Abstract: In order to enhance national security by reducing identification fraud, Congress passed the REAL ID Act in 2005, calling on all 50 states to meet minimum security standards for issuing driver’s licenses and state IDs. Seven years after passage of the act, and after two deadline extensions, the majority of states are still not in full compliance with REAL ID standards. REAL ID provides a commonsense solution to preventing terrorist travel and identity fraud. The 9/11 Commission recommended that the federal government enact national standards for identification eight years ago. Yet many states still lag behind the threshold for secure driver’s licenses that Congress requested in the REAL ID Act. The latest deadline is fast approaching on January 15, 2013, and this time, the Department of Homeland Security should enforce it.

In 2005, Congress passed the REAL ID Act, calling on the states to meet minimum security standards for issuing driver’s licenses in order to enhance national security and reduce fraud. The passage of the act followed the recommendations of the National Commission on Terrorist Attacks Upon the United States (the 9/11 Commission) to standardize secure identification in light of the fact that 18 of the 9/11 hijackers had a total of 30 driver’s licenses and state IDs between them, six of which were used to board planes on the morning of the attack.[1] Now, more than seven years after the passage of the act, following two extensions by the Obama Administration, the third REAL ID full-compliance deadline is once again quickly approaching.

While opponents of the law have long argued that the REAL ID requirements were unrealistic and unachievable, as of February 2012, 21 U.S. states and territories had committed to achieving material compliance with the law by January 15, 2013.[2] Moving forward, the Department of Homeland Security (DHS) should maintain and enforce the January 15 full-compliance deadline, while also providing the states with clear guidance for meeting REAL ID standards. The states and Administration should also work together to enhance state-to-state identity verification efforts and increase the use of facial recognition technology. DHS must also expand other efforts to halt terrorist travel.

The 9/11 Commission and the History of REAL ID

On July 22, 2004, the 9/11 Commission released its final report, which contained 41 recommendations to enhance the security of the United States. Among them:

Secure identification should begin in the United States. The federal government should set standards for the issuance of birth certificates and sources of identification, such as driver’s licenses. Fraud in identification documents is no longer just a problem of theft. At many entry points to vulnerable facilities, including gates for boarding aircraft, sources of identification are the last opportunity to ensure that people are who they say they are and to check whether they are terrorists.[3]

The recommendation to enhance identification security stemmed from information later highlighted in the Commission staff report “9/11 and Terrorist Travel.” The staff report detailed the ease with which the 19 hijackers obtained visas and gained entry to the United States. The report also explained how 18 of the 19 hijackers had held a total of 17 driver’s licenses and 13 state-issued IDs between them, seven of which had been obtained fraudulently from Virginia, and six of which were used by the hijackers to board planes the morning of the attack.[4] As 9/11 Commission staff member Janice Kephart explained:

The hijackers’ acquisition of driver’s licenses and identification cards was clearly part of the hijackers’ overall travel strategy that included fraud in every aspect of their travel…. [T]hese identifications allowed them to move freely around the country to meet, plan, and case targets, open bank accounts, rent cars, take flying lessons, and ultimately, board the airplanes on 9/11.[5]

In 2004, in response to the commission’s findings and recommendations, the American Association of Motor Vehicle Administrators (AAMVA) published its AAMVA DL/ID Security Framework.[6] This document proposed “minimum standards of security, interoperability, and reciprocity” for all of North America’s Motor Vehicle Administrations (MVAs) in order to reduce driver’s license and identification fraud and enhance security. The AAMVA framework recognized that driver’s license and ID fraud can result in loss of life due to unsafe drivers on the road; identity theft; fraudulently obtained government benefits or jobs; and other economic and social loss due to criminal activity. The basic tenets of this framework, produced by a special AAMVA task force with input from federal agencies and association members, would become the foundation for the REAL ID standards.

Secure Identification Standards

With these considerations in mind, Congress passed the REAL ID Act as part of the Emergency Supplemental Appropriation for Defense, the Global War on Terror, and Tsunami Relief in May 2005.[7] While opponents have claimed that the REAL ID Act creates a national ID, in reality, REAL ID merely sets voluntary ID security standards. States may elect not to pursue REAL ID standards. Further, these standards are only mandatory in order for a state driver’s license or ID to be recognized for “official purposes,” such as boarding a commercial aircraft or entering a federal building.

