​

A NEW LAW intended to keep driver’s licenses from being issued to terrorists and illegal immigrants is creating concerns about costs and compliance among the officials at the state level who will have to implement the new congressional mandates.

Called the Real ID Act, the law requires every state department of motor vehicles (DMV) to verify the identification and citizenship or legal residency of persons requesting driver’s licenses.

Specifically with regard to ID verification, DMVs must ask for documents showing full legal name and date of birth, preferably with a photo, plus documentation of principal residence and Social Security eligibility. Staff must verify the authenticity of these documents with the issuing agency. And the DMV must retain them digitally.

Driver’s licenses issued after this verification process is complete must contain identifying data, a digital photo, and signature. The new licenses must also contain security features. States have three years to comply.

After the law becomes effective in May 2008, anyone needing to enter a federal facility or pass a federal checkpoint will need a driver’s license that meets these new standards.

The Department of Homeland Security (DHS) will write the regulations setting out how states must implement the law’s requirements. For example, although media have speculated about what documents might be used to verify identity, the law does not enumerate which domestic documents can be used, though it does specify which foreign documents are acceptable. DHS will have to clarify which documents can serve as proof of identity and primary residence, for example.

The law also requires that DMVs make licenses machine-readable and that they develop databases of the information contained on licenses in a form that can be shared with other states.

Additionally, DMVs must establish fraudulent-document-recognition training programs for staff and make sure that facilities where licenses are produced and documents are stored are secure to minimize the risk of identity theft or counterfeiting. Regulations will need to elucidate the implementation of all of these provisions as well.

The details have yet to be proposed, but some concerns about implementation have already surfaced. For example, the ability to prove one’s own identity may not be easy due to certain restrictions, such as for U.S. citizens born overseas, says Cheye Calvo, transportation committee director for the National Conference of State Legislatures. The new law stipulates a legal passport is the only foreign document that can be accepted.

“If you’re born to a soldier stationed in Germany and you have a German birth certificate, that’s not acceptable, so how do you prove who you are?” Calvo asks.

States must also develop capabilities for digitizing all the information, most of which is currently in paper format, and store each document for at least seven years. Building that capability is likely to be costly and difficult.

Another question concerns the nature of the databases and access to them. Currently, there is the Commercial Driver License Information System (CDLIS), which states can tap into to verify information. As of April 1, 2004, there were more than 11.5 million driver records in the database, which is managed by EDS in Plano, Texas. Each record costs a state 8 cents to maintain each month.

“We would hope it would be a pointer system rather than a free flow of information, which raises real issues about who has that information and what are they doing with it,” Calvo says.

DHS will have to spell out which technology is to be used on the license as well. Possibilities for holding information include a magnetic strip, enhanced bar code, or radio frequency identification (RFID) chips.

As for what information might truly authenticate that a person is who they say, a biometrics-identifier is a good option, says Randy Vanderhoof, executive director of the Smart Card Alliance.

“If the intent is to come up with the strongest possible form of state-issued identity document in the form of a driver’s license, then it would make sense to incorporate a biometric so that the person presenting the ID can be verified against the information physically printed on the license,” he says.

The State Department is already using RFID chips on new passports, and DHS is exploring their use in ID cards for visitors at the Canadian and Mexican borders.

Calvo says that states favor bar codes over RFID, due to privacy concerns that the technology can be read by scanners without the card holder’s knowledge.

Ultimately, the big question is: What will all this cost? The Congressional Budget Office estimated the new requirements would cost $100 million, which states were provided in the FY2006 federal budget. But the National Conference of State Legislatures estimates it would cost $500 million to $750 million for equipment, computer upgrades, information storage, and employee training and overtime to meet the new requirements.

—By Eric Grasser, assistant editor