5 Places You Can Be Tracked by Facial Recognition Technology

Just a few days ago I posted a pretty extensive blog on Facial Recognition technology and the threat it poses to individual privacy. So for the sake of time and repetition I'm not going to go back over the basics (see that post for this), but rather, get straight to a fantastic article from Alternet entitled 5 Unexpected Places You Can Be Tracked With Facial Recognition Technology. Of particular interest to me was the coverage the piece gives to California's own recent fight that we at the Consumer Federation of California were deeply involved in, over biometric identifiers being used by the DMV. As such, our Executive Director, Richard Holober, is quoted in the article as well.

Before I provide some especially choice clips of this article (because it dovetails very well with my recent post on the topic), let me refresh everyone's memories regarding the successful campaign by privacy and consumer groups against the California DMV which resulted in, with just one day to spare, the Joint Legislative Budget Committee (JLBC) stepping in to reject the DMV’s proposal to impose sweeping new biometric technologies - such as facial and thumb print scans - as elements in a renewal of a vendor contract to produce driver’s licenses and ID cards.

At the time, the Consumer Federation of California had joined organizations from across the political spectrum – including the ACLU, Electronic Frontier Foundation, California Eagle Forum, Consumers Union, Privacy Activism, Privacy Rights Clearinghouse, and the World Privacy Forum - to urge the legislature to reject the DMV's request on the grounds that any change of this magnitude should be a policy matter for the legislature to decide, after considering whether it is effective, affordable, and if it contains the appropriate privacy safeguards.

If the JLBC did not act in time the proposal would have moved forward. Thankfully, at the very last moment a letter that was unequivocal in its opposition to the proposal was sent to the DMV from Senator Denise Ducheny - the Committee Chair.

Click here to read the complete letter. Here's a particularly important passage:

"Of particular concern is the proposed use of biometric technology as part of the card issuance process and the related privacy issues. I think the Legislature should consider the policy implications of using biometrics in the issuance of driver licenses before the department starts to use the technology. In addition, after review and discussions with DMV, the Analyst concluded that the request was not fully justified, in part because the department was unable to provide key information on the specific costs and benefits related to the proposed use of biometrics."

Click here to read the Monday, February 16th article in the San Jose Mercury News, entitled "DMV biometric plan will undergo public hearings".

Here was some of our argument on the DMV Proposal:

On January 14th the California Department of Finance – without notifying the public – sent a letter to inform the state Joint Legislative Budget Committee that it planned to issue a new vendor contract for production of California Driver’s Licenses, ID cards and Salesperson cards starting in June of 2009. Hidden in the fine print, the proposal called for “enhanced” biometric identification in state IDs. Unless this legislative committee objects to this plan within 30 days, the Department of Motor Vehicles will be free to begin implementing the biometric technology.

What are Biometrics?

Biometric technology is the computerized matching of an individual’s personal characteristics (like a thumbprint or facial scan) against an image or database of images.  In other words, the DMV and the Department of Finance are seeking to create a massive government database of biometric information from virtually every Californian over the age of 16 without debate or review - raising significant concerns regarding the increased surveillance, monitoring and tracking of individuals.

One would expect, in light of the ongoing and intensifying debate over the REAL ID Act (a federal plan to create a national identity card based on drivers’ licenses) and the increasing number and degree of privacy violations committed by the federal government in recent years, that such a program would be fully debated, in the open, by our representatives in the State Legislature and with public comment, before it could ever be enacted.

Because no such debate has occurred, and no attention has been given to the privacy concerns such a program warrants, a broad coalition of consumer and privacy rights advocates joined forces to urge the legislature to reject this request while there’s still time.

Our case against the proposal is twofold.

(1) The first is procedural: the DMV is attempting to use a routine contract renewal process to effectuate major policy changes.

As the ACLU noted:

•    A 30-day expedited opt-out letter to the Legislature is an inappropriate vehicle to move from photographs and thumbprints of millions of Californians to advanced facial recognition technology and biometric systems that pose a number of privacy and security concerns if not handled carefully.

•    The DMV does not appear to have authority to implement biometric technologies that the Legislature has considered and rejected over the years, without the issues being fully considered and addressed in policy and budget hearings.

(2) The second relates to privacy and security: the underlying proposal to use biometric technologies has yet to establish appropriate safeguards to protect against identity theft and unwarranted government snooping into our private lives.

It’s important to understand the limitations of biometrics as well as their strengths. The fact is, biometrics are easy to steal. Our fingerprints are left everywhere we touch, and our iris scans are everywhere we look.

According to experts, biometrics work only if two things can be verified by the verifier: one, that the biometric came from the person at the time of verification, and two, that the biometric matches the master biometric on file. If the system can't do that, it can't work.

You can see more of this original post of mine here.

Now let's get to the article from Alternet:

As face recognition and other biometrics advance, the technology has begun to proliferate in two predictable realms: law enforcement and commerce. Here are 5 places besides Facebook you might encounter face recognition and other biometric technology -- not that, for the most part, you would know it if you did. 

