Identity Crisis

DEPARTMENTS OF MOTOR VEHICLES in states across the country have spent years turning around their age-old reputations as terrible customer service centers by moving many of their services online or to onsite kiosks. Yet, many DMVs worry that those transformations may soon be reversed as a result of the Real ID Act of 2005, which, among other things, sets tight security standards for states when issuing driver’s licenses and identification cards. Many fear that the law could make licenses as difficult to get as passports — and take just as long.

“Governors are for improving security in a post-9/11 world, absolutely,” says David Quam, director, Office of Federal Relations for the National Governors Association (NGA) in Washington, D.C. “But states have gone out of their way to make the DMV more consumer-friendly, and security’s not always customer-friendly. If you tighten the clamps on security too much, you could see all those efficiencies lost.”

As the law is now written, starting in May 2008, only citizens with Real ID-compliant licenses will have access to federal services. So, for instance, such licenses will be necessary to board planes, enter courts or collect Social Security benefits.

That’s left DMVs with two problems. First, the law calls for systems that don’t exist today, and many officials insist they would be impossible to create even if they had unlimited time and money. Second, the regulations that will dictate specifically what will be required by the law have yet to be developed.

As a result, states have been stuck in purgatory as the clock ticks toward the compliance deadline. They’re worried that the two-year implementation timeframe isn’t nearly long enough to get their systems ready for the new law, and they can’t even begin designing those systems because they don’t know what the regulations will require.

For instance, Real ID says that states must have access to each other’s systems so they can ensure that applicants aren’t licensed in another state. But state officials don’t know if that will mean a new national database will have to be created; an existing national database will be upgraded to handle that part of the law; or they will have to integrate existing state databases.

Another piece of legislation says that for state licenses to be certified, DMVs will need to verify identity documents. (See “Letter of the Law ”.) This means that instead of just looking at a birth certificate, a DMV representative will need proof of its authenticity from the county clerk’s office that issued it. However, since many birth certificates aren’t stored electronically, state DMV leaders are wondering how they’ll be able to meet such a requirement.

“I think some of the concepts of Real ID are very good,” says Betty Serian, deputy secretary for Safety Administration at the Pennsylvania Department of Transportation (Penn DOT). “Further securing identification is a good thing, as is highway safety. The devil, though, lies in the implementation details.”

DMVs were created to ensure the safety of drivers and vehicles, but their role has evolved to the point where they are the de facto issuers of identification, explains Jason King, director of public affairs for the American Association of Motor Vehicle Administrators (AAMVA) in Arlington, Va. DMVs have spent years tightening the license-credentialing process. “No one wants to issue a driver’s license to a repeat DWI offender any more than they want to issue a driver’s license to a terrorist,” King says.

While many ideas in Real ID make sense, there’s only so much states can do within the constraints of tight budgets and schedules, he adds. Many states have upgraded or are in the midst of upgrading their systems, but even the most advanced states will need enhancements to comply, and they won’t know what those enhancements will be until they see the regulations.

“You have Real ID, which is a 21st century piece of legislation, and you have state DMVs that, due to lack of funding, have been using antiquated systems that in some cases haven’t received the attention they’ve needed in 30 years,” King says.

DIVING INTO THE DETAILS

The Department of Homeland Security, which is charged with overseeing Real ID, has been meeting since October with DMVs, NGA, the National Conference of State Legislatures, the American Legislative Affairs Council and AAMVA to devise regulations for implementing the law. No deadline has been set, says Jarrod Agen, DHS spokesman, but DHS expects to have draft regulations during the second half of this year.

That’s left state officials in limbo. They’re waiting for the regulations to be released before making complex, costly changes to their systems, but they’re worried about the tight timeframe between the release of final regulations and the May 2008 deadline. “Until we know exactly what’s going to be required, we can’t figure out a timeline, costs, feasibility or practicality,” NGA’s Quam says.

Vendors have already recognized the potential for the Real ID market. In February, solutions provider Digimarc announced its Real ID Migration Services.

Meanwhile, states are trying to convince DHS to relax some elements of Real ID, to consider grandfathering existing licensees so there’s not a mad rush at DMVs when the law takes effect and to fund the costs of implementing Real ID.

