Ellen Perlman was a GOVERNING staff writer and technology columnist.E-mail: firstname.lastname@example.org
States are on the hook to turn driver's licenses into secure ID cards. The size of the job is scaring them.
For the past five years, clerks at the Colorado Department of Motor Vehicles have been enforcing new rules for getting a driver's license. It hasn't been pleasant. As the new system has been put in place - a new requirement here, followed by another one there - DMV employees have been dressed down, yelled at, spat on and cursed by those in line.
This is not the usual situation at today's DMVs, because states have gone to great efforts in the past decade to make license renewal a friendlier, more convenient experience - letting drivers renew online or by mail; putting small DMV offices in local shopping malls. But there's a reason why Colorado clerks are under fire: The new rules, which have to do with creating a more secure license, have brought back long lines and frustrating misunderstandings about just exactly what documents drivers need to bring in and how long it will take the DMV to verify those papers. That's why Colorado, which established its own rules for securing licenses, may be the best place to look to see what it's going to be like when the REAL ID Act, the 2005 federal law that calls for a higher level of security for driver's licenses, starts going into effect next year.
REAL ID has just about every state, including Colorado, up in arms. It's not that states dispute the need for a more secure license. They are well aware that numerous institutions rely on licenses as identity documents. Their beef is with the U.S. Department of Homeland Security and its proposed rules for closing security holes using the state licensing process. The DHS rules, which finally surfaced this past March, ask the states to take on an immensely difficult task - some say an impossible one - and to pay for the privilege of doing it.
There are rumblings in Congress about repealing the law. But as things now stand, the proposed DHS regulations for a new or renewed license call for all drivers to go to a DMV office in person and show original identity documents. DMV employees will have to verify those documents - birth certificates, Social Security numbers or other credentials. An impact analysis done jointly by associations of state legislators, governors and motor vehicle administrators figure that REAL ID requirements will more than double the workload of motor vehicle offices.
Estimates on the cost of the program are even more daunting. The National Governors Association figures states are likely to spend at least $11 billion of their own money over the next five years to get REAL ID up and running. The largest contributing factor is the more than 2.1 million hours of computer programming states will need to adapt their systems for new requirements for things such as eligibility verification and database design.
Several states have been outspoken about their misgivings over the likely problems. "If we had all the money right now, it couldn't get done in 10 years," says Matthew Dunlap, Maine's secretary of state. "This is bigger than the space program."
It's also a lot touchier, raising as it does politically sensitive privacy issues. To make REAL ID work nationwide, it would have to be supported by a variety of databases and that raises alarms for civil liberties groups over control of personal information. Although DHS claims that REAL ID does not establish a national database of driver information and that states will collect and store information just as they do today, that hasn't eased concerns. DHS's proposed rules, says state Representative Scott Lansley of Maine, "didn't do much for me in calming my fears about Big Brother stepping in and overstepping bounds."
Given those concerns, states have a decision to make: to comply or not to comply. REAL ID is not a mandate. It is voluntary. States can opt in or opt out. If they opt in, they would have to scramble to meet REAL ID's tight and looming deadlines. The first implementations are scheduled to go into effect in May 2008. States such as Colorado and Virginia are preparing themselves for that deadline. States that opt in but aren't ready to meet the 2008 deadline can request an extension, as most states likely will, but it may not make compliance any easier in the long run.
If states decide to opt out - as Montana and Washington have done - it could create major inconveniences for their residents, who would not be able to use their driver's licenses to board planes or enter secure federal facilities. An opt-out could also shatter the federal government's plans for how REAL ID will work.
Colorado's experience is telling. The state kicked off its efforts five years ago in response to a problem that was rampant in the state: fraud and identity theft and the fake licenses used by criminals to misidentify themselves.
Producing fake licenses is low-tech and brazen. Burglars have used heavy vehicles to ram through DMV walls, windows or doors to steal license-making equipment and paper stock. Colorado DMV offices were burglarized four or five times. Or, identity thieves go "dumpster diving" behind banks, picking up discarded checks with driver's license numbers and names and using that information to apply for new licenses. Five years ago, when people came to a Colorado DMV office and said they'd lost their license, they would be issued a new one with few questions asked. Thieves were using 30 or 40 identities to obtain as many fraudulent licenses.