1. The streets of America 

In the fall, police officers from 40 departments will hit the streets armed with the Mobile Offender Recognition and Information System (MORIS) device. The gadget, which attaches to an iPhone, can take an iris scan from 6 inches away, a measure of a person's face from 5 feet away, or electronic fingerprints, according to Computer vision central. This biometric information can be matched to any database of pictures, including, potentially, one of the largest collections of tagged photos in existence: Facebook. The process is almost instant, so no time for a suspect to opt out of supplying law enforcement with a record of their biometric data.

...

 
2. The DMV

Slightly fewer than half of the DMVs in the US have the capacity to run your picture through biometric databases. Ostensibly, these searches are intended to catch people trying to collect multiple IDs from different states. Fair enough. But as EFF's Lee Tien told AlterNet, the DMV can also log into and run a person's face against any government database, including ones that hold criminal records. Last August, former New York Gov. David Paterson and DMV commissioner David Swartz held a triumphant news conference where they announced that more than 100 felony arrests were made through the DMV's facial recognition program.

In the past, the FBI has applied facial recognition technology to the DMV's vast database of photo images in pursuit of suspects, according to the AP...'We see this as sort of creeping Big Brother government, an invasion of people's privacy,' said Richard Holober, executive director of the San Mateo-based Consumer Federation of California."

...

3. Las Vegas casinos, and Kraft and Adidas stores

For years Las Vegas casinos have used various forms of facial recognition to identify card-counters. Now, Vegas is at the forefront of efforts to adapt facial recognition to more efficiently suck money out of visitors. The LA Times reported last week that the Venetian hotel and casino has installed basic facial recognition software in advertisements. A camera captures an image of a person passing by and an algorithm determines their gender and rough age. The advertisement can then present them with products most likely to appeal to their demographic. 

...

4. Bars 

Inevitably, facial recognition software is also being deployed for the purpose of getting people laid. SceneTap, an app developed by a Chicago company uses information from facial recognition cameras planted in bars to determine the ratio of women to men and the average age of customers. As of June, 200 bars across the country had signed up to take part, according to Forbes. SceneTap developers assured reporters that the cameras they're installing in bars do not capture high-enough-quality images to match them up to databases or Facebook profiles. 

Click here for more.

In my last post I give a short summation of why I find the spread of this technology, and many other privacy related intrusions, so disturbing. It's not that any one violation alone is the problem, its the totality of them all...and the direction it indicates we're headed as a society. 

I wrote, "Whether its the knowledge that everything we do on the internet is followed and stored, that we can be wiretapped for no reason and without a warrant or probable cause, that smart grid systems monitor our daily in home habits and actions, that our emails can be intercepted, that our naked bodies must be viewed at airports and stored, that our book purchases can be accessed (particularly if Google gets its way and everything goes electronic), that street corner cameras are watching our every move, and that RFID tags and GPS technology allow for the tracking of clothes, cars, and phones (and the list goes on)...what is certain is privacy itself is on life support in this country...and without privacy there is no freedom. I also fear how such a surveillance society stifles dissent and discourages grassroots political/social activism that challenges government and corporate power...something that we desperately need more of in this country, not less."

Today's article from Alternet certainly gives me no reason to retract any of this...

Amidst Continued Opposition REAL ID Delayed - AGAIN

Before I get to the article in CNet News detailing the latest buckling by the Homeland Security Department on the privacy abomination that is REAL ID, let me give you a quick refresher course on the Act and the state revolt that it inspired.

The Real ID Act was approved by Congress - underhandedly as a rider I might add - and then signed into law by President Bush in 2005 as part of the government's effort to combat terrorism.

At the time, few lawmakers even knew what they were voting for, or necessarily supported the concept to begin with. Since that time the law has evoked widespread criticism from privacy advocates and civil rights groups, which say it would create a de facto national identity card system that would be hard to manage and even harder to secure. The law requires states to issue new licenses which are supposed to screen potential terrorists and identify illegal immigrants.

Since the law's enactment, at least 42 states have considered anti-Real ID legislation, and another 24 states have enacted anti-real ID bills or resolutions, and fourteen of those states have passed binding legislation prohibiting participation in the Real ID program. Five more states have already passed resolutions or statutes in 2009 - with Missouri likely becoming the next state to opt out of Real ID if its governor signs legislation currently before him.

Initially, States had until May of 2008 to implement Real ID, but the department extended that until Dec. 31, 2009. If they need more time and have met certain benchmarks, states can request an extension until May 11, 2011. Now that deadline has been moved back again!

This new federal identity document - REAL ID - would ostensibly be required of every American in order to fly on commercial airlines, enter government buildings, open a bank account, and more. The common reaction from citizens and states across the country has centered on the threat it would pose to individual privacy, the high costs states would incur to implement it, the increased danger of identity theft, and the possible loss of freedoms due to expanded government power.

As noted by the Electronic Frontier Foundation (EFF):

Once the IDs and database are in place, their uses will inevitably expand to facilitate a wide range of surveillance activities. Remember, the Social Security number started innocuously enough, but it has become a prerequisite for a host of government services and been co-opted by private companies to create massive databases of personal information. A national ID poses similar dangers; for example, because "common machine-readable technology" will be required on every ID, the government and businesses will be able to easily read your private information off the cards in myriad contexts.
 