In January 2008, DHS issued the REAL ID final rule detailing the full standards to be met by the states in order to achieve full compliance with the law. These standards include:

• Facial image capture. REAL ID standards call for states to capture a facial image for everyone who applies for an ID or driver’s license. States are to retain the image, even if the applicant is denied a license. Before REAL ID was enacted, some states required facial image capture only for those who were ultimately issued ID cards or licenses. In order to comply with the law, a photo is to be taken at the beginning of the application process. Facial recognition can help ensure that an individual does not obtain more than one license under different names, particularly for license renewals, and is one of the best lines of defense against imposter fraud in cases where someone attempts to steal an individual’s complete identity.
• Document authenticity. States can only issue REAL ID-compliant licenses after they receive valid documentation that establishes an applicant’s date of birth, Social Security number, proof of residence, and citizenship or lawful status. An applicant’s Social Security number is also verified through the Social Security Administration’s Social Security On-Line Verification (SSOLV) system. MVA employees who handle source documents (such as birth certificates and Social Security cards) or issue IDs are to complete an approved fraudulent document recognition and security awareness training course.
• Data sharing. REAL ID calls for the creation of a network to share MVA data between the states in order to ensure that a driver’s license applicant does not hold multiple licenses from multiple states. This standard would simply extend what many states are already voluntarily doing with regards to sharing information on commercial licenses or problem drivers.
• Card security. Compliant licenses must contain measures that can meet three levels of security standards, in order to prevent tampering, counterfeit, and fraud. Each compliant driver’s license or ID is to be marked with a DHS-approved security marking (generally a gold star). Noncompliant IDs are also to state on the card that they are not acceptable for official federal purposes.
• Issuer integrity. REAL ID also aims to maintain security within an ID issuing agency. States are to conduct a name-based and fingerprint-based criminal history and employment eligibility check for certain employees who work for ID-issuing agencies. To protect privacy, states are also to submit a security plan to DHS for approval. Plans must meet certain minimum standards, such as established procedures to prevent unauthorized access, use, or dissemination of applicant information. Cards may either be issued through a secure over-the-counter process at local MVAs, or by mail from a central location.
• Lawful Status. MVAs are to verify a non-citizen applicant’s lawful status through DHS’s Systematic Alien Verification for Entitlements (SAVE) system. States can issue temporary or limited licenses to individuals with temporary lawful status limited to duration of stay. In the case of an individual with temporary lawful status of an unspecified length, the duration of a license is limited to one year.[8]

REAL ID Realities

Since its passage in 2005, the REAL ID Act has been highly contested among state leaders and advocacy groups, such as the American Civil Liberties Union (ACLU). Opponents have argued that REAL ID constitutes an unfunded mandate and violates state rights under the Tenth Amendment.[9] Drawing on these concerns, in January 2007, Maine became the first state to pass a bill in opposition to the REAL ID Act.[10] The bill stated that Maine is not allowed to participate in the federal REAL ID Act of 2005, and that no changes may be made to the state’s driver’s license process designed to conform with the federal law[11] Since then, several other states have followed suit. According to the National Conference of State Legislatures, as of June 2012, 17 states had similar laws on the books.[12] Yet, while opposition and criticism to the REAL ID Act continues, these concerns appear largely based on perpetuated myths and misinterpretations of the act.

REAL ID Is Not an Unfunded Mandate. A little over a year after the passage of the REAL ID Act, the AAMVA together with the National Governors Association and the National Conference of State Legislatures released an analysis of the national impact of the act.[13] The report asserted that REAL ID would cost the states more than $11 billion to implement over five years and would reduce efficiencies and increase wait times at state MVAs. While cited by many as evidence of an unfair burden on the states, the accuracy of these figures has been disputed. Indeed, in their final rule-making, DHS estimated that implementation of REAL ID would actually cost approximately $3.9 billion over 11 years.[14] In order to help offset some of these costs, from fiscal year (FY) 2008 through FY 2011, DHS issued approximately $200 million in federal grant money to U.S. states and territories to assist in implementation and compliance.[15]