"When we went into the customer service business," says Joan Vecchi, director of Colorado's Division of Motor Vehicles, "it started costing us." Not that Colorado was the only state with such problems. In an effort to be driver-friendly, Maine cut a deal with Rite Aid pharmacies to issue state licenses - only to find that young store clerks were making fake IDs so their underage friends could buy beer.
When Colorado decided to cut down on the opportunities for license fraud, it convened an identity-fraud working group in 2000. It came out with recommendations on how the state should tighten license-issue procedures, and the DMV started putting them into action, starting with verification of such basic documents as immigration papers.
That was when Colorado's DMV discovered that cracking down is hard to do. People got pretty unhappy. Particularly upset were those drivers who use their cars daily for their jobs. They came in expecting to walk out with a license the same day, as they always had, but some legal immigrants were told that it could take weeks or months while their immigration documents were verified. "We'd say, 'We'll have an answer in three weeks,' " Vecchi says. "They'd say, 'What are you, crazy? We need to get to work.' "
The DMV soldiered on. It started using facial-recognition technology, taking pictures and checking them against 12 million photos to see if any other documents were on file under a different name. To cut down on the theft of supplies from local DMV offices, it set up processing of licenses at a central facility in another state.
Today, when applicants come into DMV offices, employees check Social Security numbers against a federal Social Security database and naturalization certificates against a U.S. Citizen and Immigration Service database. The electronic Social Security verification system has provided quick answers, but the USCIS's electronic system for verifying the status of immigrants has been slow and clunky, and sometimes information is incomplete. In part that's because the USCIS system was created for a handful of federal agencies to use to verify whether legal immigrants are eligible for certain benefits. It was not built to handle additional requests from the states, and certainly not the millions of hits expected to come its way once all states go live under REAL ID.
There are other documents that also need verification under REAL ID, such as birth certificates. As Vecchi sees it, the only reasonable way to do that would be for the federal government to create a database. Otherwise, states would have to hit 56 different state and territorial databases during the checking process. Yet, if a state opts out, its database would not be available, thus undermining the whole REAL ID system.
As to offering advice to others, Vecchi says "there's not a whole lot you can do to plan except be ready for an onslaught. We're holding our breath to see what DHS is going to tell us has to happen."
The May 2008 REAL ID deadline may be less than a year away, but no one knows exactly what the rules will say. States were alarmed at what they saw as unrealistic timetables, unreasonable demands and huge costs contained in the proposed regulations issued in March. The rules were open to comment until early last month. DHS promises that its final regulations will address questions, complaints and suggestions received during the open comment period and, says Russ Knocke, a DHS spokesman, "provide the way forward for implementation of an absolutely vital initiative."
Knocke considers it vital because of terrorists' misuse of state driver's licenses to board airplanes before the September 11, 2001, hijackings. Admitting that REAL ID may be burdensome, Knocke notes that "there is a known vulnerability with state-issued driver's licenses. Shame on us if we don't take steps to fix it."
Early in the REAL ID process, DHS contacted some state officials so it could run proposals past them as they were being finalized. The department was not expecting the response it got. "The greeting that these proposals received was like something you'd see at Lexington and Concord," says Maine's Dunlap, who was one of the contacted officials. "Not surprisingly, after that the Department of Homeland Security went on radio silence."
But the states are speaking out. In addition to the two that have taken a stand by statutes, Maine and more than 30 other states have passed or are considering bills to protest REAL ID.
Knocke calls non-compliance a bad decision - not only in anti-terrorist terms but as an inconvenience to residents who will have to find another sanctioned ID in order to board planes. One sanctioned ID is a passport. And this is where some DMV officials get really ticked off. While the federal government is demanding hyper-security for state licenses, it doesn't apply the same rule to federally issued passports.
Most people view the U.S. passport as the gold standard for security, but the passport office is not required to verify all state birth certificates. Even if a person applying for a passport can't provide proper identity documents, such as a previous passport or government ID, that person can appear with a witness to corroborate identification. Moreover, passports can be issued in any name as long as someone submits public records to establish the exclusive use of an assumed name for a long period of time. As one DMV expert put it, "If you've been living as Minnie Mouse for the past five years, you can get a passport in the name of Minnie Mouse."