For everything that's wrong with the REAL ID Act, check out the REAL NIGHTMARE site.

Now to the latest news. As I mentioned above, the law was set to take effect May 11. But, Homeland Security Secretary Janet Napolitano indicated last week that she plans to delay the deadline for states to comply until at least January 2013. House Republicans have been arguing that we need to implement the law sooner, rather than later, but lawmakers from both sides of the aisle, particularly on the Democratic side, have continued to aggressively oppose the law -  urging straight out repeal.

Unfortunately, we lost the most effective leader against REAL ID last election, Russ Feingold, but we still have Senators like Patrick Leahy, who was quoted last week as praising the decision to delay implementation, stating, "“I have made no secret of my disagreement with this policy, which was rushed through Congress with little debate or consideration. This law has saddled the states with enormous costs and burdened citizens with the prospect of what effectively would be a national identification card. When so many states are struggling with extremely difficult budget choices, the last thing they need is to think about how to pay for this unfunded federal mandate." 

Declan McCullagh reported on Cnet: 

The reason Homeland Security granted the delay is that, apart from some Republican stalwarts in Congress, this law creating a digital nationalized ID is hardly popular, with critics calling it a national ID card. A chart (PDF) updated last month by the National Conference of State Legislatures lists 16 states, including Arizona, Georgia, Oregon, and Washington, with laws forbidding them to comply with Real ID and 8 states, including Colorado, Hawaii, and Illinois, that have enacted resolutions effectively boycotting it.

Once the regulations take full effect, the impact on Americans would be dramatic: Residents of the 24 states mentioned above would not be able to simply use their driver's license to fly or to enter a federal building such as a courthouse, even for jury duty. U.S. passports or military IDs, however, would remain valid for identification.

...

Because Real ID links state DMV databases, establishes a standard bar code that can be digitally scanned, and mandates that original documents such as birth certificates be verified, backers claim the benefits extend beyond antiterror and ID fraud cases. (Extending it to firearm and prescription drug sales has not been ruled out.)

Homeland Security's announcement today carefully neglected to mention the state-by-state revolt against these federal mandates, with state governments citing privacy, federalism, and funding as reasons for their refusal to cooperate. One estimate puts compliance costs as high as $11 billion.

...

During the Bush administration, Homeland Security was an unabashed champion of Real ID. But under the Obama administration, the department has been far less effusive in its support of the law, and Napolitano has been quoted as talking about repealing Real ID in hopes of replacing it with something that "accomplishes some of the same goals." As Arizona governor, Napolitano signed a law forbidding the state from complying with Real ID. 


Click here to read more.

The REAL ID program has appeared to be dying a slow death from the steady drip of states voicing their opposition for a long time now. Unfortunately, an improved yet totally unacceptable version of the act was gaining steam in the Senate, no doubt buoyed by support from the President and Homeland Security Chief Janet Napolitano, called PASS ID. Little media attention has been given to this new proposal, or the threat it STILL would pose to an individual's right to privacy.

Many of us - including a broad privacy coalition that opposes Real ID - remain concerned that such a variation of the Act will end up being the "compromise" position. It's not so much what such a compromised ID program would do differently, its what it would have in common: the creation of a national identification card. Whether its PASS ID, REAL ID, or a variation of the two, each would still endanger victims of domestic violence by failing to adequately shield their addresses, raise fees associated with identification cards, expose consumers to identity theft and fail to improve our nation's security.

Do we really want to create a database with all of our personal information in it? 

Here's EFF's take on the larger issues associated with a national ID type program...be it with increased safeguards or not:

Proponents seem to be blind to the systemic impotence of such an identification card scheme. Individuals originally motivated to obtain and use fake IDs will instead use fake identity documents to procure "real" drivers' licenses. PASS ID creates new risks -- it calls for the scanning and storage of copies of applicants' identity documents (birth certificates, visas, etc.). These documents will be stored in databases that will become leaky honeypots of sensitive personal data, prime targets for malicious identity thieves or otherwise accessible by individuals authorized to obtain documents from the database.

Despite some alterations to the scheme, PASS ID is still bad for privacy in many of the same ways the REAL ID was. And proponents of the national ID effort seem blissfully unaware of the creepy implications of a "papers please" mentality that may grow from the issuance of mandatory federal identification cards. Despite token provisions that claim to give states the freedom to issue non-federal identification cards, the card will be mandatory for most -- the PASS ID Act seeks to require everyone to show the federally recognized ID for "any official purpose," including boarding a plane or entering a federal building.
 
In other words, even as REAL ID has been delayed yet again, stay tuned for more alternative approaches that may be slightly more palatable, yet still unacceptable.

EPIC Grades Obama on Privacy

The Electronic Privacy Information Center (EPIC) released their Privacy Report Card for President Obama last week, and as one would expect, his scores are less than stellar. Granted, he out performs the Bush Administration, but then, if that's the bar we're going to use we're all in deep, deep trouble.

