Thursday, January 24, 2008

British national ID card agenda delayed until 2012

British national ID card agenda delayed until 2012
January 23, 2008
By James Kirkup, Political Correspondent

The Government’s national identity card scheme was “in the intensive care ward” after leaked documents showed plans to issue UK citizens with the cards have been delayed until after the next election.

Amid growing doubts that the multibillion pound scheme will ever see the light of day, a confidential Home Office report suggests that the widespread introduction of cards for British nationals will not come until 2012 at the earliest.

That is two years later than the Government has previously stated. It would also ensure that the general introduction of ID cards took place well after the next election, which must be held by May 2010 at the latest.

The Home Office paper, entitled “National Identity Scheme Delivery Strategy” and marked “Restricted” was prepared for senior officials on 20 December 2007.
It sets out “a high level roll out strategy for the National Identity Scheme” and shows a timetable for implementation.

It shows that “Borders phase II (UK citizens),” the project for issuing cards to UK nationals in large numbers is now slated to begin in 2012.
The Government has said it plans to make ID cards compulsory, but only after a “voluntary” period during which anyone who renews a passport or driving licence will be automatically issued with a card.

Last night’s leak follows Gordon Brown’s apparent hesitation over the future of ID cards in the Commons earlier this month.

Pressed repeatedly whether he stands by plans to make ID cards compulsory for all UK nationals, the Prime Minister said only: “It is the Government’s policy to move ahead with this but subject to a vote of Parliament, depending on how the voluntary scheme works.”
Downing Street has since insisted that Mr Brown’s position on the scheme has not changed, but opponents detect waning Government commitment to the project in the light of recent damaging losses of sensitive data by the public sector.

David Davis, the Conservative shadow home secretary, last night said the document cast fresh doubt on the future of the ID card project.

He said: “It is in the intensive care ward. There are clear flaws in the whole government strategy for data protection.

“There is a clear fracture in public confidence in ID cards. And there are weaknesses in every single major IT system in the public sector. This is a political nightmare for the Government.”

Further fuelling suspicions of a Government climbdown on ID cards, a major review of the scheme appears to have been shelved.

James Crosby, the head of the HBOS bank, completed a review of the potential private sector uses for ID cards last year. But the Treasury has now confirmed there is no date set for its publication.

The leaked Home Office document makes clear that some British nationals like teachers and care workers could get cards as soon as next year. An ID card could be made a requirement for holding a job in a “position of trust” such as teaching or social care from 2009.

It says: “Our first priority should be to issue cards to those who are employed in positions of trust where identity assurance is critical to determining their appropriateness for that employment.”

The Home Office refused to comment on the leaked document.
An Identity and Passport Service spokesman said: “We have always said that the Scheme will be rolled out incrementally.

“As stated in the Strategic Plan for the National Identity Scheme published in December 2006, we will begin issuing ID cards for foreign nationals this year, and the first ID cards for British citizens in 2009.”

TEXAS simpers over to REAL ID

Texas officials endorse enhanced driver's licenses

By Michael Martinez Technology Daily
January 24, 2008

The top cop in Texas has endorsed a plan for the state to develop enhanced driver's licenses that can double as border-crossing credentials.

Texas Attorney General Greg Abbott on Tuesday ruled that the cards proposed as part of the state's high-tech licensing plan would satisfy federal law. Abbott was asked for his opinion about the initiative by the director of the Department of Public Safety.

The Legislature recently authorized the plan to develop the license, which will be designed to meet nationwide standards for driving credentials recently released by the Homeland Security Department, as well as specifications for another initiative to speed cross-border travel. Several other border states are moving to issue licenses that would satisfy both the so-called REAL ID Act and the Western Hemisphere Travel Initiative.

Abbott said in his opinion that enhanced licenses would be legal under federal passport laws if they conform to the technology, security and operational requirements of the travel initiative, which mandate that that the cards be tamper-proof and machine-readable.
The ruling came as many states are considering the costs and consequences of developing driver's licenses to comply with REAL ID. Homeland Security earlier this month released the final regulations for the statute.

Homeland Security Secretary Michael Chertoff has said the final rules were designed to allow states more flexibility in meeting REAL ID's requirements. The department delayed several key deadlines to give states more time to enroll drivers, which Chertoff said should reduce the costs of compliance considerably.

