November 16, 2007
THE REAL ID ACT, ENHANCED DRIVERS' LICENSES, AND RELATED APPLICATIONS
By: James J. Fazzalaro, Principal Analyst
You asked several drivers license-related questions including:
1. What is the Real ID Act and what does it do;
2. What are “enhanced” drivers' licenses;
3. How do enhanced drivers' licenses relate to concepts such as “mini-passports”, the Western Hemisphere Travel Initiative, and credentialing documents for first responders?
The Real ID Act is a federal law passed in 2005 that requires states to meet certain standards when issuing drivers' licenses and non-driver photo identification cards in order for those credentials to be acceptable for certain federal purposes such as boarding airplanes and accessing federal facilities. States must have plans in place to comply with the standards by May 11, 2008, but the secretary of the federal Department of Homeland Security can grant extensions for compliance up to December 31, 2009 if a state makes a request for one by October 2007.
The law sets standards in a number of areas including minimum items of information and features that must be on the credential, documentary evidence that someone must submit to establish identity and residence, procedures states must follow to verify documents, and requirements for record retention and for making records available electronically to other jurisdictions. The act also, among other things (1) establishes restrictions regarding issuing these credentials to people who are not citizens of the United States, (2) requires state licensing agencies to conduct criminal history checks on employees, and (3) requires these agencies to establish fraudulent document recognition training programs for employees who issue licenses and ID cards.
The DHS secretary issued draft implementation regulations on March 1, 2007. They have yet to be issued in final form.
Some states are moving toward issuing “enhanced” drivers' licenses. These licenses are enhanced through the use of “radio frequency identification” technology. This technology involves the use of a memory chip and antenna embedded in the license or ID card that contains certain information beyond what appears on the credential itself. Depending on the type of systems used, this allows the information on the chip to be read directly by being placed in a scanner or remotely at a distance by a scanner that activates the card. This type of technology also is known as “smart cards” technology. The information taken from the card is then entered into the local computer database and may be linked through the internet to other databases.
The initial efforts by states to make use of enhanced drivers' licenses involve use of the technology to help meet the requirements of the Western Hemisphere Travel Initiative. This is the program established by DHS under which anyone entering the United States, even from neighboring countries, must show a valid passport for entry. The requirement now applies to travel by air but soon will apply to land travel as well. DHS has begun working with states to help them develop their drivers' licenses to function as “mini-passports” as a cheaper alternative. In January, 2008, Washington will begin issuing enhanced licenses that will be able to be scanned by border officers to show information on citizenship. Vermont will begin issuing similar enhanced licenses late in 2008. Other states are also considering this type of license alternative to help reduce the time it takes to cross international borders for their residents who make frequent cross-border trips.
Following the terrorist attack on the Pentagon in 2001, officials in charge of coordinating the emergency response experienced difficulties properly identifying first responders and clearing them for entry into sensitive areas of the emergency scene. DHS undertook the First Responder Partnership Initiative to develop a model for improved inter-jurisdictional coordination among agencies providing first responders to emergency scenes. Alexandria and Arlington County, Virginia recently became the first to make use of this model through creation of a First Responder Authentication Credential. More than 2,000 first responders throughout the region have been issued these new electronic credentials that allow on-scene commanders to quickly identify them and determine their expertise. The technology is the same type used for enhanced drivers' licenses. Although the new first responder credentials are not driver licenses, using enhanced drivers' licenses as a method of addressing this issue is probably technically possible.
THE REAL ID ACT
The federal Real ID Act was passed by Congress in 2005 as part of an emergency spending authorization for Afghanistan and Iraq military operations and other purposes. The law prohibits any federal agency from accepting a person's state-issued driver's license or identification card for any official federal purpose unless the state meets the requirements of the new law. The prohibition on federal acceptance of non-complying licenses and identification cards begins three years after the law's enactment, which, based on its enactment date, is May 11, 2008 (Title II of P.L. 109-13).