Additionally, approximately $63 million has been awarded through various grants between FY 2008 and FY 2011 to the five states— Florida, Indiana, Kentucky, Mississippi, and Nevada—that are leaders in upgrading and testing the communication and verification systems needed for states to meet REAL ID requirements, including those needed for cross-state information sharing and fraud checks.[16] U.S. Citizenship and Immigration Services has also awarded nearly $10 million to states for projects related to the verification of lawful status, U.S. passports, and Social Security numbers.[17]

REAL ID Does Not Create a National ID Card or Federal Database. REAL ID sets national security standards for driver’s licenses and identification. Nothing in the REAL ID Act requires that states participate or that individuals carry their license or ID on them at all times. Rather, as of January 15, 2013, identifications from non-compliant states will not be accepted for official purposes. Further, compliant states need not meet all REAL ID standards in exactly the same manner, such as physical security measures at MVAs or document security features for ID issuance. REAL ID-compliant states remain able to issue other non-compliant licenses and identifications for non-official use.

REAL ID also does not require the creation of any new databases. Rather, the REAL ID Act calls for states to link existing databases into a broader network to allow a state to query other states’ records to ensure that people are not able to receive more than one license in different states and to reduce identity theft and fraud. Preliminary state-to-state verification, or cross-state data sharing, is currently being tested and developed by a consortium of five states led by Mississippi. This state-to-state verification system is to be:

• Voluntary and open to all states,
• Limited to checking if an individual has another license or ID in another state,
• Built on existing state information systems, and
• Financed and governed by the states once fully operational.[18 ]

Design of the system is currently expected to be completed by 2013 with a pilot to be conducted in 2015.[19]

Similarly, states may also query federal databases, specifically the Social Security Administration’s SSOLV and DHS’s Systematic Alien Verification for Entitlements (SAVE); however, these queries are separate from any network for cross-state data sharing. States can query the SSOLV in order to determine that an applicant has presented a valid Social Security number (SSN), that the SSN is not associated with a deceased individual, and that an individual’s name and date of birth match the SSN presented. Even states that have passed legislation prohibiting REAL ID compliance verify applicant data through SSOLV. States may also query DHS’s SAVE to confirm a non-citizen’s lawful status in the United States.[20]

REAL ID Does Reduce Fraud and Identity Theft. REAL ID security measures, such as state-to-state data sharing, identity verification, and facial recognition help to protect privacy by decreasing fraud and identity theft. Increased security measures at MVAs and background checks of MVA employees are also important factors in reducing identity theft and fraud.

In 2010, roughly 7 percent of American households experienced at least one type of identity theft, resulting in a total cost of about $37 billion to the affected individuals.[21] Of the identity theft cases reported in 2010 to the Consumer Sentinel Network (CSN), a secure consumer-complaint database maintained by the Federal Trade Commission, government documents and benefits fraud was the most common form of identity theft. These instances of fraud made up 19 percent of all reported cases, and these are just the cases that were actually reported.[22]

While only approximately 1 percent of all cases reported to the CSN are estimated to be directly related to driver’s license forgery or fraud, states have cited REAL ID compliance in helping to identify numerous cases of fraud and identity theft that may have otherwise gone undetected. Two good examples of the benefits of facial recognition in identifying fraud, for example, were illustrated by the Government Accountability Office (GAO) in a recent report:

In one state we [GAO] visited, licensing agency employees were issuing licenses to individuals using real identities of other people for payments of $7,500 to $12,500 a piece. As part of the scheme, these employees provided their customers with legitimate identity documents belonging to other people, such as Social Security cards and birth certificates. Facial recognition successfully identified that the individuals who had paid for the fraudulent licenses had already received other identification documents from the state and therefore had photos in the state’s database. In another example from the same state, according to state officials, a foreign national who these officials identified as being on the “no-fly” list had obtained licenses under four different identities. This individual had been deported from the United States multiple times, and each time was able to re-enter the country under a different identity. Using facial recognition software, the state was able to detect him by comparing the photos associated with the different licenses.[23]

Similarly, through its document authentication provisions, REAL ID may further help to detect fraud and identity theft related to other government documents, specifically source documents used by individuals to obtain driver’s licenses and other state-issued identification cards.

