Real ID raises gold-star privacy issues

The state Division of Motor Vehicles is changing its driver’s license system to conform with the federal Real ID Act, a national security measure that has been criticized on privacy grounds, by the end of 2017.

North Carolina drivers will get to make their own decisions about whether to comply.

Congress passed the 2005 law in response to the 9/11 terrorist attacks. It’s aimed at verifying the identity of anybody who seeks to board a commercial airliner or enter a federal building or nuclear power plant.

To meet Real ID requirements, DMV will ask most of the state’s 9 million licensed drivers to bring in their birth certificates, Social Security cards or other identity documents, so state officials can scan them and save copies.

Privacy advocates and some state legislatures have argued in recent years that Real ID will turn state driver’s licenses into uniform identity cards – linked in a big new database, shared by all the states, with personal information that could be exploited by hackers and criminals.

“In summary, it’s a national ID system,” said Jim Harper, a senior fellow at the Cato Institute, a libertarian think tank in Washington, D.C. “Everyone in your state will be at risk of identity fraud.”

North Carolinians who permit DMV to keep their digitized documents eventually will receive IDs or driver’s licenses marked with a gold star.

For those who refuse to comply, the new licenses will be labeled “NOT FOR FEDERAL IDENTIFICATION.” In that case, drivers will have to carry U.S. passports or other federally approved IDs when they want to fly. That’s a federal requirement.

“As much as I think everybody in the state ought to get a Real ID-compliant identification, it’s technically up to the citizen whether they want one,” Kelly J. Thomas, the state motor vehicles commissioner, said in an interview. “There are a lot of citizens that will opt out.”

Two years to comply

The federal government took steps this month to begin enforcing Real ID. Fort Bragg and other military installations stopped accepting driver’s licenses and ID cards issued by five states – Illinois, Minnesota, Missouri, New Mexico and Washington – as proof of identity for civilian visitors.

And starting in January 2018, Homeland Security Secretary Jeh Johnson said, air travelers will not be allowed to board domestic flights using licenses from these and other states that do not meet Real ID standards or have not shown progress toward complying with the law.

“Given today’s threat environment, this requirement is as relevant now as it was when the 9/11 Commission recommended it,” Johnson said on Jan. 8. Homeland Security officials declined last week to speak with a reporter or to answer questions about Real ID.

Twenty-three states have been declared compliant with Real ID. North Carolina is one of 27 states and territories granted year-to-year extensions that will expire, unless Homeland Security renews them, in October.

Real ID was a thorny issue in many states after Congress adopted the law in 2005. By 2010, more than 25 state legislatures had passed laws criticizing or refusing to comply with the law. One North Carolina House member proposed a similar measure in 2007, but it died in committee.

In South Carolina, state lawmakers have said that they don’t intend to comply with the Real ID Act, even though they are among the states with a federal extension.

Beth Parks, spokeswoman for the S.C. Department of Motor Vehicles, said the state has met many of the Real ID Act’s requirements. But South Carolina doesn’t comply with the federal rule that licenses be renewed every eight years, she said. South Carolina lets motorists keep their licenses for 10 years.

“It might not seem like a huge thing, but it is a huge thing,” Parks said.

After military bases snubbed five states’ ID cards last week, leaders in a few of the states said they were reconsidering the issue. Several North Carolina legislators did not respond to requests for comment.

North Carolina and other states have quietly made changes in recent years to comply with Real ID standards. DMV gives drivers a high-tech, puportedly tamper-proof license that is designed to thwart counterfeiters.

And before your new license is sent out in the mail, DMV workers check your papers, confirm your Social Security number and scrutinize your photo to make sure you are truly you. Hundreds of employees who handle licenses and ID cards have been fingerprinted, background-checked and trained in recognizing phony documents.

So how can your ID get any more real than this? This is where your personal records come in.

Bring in your papers

North Carolina’s DMV requires new drivers to provide proof of their identity, address, Social Security number and legal status in the United States. Although state workers check the tax documents, Social Security cards, birth certificates and other papers provided by applicants for ID cards and licenses, DMV does not keep copies on file.

That’s about to change.

In an Oct. 22 letter to Thomas approving another one-year extension for complying with Real ID, Homeland Security credited North Carolina with making progress and spelled out steps that still must be taken.

To win its gold star, DMV will be required to start archiving digital copies of North Carolinians’ personal identity documents. And, just as the states now do for truckers with commercial driver’s licenses, DMV will put all North Carolina drivers’ records into an online database shared with the motor vehicle agencies of other states.

“So if you came in from another state, I would be able to verify – almost as you were standing in front of me – your driving record from Hawaii,” Thomas said. “Today we do that behind the scenes. We spend 24 or 48 hours verifying your documents with other agencies.”

Harper, the Cato Institute researcher, warns that this new national drivers’ database will only be as secure as its weakest link. A hacker or a corrupt official in any state could put an entire state’s database at risk, he said.

“Those documents would be available on the black market to bad folks,” Harper said.

Real ID licenses also will include a bar code on the back that contains all of the personal details listed on the front. Harper knows of a tavern in Washington, D.C., that scans patrons’ licenses just to confirm that they are of legal drinking age.

“You might have to start swiping your card when you enter a government building, cash a check or pick up a prescription,” Harper said. “That won’t just prove who you are. That will be a whole lot of data about you that’s connected to where you were and what you’re doing.”

In North Carolina, Thomas said DMV will ask to scan these documents even for older drivers who got their licenses long before these proof-of-identity requirements were introduced. Thomas says DMV offices now have the technology they need to scan North Carolinians’ identity papers, but he hasn’t decided when to start doing this.

“We’re driving very hard to be compliant, so we can give that opportunity to the citizens, but it’s technically their decision,” Thomas said. He recognizes that some people will decline.

“They will not want it,” Thomas said. “Because they will not want to surrender a copy of their originating documents.”

He said he might invite North Carolinians to start lining up with their documents later this year, to avoid the 2017 rush.

“When Florida implemented this Real ID compliance and brought in all their citizens and required them to bring in all their originating documents,” Thomas said, “it was a huge, huge wait time at the DMVs.”

This story was originally published January 16, 2016 at 4:24 PM with the headline "Real ID raises gold-star privacy issues."