“DHS needs to bring clarity to the law, and they need to do so quickly,” states Serian of Penn DOT. “Many of the law’s requirements will take time, money, process changes and, for some states, law changes. I am very concerned that DHS sees this effort only as technology — some that states and their citizens are not going to be comfortable with and some that are just too far-fetched.”

A February 2005 study from the Congressional Budget Office estimated $120 million in national implementation costs, but many states say their expenses alone will surpass that figure. So far, Congress has appropriated $40 million in Real ID grants. Of that, DHS has allocated $6 million: $3 million each to pilot projects in Kentucky and New Hampshire. Before allocating the remaining $34 million, DHS must develop an overall spending plan and present it to Congress. It plans to do that as it develops regulations, says Agen.

It would cost Pennsylvania $85 million to comply with Real ID, on top of the state’s current five-year, $40 million legacy systems upgrade, Serian says. For most states, the act would reverse efficiency gains they’ve achieved since the Internet enabled them to automate their license renewal process.

State officials are trying to convince DHS to keep the law flexible and let states make decisions based on their realities. “Part of the problem with this legislation is its one-size-fits-all approach to a 50-state system,” NGA’s Quam adds.

VEXING REGULATIONS

Some states insist they won’t be able to build the systems needed for Real ID in time, especially since the regulations are still pending. “It is not likely that Virginia or any other state will be able to achieve compliance by May 11, 2008,” states a December report from the Virginia Real ID Task Force.

Real ID calls for the use of DMV systems that don’t exist, such as linked databases between the states to check if an applicant is licensed in another state. It also requires systems to verify identity documents, such as passports and bank statements, issued by other government agencies and private institutions. But the law doesn’t provide mandates or incentives for those other institutions to participate in the verification process, the Virginia report points out.

“The law’s requirements are extensive, and it’s agreed that this process will be long and arduous,” says a statement issued by the Alabama Department of Public Safety.

Another concern is the requirement that licenses include full legal names, because the documents used to verify a person’s identity might not match those names. For instance, someone’s birth certificate might say John James Doe, while his passport says John J. Doe and his bank account says Jack Doe. In addition, some state databases can accommodate only so many characters in the name field, so they’d need to reengineer those systems to accommodate full names.

Real ID also requires licenses to include the primary residential address, which some say could pose a risk to people whose privacy is essential, such as undercover officers or victims of domestic violence.

The requirement that all license holders be recredentialed is one of the most costly issues, says Serian of Penn DOT. Most states let citizens renew their driver’s license online, at kiosks or via mail, but under Real ID, they’d have to bring their identification documents to the DMV to be verified. Serian says that legislation alone would cost Pennsylvania $68 million.

State DMVs today use two cross-state systems: the Commercial Driver’s License Information System (CDLIS), used to track commercial vehicle operators, and the National Driver Register, which contains information about drivers with revoked or suspended licenses. States can query records for an individual and get information back through a central clearinghouse, but they can’t actually access databases from other states.

Real ID says states must link databases so they can search each other’s records to ensure that applicants aren’t licensed in another state. State officials say creating such a system would be a huge undertaking and might cause potential privacy violations.

“I’m responsible for the privacy, security and confidentiality of the data in my system,” Serian says. “It’s one thing for state systems to pass information between them, but if all 50 states could directly access each other’s databases, we’d lose control.”

DMVs have discussed creating a national driver’s database for years, but it’s always been deemed too cost-prohibitive. With Real ID, AAMVA and its members have resumed those discussions and are trying to persuade DHS to foot the bill. “

States can have really great systems, but if we’re not sharing the data, we lose a lot of the advantages of those systems,” explains Keith Dey, IT manager at the Nebraska Department of Motor Vehicles. “I see very positive benefits to sharing information across states, but those projects are very complex, time-consuming and costly.”

Another problem with linking databases is that if one state decides not to participate, it could invalidate the entire system.

“Those are all valid issues,” says Agen of DHS. “The states have the knowledge about issuing driver’s licenses, which is why we are consulting with them on drafting these regulations.”