrorist activity, introduces complex rules covering "delivery bonds" (rather like bail bonds, but for aliens that have been released pending hearings), funds some reports and pilot projects related to border security, and changes visa limits for temporary workers, nurses, and Australians.

Analysis of these parts of the legislation is beyond the scope of this article. But they are not without flaws. For example, asylum-seekers, under some circumstances, may be required to provide "corroboration" of their persecution. This may be asking the impossible, and may conflict with existing treaties and the norms of international law.

A small gain in security, a substantial loss of liberty

Reaction against the Real ID Act spans the political spectrum, from civil libertarians who fear a massive joint government/business invasion of privacy, to evangelical Christians who don't want to carry "the mark of the Beast". Representative Ron Paul warns that "including such technology as RFID would mean that the federal government ... would know where Americans are at all time of the day and night."

InformationWeek, in a recent article that's broadly supportive of the Real ID Act, calls Ron Paul's concerns "perhaps a bit far-out." Maybe they are. So let's see InformationWeek's calm, rational forecast of the future:

The most-difficult challenge created by the act will be sharing birth-certificate information, Social Security numbers, and other data found on a driver's license across multiple agencies in the 50 states, territories, tribal jurisdictions, and the federal government. ...

There's already some cross-state data sharing. Thirty-nine states use EDI to access a Social Security database to verify a driver's name and Social Security number, which this bill requires. Other verifications will be tougher, since most states don't have birth certificates and other vital records stored digitally. ...

A small, federally funded pilot that uses a simple Web interface--the Electronic Verification of Vital Events--has shown that verifying records such as birth certificates isn't technologically challenging, says Jay Maxwell, CIO of the American Association of Motor Vehicle Administrators. Images can be called up to be checked against the real document but only after they're scanned into a document-management system. "The only way you can get cranking on this system is to get the data in there, and that will take years to do," he says. ...

As machine-readable IDs take hold, the private sector could rely on them in new ways and perhaps play a more-direct role in helping verify identities before IDs are issued, says Maxwell.... If states allow an electric or gas bill as evidence of residency to issue a driver's license, they might need to link to a utility's customer database to prove the invoice is real. Databases such as those managed by ChoicePoint Inc. and LexisNexis could be checked to verify information provided by a license applicant. Maxwell envisions airport-security personnel or even banks scanning in an ID, then being allowed to link up with state motor-vehicle databases to compare the images and data on driver's licenses before allowing a person to board a plane or open an account.

And in exchange for this minor bit of intrusion into our personal lives, we get... what, exactly?

Bruce Schneier, an expert in security technology, argues that a national ID system such as that created by the Real ID Act won't work, and will actually make us less secure. In a 2004 article, he writes:

Our goal is to somehow identify the few bad guys scattered in the sea of good guys.... In theory, if we know who you are, and if we have enough information about you, we can somehow predict whether you're likely to be an evildoer....

Profiling has two very dangerous failure modes. The first one is obvious. Profiling's intent is to divide people into two categories: people who may be evildoers and need to be screened more carefully, and people who are less likely to be evildoers and can be screened less carefully.

But any such system will create a third, and very dangerous, category: evildoers who don't fit the profile.... Even the Sept. 11 hijackers went out of their way to establish a normal-looking profile; frequent-flier numbers, a history of first-class travel and so on. Evildoers can also engage in identity theft, and steal the identity -- and profile -- of an honest person. Profiling can result in less security by giving certain people an easy way to skirt security.

There's another, even more dangerous, failure mode for these systems: honest people who fit the evildoer profile. Because evildoers are so rare, almost everyone who fits the profile will turn out to be a false alarm. This not only wastes investigative resources that might be better spent elsewhere, but it causes grave harm to those innocents who fit the profile.

Overall, the Real ID Act provides mostly an illusion of greater national security. In exchange for modest upgrades in ID quality control and data-sharing, border fence by decree, and a "get tough" attitude towards asylum-seekers and other immigrants, the new law gives us a faulty national ID system wide-open to abuse, substantial inconvenience or danger for legal aliens as well as many native-born citizens, and a power-grab by the Federal executive and legislative branches at the expense of the courts, the States, and of course the people of the United States.


Copyright © 2005 William S. Statler. This work is licensed under a Creative Commons License, which grants limited rights of non-commercial distribution and reuse. Please read
http://creativecommons.org/licenses/by-nc/2.0/
for details. All other rights reserved.


Changelog:

2005-05-20: corrected and expanded border fence section to show it applies to all borders, not just San Diego fence; expanded conclusion with article links and excerpts.

2005-05-18: revised introduction, added link to text of law; corrected to show States may issue a "not valid for Federal ID" license; corrected to show that database-sharing is mandatory; corrected "no judicial review" to "limited judicial review" for border fence; added note on subjects covered in Titles IV and V; other minor changes.

2005-05-17: first version.


Return to my Home Page