The law defines an “official purpose” as including accessing federal facilities, boarding federally regulated commercial aircraft, and entering nuclear power plants, but it could include other things as well. The U. S. Secretary of the Department of Homeland Security (DHS), who administers the new provisions and determines a state's compliance status, is authorized to determine any other official purposes to which the prohibition applies. The DHS secretary also is authorized to adopt other implementing regulations, including interpreting some of the act's provisions. DHS issued a set of draft regulations for comment on March 1, 2007.
The law was written so that it does not direct states to comply but the implication of not complying is that its licenses and identification cards will not be accepted for identification purposes by any federal authority anymore.
The law applies to drivers' licenses and identification cards, which it defines as an identification document issued by a state or local government solely for the purpose of identification. Thus, while it applies to the non-driver photo identification cards the DMV issues, it also could potentially apply to any other state or locally issued identification card. In its proposed regulations, DHS has limited application of the Real ID Act requirements only to drivers' licenses and non-driver photo ID cards issued by state motor vehicle agencies, but this is subject to change.
Any non-complying driver's license or identification card must (1) clearly state on its face that it may not be accepted by any federal agency for federal identification or any other official purpose and (2) use a unique design or color indicator to alert federal agency or other law enforcement personnel that it may not be accepted for any such purpose.
The law applies most directly to drivers' licenses and non-driver photo ID cards state motor vehicle agencies issue, but the definition it uses for identification cards covers any identification document issued by a state or local government solely for the purpose of identification. Identification cards issued according to the new standards and procedures can be accepted for federal purposes and those not issued to these standards cannot be accepted and must contain a statement on their face stating that they cannot be accepted for federal identification and other official purposes.
The bill establishes (1) minimum items of information and features that must be on licenses and ID cards; (2) documentary evidence that someone must submit to establish their identity and primary residence address; and (3) procedures the state agency must follow to verify the issuance, validity, and completeness of the identification documents with the agency that issued them before it issues the license or ID card. It also prohibits an agency from accepting any foreign document other than an official passport.
The new law, in effect, limits those who can receive licenses or ID cards that qualify under its requirements to nine categories of people who are either U.S. citizens or aliens who can document their lawful status in the United States. However, for five of the nine categories, the state may only issue a temporary license or ID card that can be valid only during the period of time of the person's authorized stay in the United States. If there is no definite end to the period of authorized stay, the temporary document can be issued for a period of no more than one year. It can be renewed only if valid evidence is presented that the Secretary of Homeland Security has extended the status of the person under which he qualified for the license or ID card initially.
The law establishes several other responsibilities for agencies in order for their documents to qualify for federal purposes. These include, among other things,
1. employing digital image capture technology of all identify source documents,
2. retaining paper copies of source documents for at least seven years or images for at least 10 years,
3. refusing to issue a license or ID card to someone with a license from another state without confirming that the person is terminating or has terminated the other license,
4. ensuring the “physical security” of locations where licenses and ID cards are produced and the documentary materials and papers from which they are produced,
5. subjecting all those authorized to manufacture or produce licenses and ID cards to “appropriate security clearance requirements,”
6. establishing fraudulent document recognition training programs for employees engaged in issuing licenses and ID cards, and
7. providing electronic access to all the other states to a state motor vehicle database that includes, at a minimum, all the data fields printed on the drivers' licenses and ID cards and driver histories that include violations, suspensions, and license points. The new law also requires the state to “establish an effective procedure to confirm or verify a renewing applicant's information.”
The law provides for grants to states to help them implement its requirements. States may use up to 20% of their federal homeland security grants to pay costs associated with Real ID Act compliance. Although states must have plans in place to comply by May 11, 2008, the DHS secretary may grant extensions until as late as December 31, 2009 if a state requests it by October 2007 and provides a plan detailing milestones, schedules, and budgets allowing the state to meet the requirements.
Minimum Document Requirements
To meet the law's requirements a state must include, at a minimum, the following information and features on any driver's license or ID card it issues:
1. the person's full legal name, date of birth, and gender;
2. the person's driver's license or identification card number;
3. his digital photograph;
4. his primary residence address;
5. his signature;
6. physical security features designed to prevent tampering, counterfeiting, or duplicating of the document for fraudulent purposes; and
7. a common machine-readable technology, with defined minimum data elements.
