I am Jim Harper, director of information policy studies at the Cato Institute in Washington, D.C., a non-profit research foundation dedicated to preserving the traditional American principles of limited government, individual liberty, free markets, and peace. In that role, I study the unique problems in adapting law and policy to the information age, problems like privacy and identification.
I also serve as a member of the Department of Homeland Security’s Data Privacy and Integrity Advisory Committee, which advises the DHS Privacy Office and the Secretary of Homeland Security on privacy and related issues. In addition to my professional duties, I maintain an online resource about federal legislation and spending called WashingtonWatch.com. I speak only for myself today and not for any of the organizations with which I am affiliated or for any colleague.
In my 2006 book Identity Crisis: How Identification Is Overused and Misunderstood, I examined identification theory and policy in detail, including the REAL ID Act of 2005. Below I will discuss the law’s origins and its influence on you as Florida legislators; the benefits that the national ID system envisioned by the law is intended to produce; and the costs of implementing REAL ID in terms of dollars, personal privacy, and security.
In summary, you are not obligated, legally or practically, to implement the REAL ID Act. Compared to its small benefits, the costs of implementing it are prohibitive. These costs are denominated not only in Floridians taxpayer dollars, but in their time and direct expense, their privacy, and their identity security.
You are free to do with the Florida driver’s license as you wish, of course, and I recommend that you treat it first and foremost as a tool for administering the driving laws of Florida. Drivers’ licenses are not suited for the many of the purposes that some advocates would thrust upon them. Using drivers’ licenses for public policy goals beyond driver licensing will bring you more hassles, more costs, more threats to privacy and liberty, and more government growth than you or your fellow Floridians need.
REAL ID and Federal Power
Sixteen years ago, one of the things that caused me to move to Washington, D.C. from my native California (leaving behind sunshine and beaches like Florida’s) was the unrelenting growth of federal power. Election results in 1994 promised a change back toward constitutional balance, which I thought would be better for our country. I’m still stuck in Washington, D.C. trying to make things better for our country.
Our federal constitution is structured to keep power closer to the common sense that is available in state government, local government, and with the people themselves. Under the constitution, the federal government is one of limited powers. Even when it acts under an enumerated power, it must do so in ways that are “necessary and proper” to effectuating a federal power, which does not mean “anything goes.” I am delighted to speak to this particular subcommittee, where I expect you recognize the value of setting policies in Florida that are appropriate for Florida, not simply acting as an administrative arm of the federal government.
You are probably well aware of the 1992 U.S. Supreme Court case of New York v. United States. In that case, the Court affirmed again that states are independent jurisdictions that cannot be directly required to implement federal programs. The federal government cannot command you to do its bidding except in narrow areas where it is exercising distinct authorities such as the power given in the Fourteenth Amendment to protect civil rights.
The authors of the REAL ID Act knew this. They attached REAL ID to a military spending bill in the House, and got it through the U.S. Senate without a separate vote or a hearing in either house of Congress. They designed the bill to avoid the legal limits on federal power while seeking to maximize federal influence on state power and budgets.
REAL ID Tries, and Fails, to Coerce States
Because the REAL ID Act cannot command you to implement its terms, its authors sought to coerce you with a variety of threats, especially the threat that Floridians would not be able to use Florida licenses and identification cards to travel on commercial airlines. The terms of the REAL ID Act permit federal officials to refuse otherwise suitable identification cards from states that are not complying with REAL ID. But they never have, and they never will
When REAL ID’s first deadline came around in May of 2008, many state leaders labored under the impression that the residents of their states would not be able to fly. The Transportation Security Administration and top Department of Homeland Security officials tried to reinforce the impression that a showdown with states would freeze travel in the United States.
In reality, the federal government has never made flying contingent on presenting identification. Though TSA agents sometimes don’t know the rules that govern their own agency, any American can travel without ID today if they have the courtesy and patience to explain the rules to TSA agents. More importantly, the federal government did not have the will to sacrifice domestic air transportation in the name of forcing states to succumb.