Several states already have decided to ignore REAL ID. Privacy advocates also are pushing Congress to move on federal legislation to repeal the law.

Montana Gov. Brian Schweitzer, a Democrat, has continued to reach out to other governors in his quest to block the law. He said in a letter to governors last week that he wants them to speak with "one unified voice and demand that Congress step in and fix this mess."

Schweitzer signed a bill last year that prevents Montana from participating in REAL ID. Members of Montana's congressional delegation also have expressed serious concerns.
Legislation has been offered in both chambers of Congress to wipe the REAL ID slate clean and restart a negotiated rulemaking process to develop licensing standards that was abandoned when the bill was passed.

Schweitzer wrote that the cooperative rulemaking process would give state officials a seat at the table and could facilitate the development of more secure IDs faster than REAL ID ultimately will with the new deadlines.

SCHNEIER: A year prior May 2008

May 08, 2007

REAL ID Action Required Now


I've written about the U.S. national ID card -- REAL ID -- extensively (most recently here). The Department of Homeland Security has published draft rules regarding REAL ID, and are requesting comments. Comments are due today, by 5:00 PM Eastern Time. Please, please, please, go to this Privacy Coalition site and submit your comments. The DHS has been making a big deal about the fact that so few people are commenting, and we need to prove them wrong.
This morning the Senate Judiciary Committee held hearings on REAL ID (info -- and eventually a video -- here); I was one of the witnesses who testified.

And lastly, Richard Forno and I wrote this essay for News.com:
In March, the Department of Homeland Security released its long-awaited guidance document regarding national implementation of the Real ID program, as part of its post-9/11 national security initiatives. It is perhaps quite telling that despite bipartisan opposition, Real ID was buried in a 2005 "must-pass" military spending bill and enacted into law without public debate or congressional hearings.

DHS has maintained that the Real ID concept is not a national identification database. While it's true that the system is not a single database per se, this is a semantic dodge; according to the DHS document, Real ID will be a collaborative data-interchange environment built from a series of interlinking systems operated and administered by the states. In other words, to the Department of Homeland Security, it's not a single database because it's not a single system. But the functionality of a single database remains intact under the guise of a federated data-interchange environment.

The DHS document notes the "primary benefit of Real ID is to improve the security and lessen the vulnerability of federal buildings, nuclear facilities, and aircraft to terrorist attack." We know now that vulnerable cockpit doors were the primary security weakness contributing to 9/11, and reinforcing them was a long-overdue protective measure to prevent hijackings. But this still raises an interesting question: Are there really so many members of the American public just "dropping by" to visit a nuclear facility that it's become a primary reason for creating a national identification system? Are such visitors actually admitted?

DHS proposes guidelines for proving one's identity and residence when applying for a Real ID card. Yet while the department concedes it's a monumental task to prove one's domicile or residence, it leaves it up to the states to determine what documents would be adequate proof of residence--and even suggests that a utility bill or bank statement might be appropriate documentation. If so, a person could easily generate multiple proof-of-residence documents. Basing Real ID on such easy-to-forge documents obviates a large portion of what Real ID is supposed to accomplish.

Finally, and perhaps most importantly for Americans, the very last paragraph of the 160-page Real ID document deserves special attention. In a nod to states' rights advocates, DHS declares that states are free not to participate in the Real ID system if they choose--but any identification card issued by a state that does not meet Real ID criteria is to be clearly labeled as such, to include "bold lettering" or a "unique design" similar to how many states design driver's licenses for those under 21 years of age.

In its own guidance document, the department has proposed branding citizens not possessing a Real ID card in a manner that lets all who see their official state-issued identification know that they're "different," and perhaps potentially dangerous, according to standards established by the federal government. They would become stigmatized, branded, marked, ostracized, segregated. All in the name of protecting the homeland; no wonder this provision appears at the very end of the document.

One likely outcome of this DHS-proposed social segregation is that people presenting non-Real ID identification automatically will be presumed suspicious and perhaps subject to additional screening or surveillance to confirm their innocence at a bar, office building, airport or routine traffic stop. Such a situation would establish a new form of social segregation--an attempt to separate "us" from "them" in the age of counterterrorism and the new normal, where one is presumed suspicious until proven more suspicious.