Minimum Issuance Standards
Before issuing a driver's license or ID card, a state must require, at a minimum, presentation and verification of:
1. A “photo identity document” except that a identity document without a photo is acceptable if it includes both the person's full legal name and date of birth;
2. Documentation showing the person's birth date;
3. Proof of the person's social security account number or verification that he is not eligible for a social security account number; and
4. Documentation showing the person's name and address of primary residence.
Other Special Requirements
The act, in effect, limits issuance of driver's licenses and ID cards to those who can document their lawful status in the United States. Before issuing a license or ID card, a state must require, at a minimum, valid documentary evidence that the person:
1. is a U.S. citizen or national;
2. is an alien lawfully admitted for permanent or temporary residence in the U.S.;
3. has a conditional permanent resident status;
4. has an approved application for asylum or has entered the country in refugee status;
5. has a valid, unexpired nonimmigrant visa or nonimmigrant visa status for entry into the U.S.;
6. has a pending application for asylum;
7. has a pending or approved application for temporary protected status;
8. has approved deferred action status; or
9. has a pending application for adjustment of status to that of an alien lawfully admitted for permanent residence or conditional permanent resident status.
Requirements for Temporary Licenses and Identification Cards for Certain Persons Listed Above
A state may issue only a temporary license or ID card to someone in categories 5 through 9 above. Thus a full term license or identification card may only be issued to a U.S. citizen or national, an alien with permanent or temporary residence status, someone with conditional permanent resident status, or someone with an approved application for asylum or who has entered the U.S. in refugee status. All others can only be issued a temporary document that can only be valid during the period of time of their authorized stay in the United States. In the absence of a definite end to the period of authorized stay, the temporary document can be valid for no longer than one year. The temporary document must clearly indicate that it is temporary and state the expiration date. It can only be renewed if valid documentary evidence is presented showing that the Secretary of Homeland Security has extended the status through which the applicant qualified for the temporary document.
To meet the act's requirements, a state must (1) before issuing a license or ID card, verify with the issuing agency the issuance, validity, and completeness of each document required to be presented by someone to validly establish his identity as noted above, (2) not accept any foreign document to satisfy the documentary requirements other than an official passport, and (3) no later than September 11, 2005, enter into a memorandum of understanding with the Secretary of Homeland Security to “routinely” use the automated federal system known as Systematic Alien Verification for Entitlements to verify the legal presence status of any non-citizen applying for a driver's license or ID card. (Section 404 of the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 established the federal status verification system.)
Other State Responsibilities
In addition to all of the above, in order to meet the requirements of the federal act, a state must adopt the following practices when issuing drivers' licenses and ID cards:
1. Employ technology to capture digital images of identity source documents so that the images can be retained in electronic storage in transferable format.
2. Retain paper copies of source documents for at least seven years or images of source documents presented for at least 10 years.
3. Subject each applicant for a license or ID card to mandatory facial image capture.
4. Establish an effective procedure to confirm or verify a renewing applicant's information.
5. Confirm through the Social Security Administration the social security account number a person gives using the full account number or, if the number is already registered to or associated with another person to which the state has issued a license or ID card, the state must resolve the discrepancy and take appropriate action.
6. Refuse to issue a driver's license or ID card to someone with a driver's license issued by another state without confirmation that the person is terminating or has terminated the other license.
7. Ensure the physical security of locations where drivers' licenses and ID cards are produced and the security of documentary materials and papers from which they are produced.
8. Subject all those authorized to manufacture or produce drivers' licenses or ID cards to “appropriate security clearance requirements.”
9. Establish fraudulent document recognition training programs for appropriate employees engaged in issuing licenses and ID cards.
10. Limit the term of all licenses and ID cards that are not temporary to a maximum of eight years.
11. Provide electronic access to information contained in its motor vehicle database to all other states.
12. Maintain a motor vehicle database that contains, at least, (a) all data fields printed on drivers' licenses and ID cards the state issues and (b) motor vehicle drivers' histories, including violations, suspensions, and license points.