Prior to the original REAL ID deadline, many states refused to implement REAL ID due to its unfunded mandates and the threats it poses to citizens’ privacy and liberties. These states paid no price. The federal government declined to “enforce” the REAL ID mandate when the May 2008 statutory deadline came and went. Instead, it created a new set of deadlines. There would be a “material compliance” deadline of December 31, 2009 and a full compliance deadline on May 10, 2011.
But in mid-December of 2009, DHS quietly announced that 46 of 56 states and territories would not meet even its interim deadlines. So it punted on a deadline once again. The agency said that it would still require full compliance in May of 2011, but it is certain not to enforce REAL ID once again when May rolls around this year.
The U.S. federal government does not have the legal power to tell Florida what to do, and it does not have the political power to tell Florida what to do. If the federal government attempted to “enforce” REAL ID, federally uniformed TSA agents would turn law-abiding American citizen travelers away from airports. They would try to blame state officials, but that story simply would not sell. You are at leisure to do whatever is best for Floridians with your driver licensing and identification policies.
The Benefits and Costs of REAL ID
Would Floridians be better off if the state government forced them to join a national ID system? The question is worth analyzing with care because security is very important. The question is what degree and quality of security and other benefits Floridians would get from being put into a national ID system, compared to what costs.
Security Benefits Slim, Other Benefits: A Moving Target
In 2007, I analyzed the Department of Homeland Security’s proposed rule implementing REAL ID for testimony I gave to the U.S. Senate’s Homeland Security and Governmental Affairs Committee. I used the question-and-answer framework for analyzing security programs adopted by the Department of Homeland Security’s Data Privacy and Integrity Advisory Committee in 2006.
The final rule issued by DHS reduced the security benefits of REAL ID to try to control its exorbitant costs, but the analysis still holds. I have included a version of that analysis as Appendix A to my testimony.
In summary, the REAL ID Act was an attempt to thwart terrorism that would have little impact on its own. Joined with terrorism watch-lists, or the wide variety of commercial, law enforcement, and regulatory programs aimed at reducing fraud, promoting public safety, law enforcement, and various forms of personal regulation, REAL ID might have some beneficial effects. However, the national ID system envisioned by REAL ID would transfer risk: a mad bomber would simply switch targets to someplace not controlled by identification. And it would be subject to many attacks, such as corruption of DMV workers, counterfeiting of REAL IDs, and procurement of a genuine REAL ID using counterfeit “breeder” documents. The security benefits of REAL ID are fairly sparse.
Since Congress and the Department of Homeland Security gave up on promoting REAL ID, advocates for a national ID have shifted through many justifications. One of the most prominent is use in “internal enforcement” of immigration law. Under one proposal, all new hires in the United States would have to carry a national ID in order to get access to work. The federal government’s “E‑Verify” program would ultimately require a national ID for it to be implemented successfully. I have analyzed the program with care, finding that it is susceptible to many of the costs and counterattacks of REAL ID. The federal government should address the imbalance in our substantive immigration laws rather than create a domestic identification and background check system, at a cost of billions of dollars, as a band-aid.
Other proposals would use the national ID to control access to financial services and credit, to control access to health care and medicine, and to control access to housing. There is no telling what rules the federal government might add to REAL ID in order to make all states’ residents conform to federal policy. These are “benefits” to some who believe in a large regulatory state, though not to me. REAL ID would be a huge transfer of power from states, localities and people to the federal government. It would give Washington, D.C. indirect regulatory authority over all Americans through their identity cards. Disobey federal rules and the federal government will de-identify you.
Costs: Substantial and Not Shrinking
The cost side of the ledger has a very interesting story, and many have worked hard to claim that REAL ID costs are under control. Those arguments rely on vastly reducing what it means to comply with REAL ID. So let’s recap that story:
The REAL ID Act passed in May 2005, and it required states to begin implementing a national ID system within three years. In regulations it proposed in March 2007, the Department of Homeland Security extended that draconian deadline. States would have five years, starting in May 2008, to move all driver’s license and ID card holders into REAL ID-compliant cards.