Two other big-picture concerns about Real ID come to mind: Looking at the overall concept of a national identification database, and given existing data security controls in large distributed systems, one wonders how vulnerable this system-of-systems will be to data loss or identity theft resulting from unscrupulous employees, flawed technologies, external compromises or human error--even under the best of security conditions. And second, there is no clear guidance on the limits of how the Real ID database would be used. Other homeland security initiatives, such as the Patriot Act, have been used and applied--some say abused--for purposes far removed from anything related to homeland security. How can we ensure the same will not happen with Real ID?

As currently proposed, Real ID will fail for several reasons. From a technical and implementation perspective, there are serious questions about its operational abilities both to protect citizen information and resist attempts at circumvention by adversaries. Financially, the initial unfunded $11 billion cost, forced onto the states by the federal government, is excessive. And from a sociological perspective, Real ID will increase the potential for expanded personal surveillance and lay the foundation for a new form of class segregation in the name of protecting the homeland.

It's time to rethink some of the security decisions made during the emotional aftermath of 9/11 and determine whether they're still a good idea for homeland security and America. After all, if Real ID was such a well-conceived plan, Maine and 22 other states wouldn't be challenging it in their legislatures or rejecting the Real ID concept for any number of reasons. But they are.
And we as citizens should, too. Let the debate begin.

Again, go to this Privacy Coalition site and express your views. Today. Before 5:00 PM Eastern Time. (Or, if you prefer, you can use EFF's comments page.)
Really. It will make a difference.

EDITED TO ADD (5/8): Status of anti-REAL-ID legislation in the states.
EDITED TO ADD (5/9): Article on the hearing.
Posted on May 08, 2007 at 12:15 PM

Digg thisAdd to del.icio.usTechnorati Links

FORBES: INPUT wants the chip in your wallet

BEAT THE CHIP NOTE: The people at INPUT want you to pay taxes to have yourself tracked with RFID chip in your American driver’s licenses. It is your job to boycott their business and make sure they get a first class education in consumer ethics.

SOURCE : INPUT


PR Newswire - Press Release Real ID Final Rule Enables States to Begin Work on Technologies for Compliance 01.23.08, 3:31 PM ET

RESTON, Va., Jan. 23 /PRNewswire/ -- The final rule for REAL ID compliance provides the necessary guidance for states to begin building systems and linking networks to fulfill the mandates of the 2005 legislation, according to a newly released report by INPUT, the authority on government business.

While states have until May 11, 2008 to declare their intention to comply with REAL ID, INPUT does not expect widespread resistance to derail the new approach. "Compared to the proposed rule of last March, DHS has made a credible effort to reduce or eliminate Constitutional as well as procedural and technical barriers to REAL ID compliance in many areas of the final rule," said Chris Dixon, manager, state and local industry analysis for INPUT. "The final rule should serve as a starting gun for vendors to begin working with states on compliance. Even if REAL ID were repealed in the next year or so, the concepts and approaches laid out in the final rule would still form the basis for an ongoing, generational overhaul of state drivers-licensing systems.

" With the release of the final rule for the REAL ID Act of 2005, the U.S. Department of Homeland Security (DHS) has revised its approach from that of the Notice of Proposed Rulemaking (NPRM) of March 3, 2007. A variety of deadline extensions have been granted at least in part to provide the federal government with additional time to prepare various databases for interface with the states. The REAL ID "Verification and Data Exchange Architecture" will leverage the American Association of Motor Vehicles Administrators' AAMVAnet as the "hub" for several "federated querying systems."

"Streamlining the source-document review and image-capture process will be essential to reducing the vast delays in processing of an estimated 240 million drivers," said Dixon. "Backend record-keeping and integration of state systems with the various federal and multi-state backbone systems will be the primary IT concerns in the near term. States will need long-term vendor support in implementing FISMA-compliant security around DMV databases and facilities, as well as downstream vital records production and systems -- especially birth certificates."

According to INPUT's analysis, the weakest link in the final rule concerns personal information included on the surface of -- or embedded electronically in -- the REAL ID card. While the final rule is defensible in these areas, controversies in this area are premised more on philosophy about the role of government than the specific technologies of REAL ID. If DHS and REAL ID-complying states do not address this issue head on, REAL ID will remain open to continued vigorous state and individual resistance based on fears of skimming and eventual incorporation of radio frequency identification (RFID) technology into the card.