Unfortunately, the Administration was given an incomplete grade on the issue of Consumer Privacy, an area that is especially of interest to the Consumer Federation of California.

As I have written about on this blog, the Federal Trade Commission (FTC) has gone through some enormous positive changes under President Obama, and appears committed to better protecting Internet users from behavioral targeting and ads as well as other invasive industry practices. What remains to be seen is who will be the two final appointments to the FTC board (the new head of the Bureau of Consumer Protection at the FTC and FTC Chairman Jon Leibowitz both excellent first steps) and how hard will the President push for reform?

As EPIC's report states:

The Obama Administration can protect consumer privacy by supporting new laws, by safeguarding the personal information held by the federal government, and by strengthening the Federal Trade Commission (FTC), the chief agency responsible for protecting U.S. consumers. The FTC assures that free annual credit reports are available to consumers, manages the Do Not Call telephone registry, investigates monopolies, combats identity theft, prevents deceptive practices by businesses, and protects consumer privacy rights. At this time, the Obama Administration has introduced no new consumer privacy legislation and has left two of the five FTC Commissioner slots unfilled. Proposals are also moving forward that would make government information available to the private sector for advertising and marketing.

Other highlights from the report include:

On Cybersecurity: B "The President's commitment to safeguard privacy and network communications in the difficult area of cybersecurity is commendable. But a battle looms over efforts by Congress to extend the government's control of the Internet. The President should have named a point person on cybersecurity to represent his views in that coming debate."

On Civil liberties: C+ "The Obama Administration inherited many troubling programs from the Bush Administration: the Patriot Act, Fusion Centers, No Fly Lists, E_Verify, and REAL ID. So far, there appears to be little change with the new Administration. There is a modified version of REAL ID called "PASS ID." The Patriot Act is still law. No Fly Lists and Fusion Centers are being expanded." The organization did note progress in some areas, "as well as open government and judicial appointments."

On Medical Privacy: A- "EPIC gives the Administration full credit for creating important privacy safeguards as part of the network for electronic health records. The privacy language in the HI‐TECH Act makes the bill one of the best privacy laws in years. Still, implementation of privacy safeguards remains a key challenge."

I would add one more disappointment to the list given under "civil liberties": wiretapping. Not only did the President flip flop on the issue before being elected, he has refused to hold anyone accountable for the crimes committed by the Bush Administration or the telecommunication companies that abetted those crimes. In addition, every expert I have read or spoken with has argued that the current law remains completely inadequate in terms of protecting the privacy of American citizens and restraining the growing authority of the Executive Branch.

All in all, its a rather dismal record all things considered. While again, an improvement over Bush, I think its safe to say that the President's record falls short of his promises as a candidate.

Is PASS ID Just REAL ID Reanimated?

As I've said here before, it wasn't too long ago that the REAL ID program appeared to be dying a slow death from the steady drip of states voicing their opposition. Unfortunately, an improved yet totally unacceptable version of the act has been gaining steam in the Senate, no doubt buoyed by support from the President and Homeland Security Chief Janet Napolitano.

Also, little media attention has been given to this new proposal, or the threat it STILL poses to an individuals right to privacy. My hope is that once the health care fight is over, this lack of attention will begin to change.

Today I'm going to include a recent short article on this subject by Richard Esguerra of the Electronic Frontier Foundation (EFF). But first, some background:

PASS ID would - just like Real ID - endanger victims of domestic violence by failing to adequately shield their addresses, raise fees associated with identification cards, expose consumers to identity theft and fail to improve our nation's security. Consider what just happened with the hacking of 130 million peoples credit card numbers? Do we really want to create a database with all of our personal information in it too?

In fact, PASS ID proposes to move forward on the one key component of REAL ID that privacy advocates were most opposed to: the creation of a national identification card.

Thankfully, a broad coalition of privacy organizations have joined forces (18 in all I believe) to oppose the bill - rightly advocating for the repeal, not the reform of Real ID. But I'll get to them in future posts.

Here's EFF's update and take:

Proponents seem to be blind to the systemic impotence of such an identification card scheme. Individuals originally motivated to obtain and use fake IDs will instead use fake identity documents to procure "real" drivers' licenses. PASS ID creates new risks -- it calls for the scanning and storage of copies of applicants' identity documents (birth certificates, visas, etc.). These documents will be stored in databases that will become leaky honeypots of sensitive personal data, prime targets for malicious identity thieves or otherwise accessible by individuals authorized to obtain documents from the database.

Despite some alterations to the scheme, PASS ID is still bad for privacy in many of the same ways the REAL ID was. And proponents of the national ID effort seem blissfully unaware of the creepy implications of a "papers please" mentality that may grow from the issuance of mandatory federal identification cards. Despite token provisions that claim to give states the freedom to issue non-federal identification cards, the card will be mandatory for most -- the PASS ID Act seeks to require everyone to show the federally recognized ID for "any official purpose," including boarding a plane or entering a federal building.

At the moment, health care reform is commanding tremendous attention and effort on the hill, so the PASS ID Act seems to be on the backburner for now. But after the August recess, anything can happen. So stay tuned for more about PASS ID and critical opportunities to flag your opposition to this flawed national ID scheme.