States could not do the same under REAL ID. DMV administrators say they'd have to turn away a person without proper documents. "There's debate whether a passport is any more verifiable than a Sam's card," says Dunlap, referring to the bulk warehouse shopping chain. He calls the security weaknesses in passports and other federal documents a "huge hole" that no one's addressing. "The idea that we're going to solve the problem with state driver's licenses is a fantasy that leaves all these things unaddressed."
Federal officials have told DMVs that a passport is only a travel document, not a national ID. But security personnel use it to let people on airplanes under the assumption that it is a secure identity document. "Fine," Vecchi says, "but don't say the passport is the premier identity document, then beat me up for having higher standards and not wanting to use it." Her DMV's problem is that when it turns customers down because they don't have the documents the state demands, "they come back with a passport. Then a passport with a different name." When DMV employees ask for a second document, in addition to a passport, people, she says, "go nuts."
There are many problems with the proposed rules, starting with an unrealistic deadline. States seeking an extension have until February 2008 to do so. It would give them until January 1, 2010, to start issuing compliant licenses. By spring 2013, all licenses in states doing REAL ID need to be compliant.
The catch is, states that start on time have five years to complete the task, but those that start later don't get extra time to finish. The final deadline of 2013 remains the same for all. "We're rushing into something that can't be done," says D.B. Smit, commissioner of Virginia's DMV. "It's scary."
Another problem is the technology. It's not ready for prime time. If someone moves to Virginia, for instance, and comes to its DMV with a license from her former home state, Virginia has no way to check if the out-of-state license is legitimate. "Someone's got to tell me how to do that," Smit says. "We're not arguing whether we should improve security. If the Department of Homeland Security has a better mousetrap, we're willing to use it."
DHS officials are more positive. They see it as a matter of developing rules for data exchange for state-to-state queries.
But there also are in-state documents DMVs may be asked to validate. Drivers can corroborate their residency now with utility or phone bills that have their home address on them. To verify those electronically, a state would have to surf the databases of power and telephone companies, which are unlikely to allow state snooping. "They're saying, 'Not so fast, my friend,' " Smit says.
Along with those problems, REAL ID interferes with carefully developed funding cycles for DMVs. The number of DMV locations, employees and IT resources are based on the number of years in license renewal cycles. Twenty-four states now have renewal periods longer than five years. REAL ID telescopes that cycle to five. States are flinching at the predicted hardships in complying. Under the proposed rules, nearly 30 million additional people would show up at DMV offices over the next five years. DMV workloads would increase by 132 percent on average.
Virginia figures REAL ID would bring an additional 250,000 people into each of its 73 DMV service centers. "It would pretty much break the seams," Smit says, affecting transaction times and adding more stress on centers.
To ready his agency for REAL ID, Smit plans to move as much non-licensing work out of customer service centers as possible. For instance, some auto dealers currently bundle a day or two of car-buying paperwork and stand in line with everyone else. When they get to the counter, they do 15 transactions at once. Smit has been meeting with auto dealers asking them to use online services or go to franchises known as DMV Selects, which can issue titles, registrations and handicapped placards. "I'm telling them, 'We love you very much, but we don't want you in our service centers.' "
Smit invited an official from DHS to come across the river to Virginia so he could try to make him understand why REAL ID demands are so hard to meet. "The people across the Potomac think it can be worked out easily," he says. "We can't get them to understand. It's frustrating."
Maybe a light bulb would go on if federal officials took a look at the logjam the passport office faces each spring when the number of applications picks up as people get ready for overseas vacations. At these busy times, passport offices deal with several million more people than usual and use a well-tested system. States would be faced with re-licensing 245 million people in five years, all of whom would have to show up in person.
Right now, Dunlap sees Maine's non-REAL ID driver's license as being as secure as a passport, perhaps more so. The problem is that non-compliant licenses will create hassles for residents trying to get through airport security gates after REAL ID goes into effect. "That's one of the great dichotomies," Dunlap says. "Your less-secure passport will be just fine."