With that lengthened deadline, the Department of Homeland Security estimated the costs for this project at $17.2 billion dollars (net present value, 7% discount). Costs to individuals came it at nearly $6 billion — mostly in wasted time. Americans would spend more than 250 million hours filling out forms, finding birth certificates and Social Security cards, and waiting in line at the DMV. (A copy of the DHS’ original cost estimate is attached as Appendix B.)
The bulk of the costs fell on state governments: nearly $11 billion dollars. The top three expenditures were $5.25 billion for customer service at DMVs, $4 billion for card production, and $1.1 billion for data systems and IT. Getting hundreds of millions of people through DMVs and issuing them new cards in such a short time was the bulk of the cost.
To drive down the cost estimate, DHS pushed the implementation schedule way back. In its final rule of January 2008, it allowed states a deadline extension to December 31, 2009 just for the asking, and a second extension to May 2011 for meeting certain milestones. Then states would have until the end of 2017 to replace all cards with the national ID card. That’s just under ten years. Also, the DHS decided to assume that only 75% of people would actually get the national ID. (Never mind that whatever benefits from having a national ID drop to near zero if it is not actually “national.”)
The result was a total cost estimate of about $6.85 billion (net present value, 7% discount). (A copy of the DHS’ cost estimate for this stage is attached as Appendix C.) Individual citizens would still spend $5.2 billion worth of their time (in undiscounted dollars) on paperwork and waiting at the DMV. But states would spend just $1.5 billion on data and interconnectivity systems; $970 million on customer service; and $953 million on card production and issuance — a total of about $2.4 billion. (All undiscounted — DHS didn’t publish estimates for the final rule the same way it published their estimates for the proposed rule.)
Since then, DHS has gotten out of the cost estimate business, but others have picked up the challenge. In particular, a recent report from the Center for Immigration Studies attempted to show that REAL ID costs are well under control. It achieved this result by reporting not on the cost of REAL ID compliance but by reporting on the cost of reaching eighteen milestones or “benchmarks,” including “gimmes” such as “Require covered employees to attend American Association of Motor Vehicle Administrators (AAMVA) or equivalent fraudulent document recognition training.”
There are things that states will do on their own to ensure the security of drivers’ licenses if they wish. One can call that REAL ID compliance, just like one can say that driving north on I‑95 through Jacksonville is a substantial start on a trip to the north pole. The real costs come in when states take steps to complete the national ID system, producing a driver’s license that has nationally uniform data elements, and a back-end surveillance system that shares driver information nationwide. This is when privacy costs join dollar costs to make REAL ID compliance something for Florida to avoid.
Privacy and Data Security Costs
REAL ID has formidable privacy and data security problems, which I will briefly touch on.
The increased data collection and data retention required of states under REAL ID is one important privacy concern. State databases of foundational identity documents will create an incredibly attractive target to criminal organizations, hackers, and other wrongdoers. The breach of any state’s entire database, containing copies of birth certificates and various other documents and information, could topple the identity system we use in the United States today. The best data security is avoiding the creation of large databases of sensitive and valuable information in the first place. REAL ID goes the wrong way in terms of privacy and identity security.
The requirement that states transfer information from their databases to each other contributes to this problem. Interstate transfer exposes the security weaknesses of each state to the security weaknesses of all the others. When a corrupt employee fishes through the system for data about drivers in other states, he or she will be able to collect not just name, address, height, and weight of Florida drivers, but pictures, other biometrics, and copies of foundational identity documents. Sharing of this kind will be required to resolve disputes about who is the true holder of a particular identity.
There are ways to limit the consequences of having a logical national database of driver information, but there is no way to ameliorate all the consequences of the REAL ID Act. It requires that information about every American driver be made available to every other state.
These “in-system” problems join the general privacy problem with having a nationally uniform identity system. Converting from a system of many similar cards to a system of uniform cards is a major change. It is not just another in a series of small steps.
Economists know well that standards create efficiencies and economies of scale. When all the railroad tracks in the United States were converted to the same gauge, for example, rail became a more efficient method of transportation. Because the same train car could travel on tracks anywhere in the country, more goods and people traveled by rail. Uniform ID cards would have the same influence on the uses of ID cards.