Administrative Soft-Pedaling and Compliance Extensions

The REAL ID Act initially set the deadline for full compliance with REAL ID standards for May 11, 2008. However, with the final REAL ID regulations issued by DHS a mere four months before the statutory compliance date, full compliance was extended until May 11, 2011.[24]

Cognizant of the new 2011 deadline, many states continued to move forward with REAL ID compliance. In June 2009, however, Congress introduced the Providing for Additional Security in States’ Identification Act of 2009 (PASS ID Act). The act would have repealed the REAL ID Act of 2005, rolling back efforts to enhance driver’s license and ID security. Not surprisingly, many opponents of the REAL ID Act put their support behind the PASS ID Act, heralding it as the solution to supposed REAL ID privacy and cost concerns.[25]

Critical to the fate of REAL ID, the ranks of PASS ID supporters also included Homeland Security Secretary Janet Napolitano. Testifying before Congress in July 2009, Secretary Napolitano stated:

PASS ID is a critical piece of national security legislation that will fix the REAL ID Act of 2005 and institute strong security standards for government-issued identification. PASS ID will fulfill a key recommendation of the 9/11 Commission, that the federal government set standards for identification such as driver’s licenses and non-driver identification cards—and this bill will do so in a way that states will implement, rather than disregard…. [C]ritically, this bill provides a workable way to get there.[26]

Lacking the support of the Obama Administration and with questions about whether REAL ID would still be on the books in the near term, progress toward REAL ID compliance was essentially put on hold. By March 2011, however, it had become clear that PASS ID no longer had the support it needed in Congress and was dead. Nevertheless, without request for comment, the Department of Homeland Security once again extended the REAL ID compliance date. Under current regulation, the REAL ID full compliance deadline is now January 15, 2013.

After this deadline, licenses from non-complaint states are no longer to be accepted for official purposes; compliant states, however, are able to complete issuing new licenses in a phased approach. By December 1, 2014, states are to issue new, compliant licenses to all individuals born after December 1, 1964. States then have until December 1, 2017, to issue new licenses for all individuals born before December 1, 1964.[27]

State Progress and Implementation

Despite the uncertainty caused by congressional consideration of the PASS ID Act, REAL ID implementation was anything but “disregarded."[28] According to DHS, as of February 2012, 21 states and territories had committed to meet the 18 REAL ID material compliance benchmarks by January 15, 2013. DHS also indicated that an additional five states had committed to achieving the 18 benchmarks, but do not believe they would be able to do so by January 15, 2013.[29]

The concept of material compliance was a metric created by the REAL ID final rule to measure state progress in implementing REAL ID. In order to aid in determining material compliance, DHS published a list of 18 benchmarks for states to meet (see Appendix). In DHS’s own words, the material compliance benchmarks “focused on measures that produced the greatest gain in security in the shortest period of time and at reasonable costs."[30] These metrics include facial image capture, card security measures, verification of lawful status, issuer-integrity standards, and document verification, and are intended to serve as a general picture of how states are progressing with REAL ID implementation.

While states are required by law to achieve full compliance with the REAL ID Act—meeting not just the 18 benchmarks, but all requirements of the law—by January 15, 2013, in order for their licenses to be recognized for federal purposes, fewer data are available about state progress toward full compliance. DHS has, thus, largely relied on data on material compliance to measure progress toward the January 15 deadline, despite the fact that such data only indicate progress toward a portion of the full standards required by the REAL ID Act. As of April 2012, DHS reports that it had received documentation of full compliance for certification from six states—Connecticut, Delaware, Maryland, South Dakota, Tennessee, and Wyoming.[31]

While the statutory deadline to submit full-compliance packages officially passed on October 15, 2012, DHS has indicated that it will likely be a soft deadline, and anticipates that more states will submit packages before January 15, 2013.