ENHANCED DRIVERS' LICENSES
All drivers' licenses, no matter what state issues them, have a feature through which certain information on the license holder, such as name, age, or something else considered important by the license agency is encoded on the license and can be read via a scanner. Almost all of the states use a device known as a 2D barcode to carry this information. A few states use other forms of barcode technology or a magnetic stripe. Barcodes are a type of a security feature intended to make licenses more difficult to counterfeit.
An “enhanced” driver's license is considered to be one that uses more advanced types of technology to accomplish additional things. The type of technology most frequently being considered for enhancing drivers' licenses is known as “radio frequency identification” or RFID. With RFID, a special integrated circuit “chip” is embedded in the license or ID card itself along with a small antenna that makes it possible for the information coded onto the chip to be read or transmitted by an external reading device. Credentials using this type of technology are also commonly referred to as “smart cards.” More advanced forms of RFID technology may include an embedded microcontroller. The microcontroller is like a miniature computer with the ability to store large amounts of data, manipulate the information in its memory, carry out on-card functions like encryption and digital signatures, and interact intelligently with a smart card reader.
Memory chips are cheaper than microcontrollers, but provide less in the way of data security. Cards with these chips depend on the security of the card reader for processing and are more appropriate for applications that require low or medium levels of security.
RFID systems can be passive, semi-passive, or active. Passive RFID has no internal power source, just the integrated circuit chip and an antenna. The chip is activated by the external scanning device and is then able to transmit its data through the embedded antenna. In a semi-passive system, the device does not initiate communication with the reader, but contains a battery that allows it to perform other functions such as monitoring the card environment, powering the internal electronics, or facilitating information storage. Active RFID has a power source and a transmitter in addition to its antenna and memory chip. RFID systems usually have read and write capability and can transmit their data over much longer distances than semi-passive or passive RFID. Vehicle transponders used for electronic toll collection are a typical example of active RFID.
Active RFID units typically cost $20 or more, semi-passive units cost from $2 to $10, and passive units cost from $0.20 to a few dollars. Passive RFID is typically “read-only” while semi-passive and active RFID can have varying degrees of read-write capability depending on the sophistication of the system.
The RFID technology commonly being considered for enhanced drivers' licenses is the passive format. The operating frequency of the RFID system determines the range at which the information on the memory chip can be read. With low frequency RFID, the read range is typically less than two feet. These applications are most common for access control systems, animal identification, and car key-and-lock systems. High frequency RFID units can be read from up to three feet away. Applications typically are material tracking, pallet tracking, building access control, and airline baggage tracking. Ultra-high frequency RFID allows the chip to be read from up to 15 feet away. Typical applications include pallet and container tracking, truck tracking in shipping yards, and retail. Higher frequencies also allow for a faster read rate which allows more tags to be read simultaneously. RFID applications being used for enhanced drivers' licenses typically are using the ultra-high frequency band.
When the RFID reading device broadcasts its radio waves, all of the RFID chips designated to respond to that frequency and within range will respond. The information contained on an RFID chip is sent through the reader to the local database and, depending on the system, can be linked to other databases through the internet. The actual information transmitted depends on the information the system is designed to collect.
Drivers' licenses typically contain relatively basic information about the license holder such as name, address, height, eye or hair color, and date of birth. A driver's license enhanced with RFID technology would be capable of storing more than just this basic information. Enhanced licenses about to be issued in Washington and Vermont provide citizenship information that can be used to speed up the process of crossing the international border between Canada and the United States. But other types of information such as digitized fingerprint or biometric information about the license holder may also be possible, depending on the sophistication of the enhancement. Identifying information, either in the form of a reference number or the actual digitized information, might then be linked to other databases, such as license status, driver history, or criminal history, via the internet.