That about sums up my own thoughts for today. Click here to read the entire EFF post.

Los Angeles Timed Editorial: Real ID -- a real pain

I know this editorial is about a week old, but for anyone that hasn't read it, I highly recommend you check it out...a hopeful sign to be sure!

It wasn't too long ago that the REAL ID program appeared to be dying a slow death from the steady drip of states voicing their opposition. Unfortunately, an improved yet totally unacceptable version of the act has been gaining steam in the Senate, no doubt buoyed by support from the President and Homeland Security Chief Janet Napolitano.

Little media attention has been given to this new proposal, or the threat it STILL poses to an individual's right to privacy, but perhaps that is beginning to change. Some background:

PASS ID would - just like Real ID - endanger victims of domestic violence by failing to adequately shield their addresses, raise fees associated with identification cards, expose consumers to identity theft and fail to improve our nation's security. In fact, PASS ID proposes to move forward on the one key component of REAL ID that privacy advocates were most opposed to: the creation of a national identification card.

Thankfully, the increasingly nimble and broad coalition of privacy organizations have joined forces to oppose the bill - rightly advocating for the repeal, not the reform of Real ID. Here's a few clips from the recent LA Times editorial, "Real ID -- a real pain":

The law mandates a tamper-proof card that would become the only acceptable form of identification for federal purposes, such as boarding a commercial airliner or entering a federal building. It was clumsily drafted in a way that imposes multibillion-dollar expenses on state governments, enhances opportunities for identity theft, turns state motor vehicle departments into arms of U.S. Immigration and Customs Enforcement and will almost certainly lead to harassment of immigrants, legal or otherwise. Though legislation has recently been introduced in Congress that would repair many of Real ID's faults, it doesn't go far enough. The best way to fix Real ID is to repeal it.

...

The states are in open revolt against Real ID because of its financial burdens, with 13 passing legislation refusing to participate in the program and at least as many more officially opposing it or considering legislation barring compliance (so far, California has been silent). This has prompted the Department of Homeland Security to repeatedly push back its deadlines.

Currently, states don't have to issue the new licenses until 2017, but they must certify that they are meeting benchmarks toward compliance by Dec. 31. If any state fails to do so, and most will, its residents won't be able to use driver's licenses as ID for boarding a domestic flight, instead being forced to produce a passport or other federally acceptable photo ID.This could cripple the nation's airports -- though it's highly unlikely that the Obama administration would allow that to happen. Unless Real ID is amended or repealed, Homeland Security Secretary Janet Napolitano is likely to push back the deadline once again.

Napolitano is backing a different solution, known as the Pass ID Act:S.1261:. Introduced last month by Sens. Daniel K. Akaka (D-Hawaii) and George V. Voinovich (R-Ohio), the bill was drafted at the behest of the National Governors Assn. and addresses most of the state-level concerns. DMVs would no longer have to verify birth certificates or home addresses, and they wouldn't have to create databases searchable by other states, which would greatly reduce the costs. What's more, the federal government would issue grants to cover most of the other expenses.

Pass ID is an improvement, but it still imposes risks and burdens that outweigh its national security benefits. It mandates storage of identity documents by state officials and immigration checks at the DMV. It complicates efforts by some states to issue driver's licenses to illegal immigrants, because such licenses would require special markings to signal that the bearer is here illegally. We don't oppose sensible measures to enforce our immigration laws, but anything that discourages undocumented immigrants from getting driver's licenses -- as Pass ID would -- endangers all drivers on the road and raises insurance costs for everyone.

Click here to read the rest of the editorial.

I also found an editorial in Indiana's "News Sentinel" published yesterday that makes a similar case as the Times. Its unusual for the mainstream media to publicly oppose laws that are being sold to us as critical to winning the phony "war on terror". The media, for whatever reason, appears to be a potential ally in the fight to defeat PASS ID and the concept of a national identification program. The Sentinel sums it up nicely:

So if we put everything into that one document – make it the be-all and end-all of identification for most Americans – what might we have? An invasion of ordinary citizens' privacy and phony documentation in the hands of identity thieves and potential terrorists that we believe too readily is authentic. This is something to talk about before a national ID becomes reality, don't you think?

For more, click here to read a recent post of mine in which I go into greater detail regarding the key similarities and differences between REAL ID with PASS ID.

Also, in case you were wondering, the privacy coalition opposing the new law includes: ACLU, Campaign for Liberty, Citizens Against Government Waste, Consumer Action, Cyber Privacy Project, DownsizeDC.org, Inc., Electronic Frontier Foundation, Equal Justice Alliance, Leadership Conference on Civil Rights, Liberty Coalition, National Immigration Law Center, National Network to End Domestic Violence, Privacyactivism, Privacy International, Privacy Journal, Privacy Rights Clearinghouse, Rutherford Institute and U.S. Bill of Rights Foundation.

I'll be covering the legislation's progress right here...

