A controversial 2005 bill designed to create a national standard for driver's licenses may not be quite as dead in the water as many might have assumed, according to a report released this week by the Center for Immigration Studies.
The report , authored by Janice Kephart, director of national security policy at the CIS, offers an update on the implementation status of the Real ID Act in each state. It is one of the first comprehensive looks at the effort since 2009, when broad concerns over Real ID requirements led to calls for its repeal and to Congress making a failed attempt at passing a watered-down alternative called the Pass ID Act .
Kephart said the review shows that several states have been quietly implementing Real ID requirements over the past year, and at substantially lower costs than originally estimated. "Real ID is alive and well and is being implemented," Kephart said. "Despite the immense amount of rhetoric against it, Real ID is proving itself to be of significant value [to states]," she said.
However, Jim Harper, director of information policy studies at the Cato Institute, a Washington-based public-policy research organization with libertarian leanings, challenged Kephart's findings. He said that the data in the report is not specific to Real ID.
Rather, what the CIS report shows is is merely the progress that states in general are making in upgrading their license issuance processes, Harper said. "There's a lot of pressure on states to improve driver's license standards." He said the CIS has only interpreted what the states are doing, in compliance with the Real ID mandate.
The Real ID Act of 2005 stemmed from one of the recommendations of the 9/11 Commission, and was passed as part of a broader anti-terrorism effort. It seeks to establish a national standard for issuing driver's licenses and other forms of identification.
The standard requires state drivers license authorities to use more stringent measures for verifying Social Security numbers, birth dates, address, proof of citizenship and immigration status. In all, the act prescribes 18 separate security controls that states are required to use when issuing drivers licenses.
In addition, the cards themselves are required to be machine-readable to allow for the easy capture of information. Under the act, all state driver's license databases would be linked. This would allow information in a person's record in any state to be accessible by officials in other states, and by the federal government.
Although states are not mandated to issue Real ID cards, the Department of Homeland Security (DHS) has noted that, eventually, Real ID-compliant cards will be required for air travel, for access to federal buildings and even for receiving federal benefits such as Social Security.
Almost from the start, privacy advocates, civil liberties groups and various others have protested against Real ID , saying that it would ultimately result in the creation of a national identity card that could be used for purposes such as profiling or surveillance.
Many states have also expressed concerns over the cost, security and privacy implications of Real ID. Such concerns have resulted in the deadline being pushed back repeatedly .
Currently, the deadline for full implementation is 2017, though there are several other milestone deadlines that states are required to meet before then.
Kephart said that a look at what's going on in different states suggests that Real ID is faring better than many might have assumed. So far, 11 states, including Alabama, Colorado, Indiana and Maryland, have already implemented all of the 18 security requirements mandated by Real ID.
The states are well ahead of the May 2011 deadline for doing so, she said. Another eight states, including Arkansas, Connecticut, Georgia, and New York, are within one to three benchmarks of full compliance.
In all, 37 states have implemented facial recognition technologies into their licensing process, and all require Social Security number verification. Many states have also ramped up checks of citizenship and immigration status, as required by Real ID.
All of this is very different from when Real ID was first passed and shows that states are making quiet progress with implementing the law, she said.
Interestingly, the cost of implementing Real ID requirements also appear to be nowhere close to the $11 billion price tag that some had projected for the effort, Kephart said. A review of the costs incurred by the states that are fully compliant with Real ID requirements shows that the initiative should cost between $350 and $750 million to fully implement, she said.
So far, the federal government has distributed close to $177 million to the states for funding Real ID upgrades.
However, Harper said the CIS report is somewhat misleading because all it is measuring is the progress states have made in implementing controls that many would have implemented even otherwise.
There's nothing showing what progress states are making with some of really key elements of Real ID, such as the linked databases and machine readable cards, he said. "These benchmarks are not the substance of Real ID, which is uniform collection and sharing of driver information, and uniform display of driver information," he said.
But he said the report was still important because it shows that efforts to push for a national ID card are still very much alive.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org .
Read more about privacy in Computerworld's Privacy Topic Center.