THE WESTERN HEMISPHERE TRAVEL INITIATIVE
The federal Intelligence Reform and Terrorism Prevention Act of 2004 requires DHS and the Department of State to develop and implement a plan to require all travelers to present a passport or other accepted documents that show identity and citizen ship when entering the United States. The Western Hemisphere Travel Initiative (WHTI) is the plan to implement these requirements. Beginning in January 2007, U.S. citizens traveling by air between the U.S. and Canada, Mexico, Central and South America, the Caribbean, and Bermuda are required to present a valid U.S. passport, Air NEXUS Card, or U.S. Coast Guard Merchant Mariner Document. (NEXUS is a joint U.S.-Canada program to provide expedited border clearance for certain low-risk, pre-approved people who frequently cross the border.) Beginning as early as January 2008, the document requirements may be applied to travelers crossing the U.S. border by either land or air.
Beginning in 2006, new U.S. passports have been issued in a format that includes RFID technology. These “e-passports” are intended to help address some of the demands that the WHTI imposes at border crossing points by allowing passports to be scanned electronically. However, in
addition to this, DHS has been working with states on programs that both enhance the security of a state-issued driver's license or ID card and allow these documents to serve as acceptable alternative documents for crossing the border.
Starting in January 2008, Washington will begin issuing an RIFD-enhanced driver's license as part of a pilot program to test this concept of an enhanced driver's license serving as a “mini-passport” to meet the requirements of the WHTI. The enhanced driver's license will cost $15 more than the standard Washington driver's license ($40 compared to $25) and is voluntary. The enhanced license is a passive, ultra-high frequency RFID that will be activated by the scanners at a border crossing point and will send a unique reference number to the border officer. The RFID contains no personal information only a reference number that links it, through the Customs and Border Protection network to the state Department of Licensing records to verify the information in the license files. The state and federal proponents of the enhanced license feel that it provides a less expensive and faster alternative to obtaining a U.S. passport yet meets the requirements of the WHTI.
An applicant for an enhanced Washington driver's license must apply in person, be photographed and interviewed, and provide satisfactory proof of U.S. citizenship, identity, and Washington residency. The law authorizing the enhanced driver's license requires that the department obtain a biometric identifier from each applicant that it must match against existing images in its license database to verify identify. The law also authorizes the department to make images associated with the enhanced license program available to U.S. customs and border agents for the purposes of verifying identity.
Vermont recently became the second state to provide an enhanced driver's license alternative. The Vermont program is similar to Washington's and is being done through an agreement with DHS similar to Washington's. The enhanced Vermont licenses will start to become available in the latter part of 2008. The additional cost for the enhanced license has not yet been determined but state official expect it to be $15 to $20 more than a standard license.
Other states, including Arizona and Texas, appear to be examining the feasibility of similar initiatives.
FIRST RESPONDER CREDENTIALING
In the aftermath of the terrorist attack on the Pentagon on September 11, 2001, emergency first responders from throughout the region came to provide assistance at the scene. Officials from Arlington County, Virginia, who were responsible for command at the emergency scene, experienced significant problems ensuring that only credentialed responders had access to the most sensitive areas of the scene. As a result, onlookers and emergency personnel were intermixed at the scene.
As a result, DHS started the First Responder Partnership Initiative, the purpose of which is to develop a model that enhances cooperation and efficiency between state and local first responders and their federal counterparts. Part of the program involves development of a smart card using a common architecture and standards that could serve as the basis for a common first responder authentication credential. The credential would contain information that would securely establish the identities of emergency responders and their qualifications to on-scene commanders so that they could be rapidly cleared and assigned duties at the scene.
The result of this effort has been development of the First Responder Authentication Credential (FRAC). The city of Alexandria and Arlington County, Virginia recently became the first jurisdictions to implement the FRAC system. More than 2,000 FRAC cards have been issued to first responders throughout the region.
Although the cards being issued for the FRAC system are distinct credentials and not drivers' licenses, the RFID-based technology being used is similar to the technology used for enhanced drivers' licenses, so the possibility may exist for states to examine ways in which enhanced license could be adapted to provide the type of common first responder credentialing that DHS envisions through the First Responder Partnership Initiative.