Privacy Groups Join Forces to Oppose PASS ID

First the good news: the American Civil Liberties Union has joined 17 other civil liberties groups to oppose the Pass ID Act, a bill that intends but fails to fix the flawed Real ID Act of 2005 - which was designed to turn the state driver’s license into a national identity card.

The coalition letter was sent in preparation for a hearing scheduled for TODAY on the Pass ID Act and includes principles that should guide Congress in repealing, not fixing, the Real ID Act of 2005 so that effective driver’s license policy can be developed. While Pass ID eliminates many of the more costly Real ID requirements for the states, it leaves intact the same fundamental structure created by Real ID.

Click here for a recent fairly detailed post of mine comparing REAL ID with PASS ID.

As I have posted on here, I'm afraid to say that even as PASS ID represents a break from, and an improvement of REAL ID, it simply isn't an acceptable alternative to those that cherish privacy and are concerned with the ever expanding power of government in areas related to "national security". The fact is, PASS ID continues the one key component of REAL ID that privacy advocates were most opposed to: the creation of a national identification card.

And that is where my "bad news" comes into play. Not only is PASS ID unacceptable, but its also supported by President Obama and Homeland Security Secretary Janet Napolitano.

For the sake of today though, let's focus on this new 18 group and counting coalition opposing PASS ID, which includes, in addition to the ACLU: Campaign for Liberty, Citizens Against Government Waste, Consumer Action, Cyber Privacy Project, DownsizeDC.org, Inc., Electronic Frontier Foundation, Equal Justice Alliance, Leadership Conference on Civil Rights, Liberty Coalition, National Immigration Law Center, National Network to End Domestic Violence, Privacyactivism, Privacy International, Privacy Journal, Privacy Rights Clearinghouse, Rutherford Institute and U.S. Bill of Rights Foundation.

Unfortunately, very little media attention is being given to this issue yet, or likewise, this coalitions efforts. So, let me communicate their primary concerns before I get to the rather dinky article by the Associated Press regarding this emerging privacy fight (which barely mentions them or their concerns).

These privacy advocates believe that in the most significant measures the Pass ID Act is the same as the Real ID Act. Beyond creating a National ID, both the bill and the law invade American’s privacy, endanger victims of domestic violence by failing to adequately shield their addresses, raise fees associated with identification cards, expose consumers to identity theft and fail to boost security.

Like the privacy groups, many states oppose the de facto national ID as a waste of state tax dollars that will put privacy at risk without any security benefits. Since the Real ID Act passed, 14 states have passed statutes barring participation and 24 states in total have rejected the 2005 law.

With that, here's a few clips from the Associated Press on Senate developments:

Leading senators from both parties expressed a willingness Wednesday to revamp the nation's stalled plan to secure driver's licenses in an effort to thwart terrorists. But some senators raised concerns about elements of a new plan supported by the Obama administration.

...

The National Governors Association estimates the current law would cost states $4 billion while the new plan could cut the costs to between $1.3 billion and $2 billion. Sen. Daniel Akaka, D-Hawaii, introduced the Pass ID legislation last month. Akaka and other members of the Homeland Security committee would like to get a version of the bill passed before the end of the year.

...

The Pass ID, by contrast, would not put the home addresses of victims of domestic violence or people in the witness protection program on licenses. Pass ID also would not require that birth certificates be confirmed with the agency that issued them...Unlike the Real ID plan, the Pass ID plan would not require that people have the new driver's licenses to board airplanes. Sen. Susan Collins, R-Maine, expressed concerned this could undermine the purpose of having a secure driver's license.

...

Under the current law, states have to certify by Dec. 31 they are complying with the Real ID standard to validate immigration status in order to issue a driver's license. Residents of states that don't follow the new standard will not be allowed to board airplanes with their driver's licenses after the end of this year. Napolitano said the Bush administration program is unrealistic because it's too expensive, and the technology necessary to meet the security standards is not available.

...

Civil liberties groups say the Pass ID would violate privacy rights in the same way the Real ID does. Twenty-four advocacy groups for privacy and other causes — including the American Civil Liberties Union, Citizens Against Government Waste and the National Network to End Domestic Violence — sent Congress a letter opposing both identification programs.

So it appears - while the worst is over (REAL ID) - the "national identification card battle" has been reignited. Stay tuned...

Napolitano Endorses PASS ID and EFF Files Lawsuit Against the Justice Department

I'm going to keep this short and sweet today. For a detailed analysis of the recently introduced “Providing for Additional Security in States’ Identification Act” (PASS ID), check out my post from Friday.

I'm afraid to say - as I stated on Friday - even as PASS ID represents a break from, and an improvement of REAL ID, it simply isn't an acceptable alternative to those that cherish privacy and are concerned with the ever expanding power of government in areas related to "national security". The fact is, PASS ID continues the one key component of REAL ID that privacy advocates were most opposed to: the creation of a national identification card.

Unfortunately, as reported in Federal Computer Week, Homeland Security Secretary Janet Napolitano - a former opponent of REAL ID - has endorsed PASS ID. A point I've made numerous times on this blog over the past few months, is that as Governor of Arizona, Napolitano had a decidedly mixed record on privacy. In that context, her announced support for PASS ID comes as no major surprise.