INPUT's REAL ID -- Final Rule Provides Extra Time and Flexible Options for Technical Compliance INPUT/Output(R) report is available on INPUT's website at http://REALID08.input.com About INPUT INPUT is the authority on government business. Established in 1974, INPUT helps companies develop federal, state, and local government business and helps public sector organizations achieve their objectives. Over 1,300 members, including small specialized companies, new entrants to the public sector, and the largest government contractors and agencies, rely on INPUT for the latest and most comprehensive procurement and market information, consulting, powerful sales management tools, and educational & networking events.

For more information about INPUT, visit www.input.com or call 703-707-3500. Proper use of name is INPUT Media Contact: Meredith Lawrence mlawrence@input.com 703-707-3687 SOURCE INPUT

PA stalls on Real ID Committment

Posted on Wed, Jan. 23, 2008

Feds grant Pa. extension on Real ID driver's license rules
The Associated Press

HARRISBURG, Pa. - The Pennsylvania Transportation Department is getting more time to implement new rules for making driver's licenses more secure.

The state says it'll have until the end of next year to comply with the federal REAL ID Act.
The law is supposed to make it more difficult for terrorists, illegal immigrants and others to get official identification.

PennDOT's extension allows state residents to continue using their existing driver's licenses and identification cards for official federal purposes through Dec. 31, 2009.

The agency says the delay gives it more time to figure out what its options are, how much it's going to cost and how it'll affect people.

CNN.com : Federal ID Plans Raise Concerns

CNN) -- Americans may need passports to board domestic flights or to picnic in a national park next year if they live in one of the states defying the federal Real ID Act.

Homeland Security Secretary Michael Chertoff says there are no plans for a federal database of drivers' information.The act, signed in 2005 as part of an emergency military spending and tsunami relief bill, aims to weave driver's licenses and state ID cards into a sort of national identification system by May 2008. The law sets baseline criteria for how driver's licenses will be issued and what information they must contain.

The Department of Homeland Security insists Real ID is an essential weapon in the war on terror, but privacy and civil liberties watchdogs are calling the initiative an overly intrusive measure that smacks of Big Brother.More than half the nation's state legislatures have passed or proposed legislation denouncing the plan, and some have penned bills expressly forbidding compliance.

Several states have begun making arrangements for the new requirements -- four have passed legislation applauding the measure -- but even they may have trouble meeting the act's deadline.

The cards would be mandatory for all "federal purposes," which include boarding an airplane or walking into a federal building, nuclear facility or national park, Homeland Security Secretary Michael Chertoff told the National Conference of State Legislatures last week. Citizens in states that don't comply with the new rules will have to use passports for federal purposes.
"For terrorists, travel documents are like weapons," Chertoff said. "We do have a right and an obligation to see that those licenses reflect the identity of the person who's presenting it."
Chertoff said the Real ID program is essential to national security because there are presently 8,000 types of identification accepted to enter the United States.

"It is simply unreasonable to expect our border inspectors to be able to detect forgeries on documents that range from baptismal certificates from small towns in Texas to cards that purport to reflect citizenship privileges in a province somewhere in Canada," he said.

More information
· Details of Real ID Act
· NCSL's 'Countdown to Real ID'
· Department of Homeland Security FAQs
· ACLU's 'Real nightmare'

Chertoff attended the conference in Boston, Massachusetts, in part to allay states' concerns, but he had few concrete answers on funding.

The Department of Homeland Security, which estimates state and federal costs could reach $23.1 billion over 10 years, is looking for ways to lessen the burden on states, he said. On the recent congressional front, however, Chertoff could point only to an amendment killed in the Senate last month that would've provided $300 million for the program.
"There's going to be an irreducible expense that falls on you, and that's part of the shared responsibility," Chertoff told the state legislators.

Bill Walsh, senior legal fellow for the Heritage Foundation, a Washington-based conservative think tank that supports the Real ID Act, said states shouldn't be pushing for more federal dollars because, ultimately, that will mean more federal oversight -- and many complaints about cost coincide with complaints about the federal government overstepping its bounds.
"They are only being asked to do what they should've already done to protect their citizens," Walsh said, blaming arcane software and policies at state motor vehicle departments for what he called "a tremendous trafficking in state driver's licenses."