There are machine-readable components like magnetic strips and bar codes on many licenses today. Their types, locations, designs, and the information they carry differ from state to state. For this reason, they are not used very often. If all identification cards and licenses were the same, there would be economies of scale in producing card readers, software, and databases to capture and use this information. Americans would inevitably be asked more and more often to produce a REAL ID card, and to share the data from it, when they engaged in various governmental and commercial transactions.
In turn, others would capitalize on the information collected in state databases and harvested using REAL ID cards. Massed personal information will be an irresistible attraction to the Department of Homeland Security and many other governmental entities, who will dip into data about us for an endless variety of purposes.
The proposed REAL ID regulation cited the uses that governments are likely to make of REAL ID and that advocates of a national ID continue to tout: controlling “unlawful employment,” gun ownership, drinking, and smoking. Uniform ID systems are a powerful tool. If you build one and force Floridians into it, people other than you will use it to control Floridians’ lives. If created, REAL ID will be used for many purposes beyond what was originally contemplated and what is contemplated today.
Conclusion
The federal government in Washington, D.C. cannot and should not tell Florida how to run its driver licensing and identification card systems. Part of the genius of federalism is that states can experiment with different approaches to public policy problems and learn from one another. They also can compete against each other for superiority in maintaining low tax rates, relatively high levels of service, protections for privacy, conveniently offered government services, and so on. Identification is an area where experimentation and competition — not uniformity — will bring out the best policies and programs.
It is not a given that governments should be the primary identity providers. I would like to see states more willing to accept privately issued identification documents and credentials that adequately prove relevant information. The private market for identity and credentialing systems is emerging slowly and cautiously, as it should.
Whatever the case, Florida should reject national identification standards. For the sake of Floridians’ privacy, Florida should reject sharing driver information with states across the nation and the federal government.
Beyond those strong recommendations, it is not up to me to tell you what to do either. I am happy to continue to assist your state in devising identification and driver licensing policies that will best meet the needs of your citizens and residents at the lowest cost and with the greatest protections for privacy. For the most part, that means using the Florida drivers license as a drivers license, and not making it into a newfangled tool for implementing the federal government’s policies.
APPENDIX A Rudimentary Analysis of REAL ID Act Proposed Regulation in Terms of Risk Management Q&A Format Devised by DHS’ Data Privacy and Integrity Advisory Committee
• What are you trying to protect? The REAL ID regulation identified federal buildings, nuclear facilities, and aircraft as the primary beneficiaries of the REAL ID rules, as well as other infrastructure should access to it be conditioned on showing ID. “Ancillary” beneficiaries would be the many segments of the public who would benefit from various types of fraud reduction, public safety law enforcement, and various forms of personal regulation. • What are you trying to protect it from? The primary threat articulated by the rule’s brief benefit statement is “terrorist attack,” which can take any number of forms. The assessment did not describe with particularity any vulnerability or the way any of these assets may be harmed, much less how REAL ID would prevent or diminish such harm. As to ancillary beneficiaries, it is well known that fraud, unsafe behavior, and unwise personal choices have a variety of costs. The assessment did not describe how the REAL ID regulations would prevent these ills, though as part of an expanded police and regulatory state, they undoubtedly would. • What is the likelihood of each threat occurring and the consequence if it does? The rule’s benefit statement made no attempt at terrorism risk assessment, positing instead two different “9/11” scenarios, the avoidance of which would cost-justify the rules. The ancillary harms the assessment claims to effect vary widely across the landscape of human action, and have a variety of likelihoods and consequences. • What kind of action does the program take in response to the threat — acceptance, prevention, interdiction, or mitigation? The proposal did not go into this kind of detail, but the REAL ID rules are best characterized as interdiction: a form of confrontation with, or influence exerted on, an attacker to eliminate or limit its movement toward causing harm. A more accurate and secure identification system may interfere with terrorists in a variety of ways.