FCW reports:

Napolitano, as governor of Arizona, had a mixed record on Real ID. In June 2008, she signed legislation passed by the Arizona State Legislature to prohibit the state from complying with Real ID. However, in August 2007, Napolitano was one of the first governors to reach an agreement with the Homeland Security Department to produce an enhanced driver’s license that would also serve as a substitute for a U.S. passport at the U.S.-Mexico border.

These licenses, which are now being produced in Washington State, New York and Vermont, are designed to comply with Real ID. The National Governors Association has praised Pass ID, saying it would reduce costs, offer greater flexibility to states, eliminate the need for costly new data systems and strengthen privacy protections. However, the American Civil Liberties Union said risks to privacy are still a major concern under Pass ID.

I'll be covering the progress of this legislation right here...

Electronic Frontier Foundation Files Suit Against Justice Dept.

Where would we be without organizations like the ACLU and EFF??? Seriously! In yet another laudable effort to take on, and expose the most entrenched corporate and government powers on behalf of individual privacy, EFF has filed a lawsuit against the Justice Department demanding the public release of the surveillance guidelines that govern investigations of Americans by the FBI.

The National Journal's "Tech Daily Dose" reports:

The protocols took effect in December 2008 and detail the bureau's procedures and standards for implementing the attorney general's guidelines on approved surveillance strategies. The Electronic Frontier Foundation's complaint comes after DOJ failed to respond to a Freedom of Information Act request for a complete copy of the document. FBI General Counsel Valerie Caproni has acknowledged that "the expansion of techniques available [to the bureau] has raised privacy and civil liberties concerns."

Investigations can include the electronic collection of information from online sources and computer databases, as well as the use of grand jury subpoenas to obtain telephone and e-mail subscriber information, EFF said in a press release. Other recent policy changes allow the FBI to engage in free-ranging investigation of Internet sites, libraries, and religious institutions, the group said.

"Americans have the right to know the basic surveillance policies used by federal investigators and how their privacy is -- or is not -- being protected," EFF senior counsel David Sobel said. Read EFF's full complaint to the U.S. District Court for the District of Columbia here.

As with PASS ID, I will follow this case here, and provide more details in coming posts.

PASS ID Versus REAL ID: An Inadeqaute Fix

As I always do when discussing REAL ID, before I get to the articles I want to highlight, I like to give a quick refresher course on the Act and the state revolt that it inspired:

The Real ID Act was approved by Congress - underhandedly as a rider - and then signed into law by President Bush in 2005 as part of the government's so called "war on terror".

At the time, few lawmakers even knew what they were voting for, or necessarily supported the concept to begin with. Since that time the law has evoked widespread criticism from privacy advocates and civil rights groups, which say it would create a de facto national identity card system that would be hard to manage and even harder to secure. The law requires states to issue new licenses which are supposed to screen potential terrorists and identify illegal immigrants.

Electronic Frontier Foundation (EFF) sums up the concerns of privacy advocates thusly:

Once the IDs and database are in place, their uses will inevitably expand to facilitate a wide range of surveillance activities. Remember, the Social Security number started innocuously enough, but it has become a prerequisite for a host of government services and been co-opted by private companies to create massive databases of personal information. A national ID poses similar dangers; for example, because "common machine-readable technology" will be required on every ID, the government and businesses will be able to easily read your private information off the cards in myriad contexts.

The States Rebel!

Since the law's enactment, at least 42 states have considered anti-Real ID legislation, and another 24 states have enacted anti-real ID bills or resolutions, and fourteen of those states have passed binding legislation prohibiting participation in the Real ID program. Five more states have already passed resolutions or statutes in 2009 - with Missouri likely becoming the next state to opt out of Real ID if its governor signs legislation currently before him.

Initially, States had until May of 2008 to implement Real ID, but the department extended that until Dec. 31, 2009. If they need more time and have met certain benchmarks, states can request an extension until May 11, 2011.

For everything that's wrong with the REAL ID Act, check out the REAL NIGHTMARE site.

The Birth of PASS ID

The Obama Administration has recently begun voicing its opposition to key components of REAL ID. This fact, combined with overwhelming state opposition, and the fast approaching deadline they face for implementation, has led to a renewed debate in the Senate as to whether it should be abolished altogether, or simply take a modified, more "mild" form, known as PASS ID?

Senator Daniel Akaka (D-HI) - seeking to reform the REAL ID Act - introduced the “Providing for Additional Security in States’ Identification Act” (PASS ID) last week with 5 co-sponsors, offering some important privacy protections, most notably, eliminating interconnected databases and repealing the requirement that states query other states or verify birth certificates with the originating agencies. The bad news is, PASS ID could ultimately become the basis for a National ID.

I would echo the comments made by the ACLU'S Chris Calabrese, Counsel of the ACLU Technology and Liberty Program:

“Senator Akaka is right in his efforts to eliminate a substantial number of the more problematic aspects of Real ID, including the creation of a national database of driver information and misuse of license information by the private sector...Any day now, we will have fully half of all states on record opposing Real ID. We agree with Secretary of Homeland Security Napolitano that the best solution to the Real ID Act is to repeal it.”

