REAL ID Act — Federal Security Standards for Identification Documents

In the United States, there hasn’t been federal security standards set for driver’s licenses and identity cards being issued by each state, creating opportunities for fake IDs and identity theft. Enacted in 2005, The REAL ID Act (Real ID) sets federal standards for driver’s licenses and identification cards from states in an effort to make securing fake IDs more difficult.

Fraudulent and forged identity documents are a national security risk, making Real IDs the last line of defense for air transport safety. Real ID came about as a result of the 9/11 Commission and the Transportation Security Administration (TSA) will enforce Real ID for all passengers going through security checkpoints at commercial airports in the United States.

Real ID has a four-phase roll-out. The first three are targeted for secure federal facilities and thus have no wide-spread implications. However, the fourth phase involves boarding federally regulated commercial aircraft therefore affecting huge numbers of people; in 2017 there were 217 million enplaned passengers on U.S. domestic flights and while not all were U.S. citizens, anyway you look at it, that’s a lot of people.

As of “January 22, 2018, passengers who have driver’s licenses issued by a state that is not yet compliant with REAL ID and that has not received an extension will need to show an alternative form of acceptable identification for domestic air travel.”

However, at this time all U.S. states are either compliant or have an extension. According to the New York Times, “26 states and territories have been granted extensions until Oct. 10, 2018” to file another extension. The article goes on to state that “in past years, the agency has provided a grace period for approximately 90 days before enforcement would begin” so if no extensions are filed, Real ID will be required by early January 2019. By October 1, 2020 all U.S. domestic travelers will require a Real ID-compliant driver’s license or alternate acceptable identification.

Real ID and Privacy

In regards to privacy, Real ID does not collect information at the federal level and is not a mandatory requirement for states. Rather, each state is responsible for collecting and managing identity information and issuing ID documents. The Department of Homeland Security (DHS), which has responsibility for the program, is there to help states with technical standards, implementation and certify compliance.

Also note, Real ID is not required in other situations such as for voting, registering to vote or applying for federal benefits. And as a U.S. passport is an acceptable document for air travel, a Real ID license is not a mandatory requirement for most U.S. citizens.

While not mandatory for states or for individuals, the fact of the matter is that a driver’s license or state-issued ID is the primary form of ID used in the U.S. As of 2016, there were about 222 million licensed drivers in the U.S. while the adult population is about 249 million.

Therefore, improving security and trustworthiness of state-issued ID is a “key enabler of public and commercial life.” It’s not only about improving air travel security, although that was a major impetus for the act.

Now, state-issued ID serves multiple purposes including:

• Identity verification
• Age verification
• Address verification

Their value is demonstrable by the fact of how much forgeries of these documents are in-demand; effective forgeries could be used to open up accounts, create false identities, bypass security procedures and other nefarious acts.

Improving security, decreasing fraud and ensuring ID documents are a reliable source of identity information is of value to every state and citizen. Implementation of federal guidelines have not met substantial resistance from the states themselves, regardless of the cost and efforts to become compliant. Quoted in the Times article Steve Yonkers, the director of the Real ID program for the privacygoverDepartment of Homeland Security, states “every state is working on getting compliant with all Real ID requirements.”

Real ID Requirements

To become compliant with Real ID, states must enact certain policies and procedures to ensure their programs follow safe practices and have sufficient technology to meet modern requirements.

State officials who handle ID, such as DMV employees, must pass a background check. They must also go through training to spot forged documents. States must “ensure the physical security of locations where drivers’ licenses and identification cards are produced, and the security of document materials and papers from which drivers’ licenses and identification cards are produced.”

Where available, DMVs must use electronic verification of source documents, make copies of those documents and make their ID database available to other DMVs.

The ID must be machine readable, entailing a 2-D barcode with the following information:

(a) Expiration date

(b) Full legal name, as recorded pursuant to § 37.17(a) of the rule

(c) Date of transaction

(d) Date of birth

(e) Gender

(f) Address as listed on the card pursuant to § 37.17(f) of the rule

(g) Unique drivers’ license or identification card number

(h) Card design revision date, indicating the most recent change or modification to the visible

format of the drivers’ license or identification card

(i) Inventory control number of the physical document

(j) State or territory of issuance

Another requirement is that the ID must have security features. These are designed to “prevent tampering, counterfeiting, or duplication of the driver’s licenses and identification cards for fraudulent purposes.” As opposed to prescriptive rules, this requirement is performance based. One example of a commonly used security feature is a hologram.

National ID Programs

An estimated 3.6 billion people will have a national eID card by 2021. Digital identity frameworks have great promises of improvements to usability, accessibility, security, privacy, fraud prevention and risk management.

However, consolidating citizen identity data in one system has many privacy advocates deeply concerned. There are also complex jurisdictional considerations between different levels of government; states currently are in charge of issuing driver’s licenses and identification cards and any attempt to change the status quo will entail a complex political battle.

It’s been 13 years since Real ID was enacted. Specific requirements have been set by DHS. Now, the onus is on the states to meet the standards if they want their citizens to be able to travel domestically using their primary ID.