Requiring REAL ID-compliant identification cards for access to secured areas would limit the field of potential attackers on those areas to only those people that are able to prove their identity and lawful presence in the United States.
This would inconvenience foreign terrorist organizations, likely changing their behavior in a number of ways. The REAL ID Act might cause foreign terrorist organizations to target infrastructure that is not secured by identification requirements. It might cause them to select individual attackers who can lawfully enter the U.S. and acquire identification.1 It might cause them to ally with domestic criminals or criminal organizations.
They might also attack the REAL ID system in various ways. The REAL ID regulations might induce foreign terrorist organizations to procure REAL ID-compliant cards through corrupt Department of Motor Vehicles employees. It might cause them to seek counterfeit documents that can fool DMV employees into issuing REAL ID-compliant cards. It might cause them to seek counterfeit REAL ID-compliant cards good enough to fool verifiers at checkpoints. It might cause them to corrupt verifiers at checkpoints.2
Whatever the case, the REAL ID regulations would cause some inconvenience to foreign terrorist organizations seeking to mount an attack on infrastructure secured behind checkpoints.
A second form of interdiction, also not discussed in the regulation, is the use of REAL ID in conjunction with watch lists. Again putting aside attacks on the REAL ID system, requiring REAL ID-compliant identification cards for access to secured areas would limit the field of potential attackers on those areas to only those people that are not known to be terrorists by the authorities. Coupled with watch lists, the REAL ID regulations might cause terrorist organizations, foreign and domestic, to target infrastructure that is not secured by identification requirements. It might cause them to select attackers who are not known to have contacts with terrorists. It also might cause them to attack the REAL ID system in the ways discussed above.3
Similar to the joining of REAL ID to watch lists in terrorism interdiction, REAL ID may be joined to a variety of commercial, law enforcement, and regulatory programs aimed at reducing fraud, promoting public safety, law enforcement, and various forms of personal regulation. Each of these multitudinous potential uses of REAL ID would alter the behavior of “attackers” in various ways. It would improve their behavior in some cases, inspire avoidance in others, and also in some cases prompt attacks on the REAL ID system like those discussed above, such as by college students seeking a good fake ID.
• Does the response create new risks to the asset or others? Some of the avoidance behaviors listed above would transfer risks or create new risks. Terrorists may shift from REAL-ID-secured targets to non-REAL-ID-secured targets. Foreign terrorist organizations allying themselves with domestic criminal organizations to avoid REAL ID-based security might form more dangerous hybrid organizations. As noted above, there would certainly be attacks on the REAL ID system, in terms of technical security, corruption, fraud, and so on. The techniques developed by “casual” attackers such as college students would accrue to the benefit of the serious threats such as criminal or terrorist organizations. These are just some of the risk transfers and new risks that would result from implementing the REAL ID regulations.
APPENDIX B
Department of Homeland Security, Regulatory Evaluation
Notice of Proposed Rulemaking
February 28, 2007
APPENDIX C
Department of Homeland Security
Regulatory Evaluation, Final Rulemaking
January 17, 2008
1. In general, this was the modus operandi of al Qaeda in the 9/11 attacks.
2. As demonstrated by the “Carnival Booth” study, relevant information from watch lists is relatively easy to reverse-engineer. One must simply send an attacker through a checkpoint on a few “dry runs” to determine whether he or she is subject to different treatment. See Samidh Chakrabarti and Aaron Strauss, Carnival Booth: An Algorithm for Defeating the Computer-Assisted Passenger Screening System, 6.806: Law and Ethics on the Electronic Frontier (May 16, 2002) .
3. Assuming terrorists aim to sap the economy and vitality of the United States, they could do very well by serially attacking non-ID-controlled targets if that would induce the U.S. to secure them through ID checks. If each of the 240 million licensed drivers in the U.S. were inconvenienced by just one minute per week to show ID at malls, subway stations, bus depots, office buildings, and other public infrastructure, the cost to society in lost time alone (assumed value: $20/hr.) would be over $4 billion per year – a net present cost of $57 billion (assumed 7% interest).