Remaining Resistance and Challenges

On October 5, 2012, New Jersey officials agreed to drop requirements that would have made driver’s licenses materially compliant with REAL ID. This action came after a judge ruled in favor of an ACLU objection to how the New Jersey Motor Vehicle Commission (MVC) proceeded in altering its licensing systems. The ACLU argued that the MVC improperly tried to impose REAL ID–compliant standards without publishing details or seeking public comment.[37]

With the REAL ID full-compliance deadline quickly approaching, New Jersey unfortunately is not the only state in the country that is likely to fail to meet the deadline. For instance, advocacy groups in Oklahoma have advised potential travelers to obtain a passport for use for official purposes because they do not believe the state will be compliant with REAL ID by the January 15, 2013, deadline.[38] In Alaska, MVA employees were giving drivers similar advice.[39] In New Mexico, failure to advance with REAL ID compliance has lead to critical challenges for the state.

Despite local nongovernmental organizations (NGOs) and agencies telling citizens to prepare for REAL ID enforcement, the question remains whether DHS will hold to the requirement to have fully REAL ID–compliant licenses to board airplanes or enter federal buildings come January 2013. As DHS reacts to the possibility that some states may not reach full compliance by January, it may consider taking one of two steps to prevent the burden that not having a compliant license will place on air travelers. DHS may (1) extend the full-compliance deadline again or (2) declare that licenses from all states that have made progress toward, or achieved all material compliance standards, will be accepted for federal purposes regardless of statutory requirements.

Even though DHS has announced that it will not extend the January 15, 2013, compliance deadline, it has not audited state compliance, nor has it sought to motivate states that are lagging behind to expedite their efforts.[47] DHS has also failed to release pass-or-fail criteria that would allow states to evaluate their security processes.

In a recent investigation, GAO auditors were able to acquire licenses in three states by using fake birth certificates. The auditors blamed DHS for not proactively addressing remaining security vulnerabilities in the license issuing processes. GAO stated that “without guidance and encouragement from DHS, states and other agencies may be less likely to coordinate in pursuit of these opportunities."[48] DHS, however, rejected GAO’s assessment, arguing that states are free to coordinate with one another.[49] However, the fact that some states are not certain about what minimum standards they must meet in order to comply with REAL ID demonstrates that DHS should play a more active role in helping states prepare for January.

Another key challenge is the fact that certain systems that will foster state-to-state cooperation are not yet fully operational. The development of the state-to-state verification, or cross-state data sharing, system, led by Mississippi, is still in the preliminary stages of development and may not be fully online until 2023.[50] Further, the failure of many states to link to the Electronic Verification of Vital Events (EVVE) system remains as another critical challenge in REAL ID implementation.

REAL ID requires that states verify birth certificates in order for an applicant to receive a driver’s license. In 2000, the U.S. Department of Health and Human Services’ Office of the Inspector General produced a study showing that 6,422 state and local agencies issued birth certificates. At the time the study was conducted there were over 14,000 different kinds of birth certificates in circulation.[51] Additionally, as many as 15 states have little to no restrictions on who can obtain a birth certificate from a vital records agency.[52] This decentralized issuing process makes it difficult for DMV employees to efficiently and accurately verify birth certificates, and increases the ease by which individuals can obtain or produce fraudulent birth certificates.

EVVE is the result of collaboration between the Social Security Administration and the National Association for Public Health Statistics and Information Systems (NAPHSIS). Through EVVE, state and federal agencies can electronically query all participating vital records agencies to verify the contents of a paper birth certificate through a single interface. Querying agencies simply receive a message from the EVVE system indicating whether a query was a match, or whether a record is marked as deceased. As of August 2012, 47 of the nation’s 57 vital records agencies were online with EVVE for birth certificate queries, and two were in the process of coming online.[53] However, at present, no state MVA has begun using the system, in part due to cost concerns.[54]

The Future of REAL ID

More than seven years ago, the 9/11 Commission called upon the Department of Homeland Security and the states to ensure the security of driver’s licenses and IDs throughout the U.S. With the deadline for full compliance with the REAL ID Act quickly approaching, while the states and their federal partners have made great progress, more remains to be done to ensure that state licenses are not exploited for fraud and abuse. In order to fully meet the recommendations of the 9/11 Commission, the Department of Homeland Security and the states should:

• Maintain and enforce full-compliance requirements. According to the latest information available from the Department of Homeland Security, only six states have submitted packages indicating full-compliance with REAL ID. Despite this fact, DHS should not waver on the REAL ID January 15, 2013, full-compliance deadline and enforce the statutory requirement to have REAL ID–compliant licenses for official purposes. With two extensions already, states have been given time and opportunity to comply. Congress could push implementation along further by holding the Administration accountable for meeting its own implementation deadlines.
• Provide clear guidance on REAL ID criteria. A critical challenge, continually communicated by the states, in achieving REAL ID compliance has been the lack of clear guidance on what is expected of them in meeting REAL ID standards. DHS should, therefore, establish clear pass-or-fail criteria to allow states to evaluate their progress in meeting the act’s ID security criteria. Without such guidance and criteria, states will continue to lack the ability to determine if they are truly on track to meet the full-compliance standards.
• Enhance state-to-state verification efforts. One of the critical requirements of the REAL ID Act is for states to make reasonable efforts to ensure that an applicant does not already hold a driver’s license or ID in a different state. In order to meet this standard, the act calls for the creation of a network to share MVA data between the states. With the support of DHS, Mississippi has led a coalition of five states in developing this state-to-state verification and communication system. The development of these systems, however, remains incomplete, making it impossible for states to truly meet the requirements of the REAL ID Act in their entirety. In the absence of these systems, DHS should provide states with guidance on acceptable alternative measures. Greater effort must also be made to encourage state MVAs to verify applicants’ birth certificates through the EVVE system, and for vital records agencies to clean up and further digitize records.
• Increase the use of facial recognition. One of the most important tools for ensuring that an individual does not have another driver’s license under a different identity is the use of facial recognition technology. According to the GAO, 41 states plus the District of Columbia were using facial recognition and other biometric techniques as of August 2012.[55] Given the importance of facial recognition in preventing fraud and identity theft, DHS should encourage more states to adopt this technology.
• Expand other efforts to halt terrorist travel. In addition to ensuring that terrorists cannot obtain fraudulent driver’s licenses and IDs, Congress and the Administration should halt terrorist travel by expanding the Federal Flight Deck Officers program, which certifies firearms-trained volunteer pilots as a last line of defense against would-be hijackers and terrorists, and strengthening the deployment of Secure Flight, a program to screen flight passenger data and flag possible terrorists before they board a commercial airplane. Other important efforts include expanding the Visa Waiver Program and ending the 100 percent visa interview requirement to allow State Department officials to focus their attention on those potential travelers who truly pose a risk to the United States.

Halting Terrorist Travel and Fraud

REAL ID provides a commonsense solution to preventing terrorist travel and identity fraud. The 9/11 Commission recommended that the federal government enact national standards for identification eight years ago. Yet many states still lag behind the threshold for secure driver’s licenses that Congress called for when it enacted REAL ID. On January 15, 2013, DHS should enforce the full-compliance deadline, while also improving its efforts to guide states that are struggling to reach compliance with the law.

—Jessica Zuckerman is a Research Associate in the Douglas and Sarah Allison Center for Foreign Policy Studies, a division of the Kathryn and Shelby Cullom Davis Institute for International Studies, at The Heritage Foundation. The author is grateful to Research Assistant David Inserra for his help in preparing this study.

Appendix

Material Compliance Benchmarks.[56]

1. Subject each applicant to a mandatory facial image capture and retain such image even if a driver’s license (DL) or identification card (ID) is not issued.
2. Require each applicant to sign a declaration under penalty of perjury that the information presented is true and correct, and retain this declaration.
3. Require an individual to present at least one of the source documents listed in subsections 37.11 (c)(1)(i) through (x) when establishing identity.
4. Require documentation of:

• Date of birth
• Address of principal residence
• Social Security number
• Evidence of lawful status

• Full legal name
• Address of principal residence
• Date of birth
• Signature [with exceptions]
• Gender
• Date of transaction
• Unique DL/ID number
• Expiration date
• Full facial digital photograph
• State or territory of issuance

*Requirement superseded by indefinite stay of material compliance deadline.