The NCSL is calling Real ID an "unfunded mandate" that could cost states up to $14 billion over the next decade, but for which only $40 million has been federally approved. The group is demanding Congress pony up $1 billion for startup costs by year's end or scrap the proposal altogether.

Everyone must visit DMV by 2013

The Real ID Act repealed a provision in the 9/11 Commission Implementation Act calling for state and federal officials to examine security standards for driver's licenses.
It called instead for states to begin issuing new federal licenses, lasting no longer than eight years, by May 11, 2008, unless they are granted an extension.

It also requires all 245 million license and state ID holders to visit their local departments of motor vehicles and apply for a Real ID by 2013. Applicants must bring a photo ID, birth certificate, proof of Social Security number and proof of residence, and states must maintain and protect massive databases housing the information.

NCSL spokesman Bill Wyatt said the requirements are "almost physically impossible." States will have to build new facilities, secure those facilities and shell out for additional equipment and personnel.

Those costs are going to fall back on the American taxpayer, he said. It might be in the form of a new transportation, motor vehicle or gasoline tax. Or you might find it tacked on to your next state tax bill. In Texas, Wyatt said, one official told him that without federal funding, the Lone Star State might have to charge its citizens more than $100 for a license.

"We kind of feel like the way they went about this is backwards," Wyatt said, explaining that states would have appreciated more input into the process. "Each state has its own unique challenges and these are best addressed at state levels. A one-size-fits-all approach to driver's licenses doesn't necessarily work."

Many states have revolted. The governors of Idaho, Maine, Montana, New Hampshire, Oklahoma, South Carolina and Washington have signed bills refusing to comply with the act. Six others have passed bills and/or resolutions expressing opposition, and 15 have similar legislation pending.

Though the NCSL says most states' opposition stems from the lack of funding, some states cited other reasons for resisting the initiative.

New Hampshire passed a House bill opposing the program and calling Real ID "contrary and repugnant" to the state and federal constitutions. A Colorado House resolution dismissed Real ID by expressing support for the war on terror but "not at the expense of essential civil rights and liberties of citizens of this country."

Privacy concerns raised

Colorado and New Hampshire lawmakers are not alone. Groups like the American Civil Liberties Union and Electronic Frontier Foundation say the IDs and supporting databases -- which Chertoff said would eventually be federally interconnected -- will infringe on privacy.
EFF says on its Web site that the information in the databases will lay the groundwork for "a wide range of surveillance activities" by government and businesses that "will be able to easily read your private information" because of the bar code required on each card.

The databases will provide a one-stop shop for identity thieves, adds the ACLU on its Web site, and the U.S. "surveillance society" and private sector will have access to the system "for the routine tracking, monitoring and regulation of individuals' movements and activities."
The civil liberties watchdog dubs the IDs "internal passports" and claims it wouldn't be long before office buildings, gas stations, toll booths, subways and buses begin accessing the system.
But Chertoff told legislators last week that DHS has no intention of creating a federal database, and Walsh, of the Heritage Foundation, said the ACLU's allegations are disingenuous.
States will be permitted to share data only when validating someone's identity, Walsh said.
"The federal government wouldn't have any greater access to driver's license information than it does today," Walsh said.

States have the right to refuse to comply with the program, he said, and they also have the right to continue issuing IDs and driver's licenses that don't meet Real ID requirements.
But, Walsh said, "any state that's refusing to implement this key recommendation by the 9/11 Commission, and whose state driver's licenses are as a result used in another terrorist attack, should be held responsible."

State reaction to Real ID has not been all negative. Four states have passed bills or resolutions expressing approval for the program, and 13 states have similar legislation pending (Several states have pending pieces of legislation both applauding and opposing Real ID).
Chertoff said there would be repercussions for states choosing not to comply.

"This is not a mandate," Chertoff said. "A state doesn't have to do this, but if the state doesn't have -- at the end of the day, at the end of the deadline -- Real ID-compliant licenses then the state cannot expect that those licenses will be accepted for federal purposes."