With all this said, let me get to my two featured "articles" today. Joan Friedlan, focuses on the anti-immigrant aspect of PASS ID in a piece entitled "The Real ID Act Is an Unfixable Disaster...Why Tinkering with it Won't Help". In this clip, she points out some of the disturbing similarities shared by PASS ID and REAL ID, which include:

Make non-citizens prove lawful immigration status to get a license. Immigration law is complicated, contradictory and ever-changing, so it is not surprising that REAL ID left out some categories of lawfully present immigrants who should be eligible for a license—such as trafficking—victim applicants for non-immigrant visas or those protected under the Convention against Torture.

PASS ID attempts to cure some of these deficiencies, but at the same time gives DHS unreviewable discretion to add categories of lawfully present non-citizens, leaving open the possibility that this might be done in a discriminatory or irrational way. States will likely find a shifting list of eligible immigration statuses to be confusing and cumbersome.

Recognize that exceptional circumstances – e.g. Hurricane Katrina – can make it impossible for people to provide the required documents for a license. States can set up an “exceptions process” to deal with this. But states can’t do the same for immigration status, even if people lose their documents proving immigration status in the very same disaster.

Require a passport as the only foreign document that can be used to prove identity and date of birth for a driver’s license—even though other documents such as birth certificates and school records can be used in actually obtaining legal status.

On a similar note, the ACLU has published a one page fact sheet that sums up quite nicely exactly why PASS ID is an inadequate fix for REAL ID. Here are a couple useful highlights:

PASS ID would impose the United States' first-ever national identity card system, which would violate privacy by helping to consolidate data and facilitate tracking. After a 5-year hiatus to allow for implementation, PASS ID will be required for boarding airplanes in the same manner as Real ID, and over time its use will almost certainly expand to cover other activities necessary to participate in society.

PASS ID mandates that all identity source documents be copied physically or digitally and retained as long as the license is valid. By creating troves of sensitive documents on millions of individuals, this provision will be a dream for identity thieves.

In a provision that is actually worse than Real ID, PASS ID will allow insecure technology such as radio RFID chips to be used as part of PASS ID, despite the strong potential that technology holds for tracking of individuals' movements. While PASS ID makes some concessions for the security of domestic violence victims, it still requires victims to get approval from the state before they can shield their identity.

Click here to read the fact sheet in full.

Again, I will defer to the ACLU on this, as I just couldn't agree more with the conclusion they reach on REAL ID, PASS ID, and what appears to be in the end, the government's continued efforts to march us, slowly but surely, towards a national identification card:

This legislation is entirely unnecessary because, thanks to the rebellion in the states, the Real ID Act is already dead...Rather than saving Americans from the Real ID legislation that they have rejected in such large numbers, PASS ID would actually rescue the core policies of Real ID at a time when it is about to die of its own misguided impracticality.

The problems inherent in Real ID cannot be solved by tinkering around the edges of the act. Instead, the entire unworkable system must be scrapped and replaced with a system that does not endanger Americans' privacy and civil liberties, such as a "negotiated rulemaking" process that brings together stakeholders to hash out wise and realistic improvements to driver's licenses (such a process was underway before Real ID shut it down). The PASS ID Act creates more problems than it solves, and it should not be viewed as a viable alternative to a true repeal of Real ID.

Perhaps the most important step Congress could take is to engage the American people in a real debate as to the value of a national ID. Remember, REAL ID was passed without that debate, and with fear as the trump card, and slipped deeply into a spending bill that funded the war and tsunami relief.

William Jackson of Government Computer news sums up this line of thinking nicely:

If the American people and their representatives agree that creation of some form of national ID makes sense, the government can then take steps to implement it in a way that is fair, reasonable and secure. But if we decide that people should not need papers to travel freely within the borders of their own country, the issue of creating and securing state databases of personally identifiable information becomes moot.

In the meantime, I'm afraid to say, that even as we are taking steps away from adopting the REAL ID concept as first proposed, we continue (with PASS ID anyway) moving towards something nearly as unnacceptable: a national identification card. Stay tuned...

Obama Administration to Scale Back Real ID Law

The Obama Administration has now finally taken a concrete stand (against) on the beleaguered, privacy invasive program known as the REAL ID Act. As I've been repeating on this blog over and over, little was known about how Obama was going to proceed on this issue, which was made all the more mysterious after he chose Gov. Janet Napolitano as Secretary of Homeland Security.

The reason being of course that Napolitano had a VERY spotty record on the issue of privacy while Governor of Arizona, and while she did oppose REAL ID, she only did so because of her belief that it was too expensive and burdensome for the states to implement. So the big question in my mind has been whether the Administration would continue the REAL ID program, and if so, in what form, and if not, for what reasons?

The good news is - as reported in the Washington Post- that the Administration doesn't appear to be interested in continuing the program. On the other hand, it doesn't seem willing to simply abolish it altogether either (as privacy advocates would like to see).

Before I get to the article, let me give you a quick refresher course on the Act and the state revolt that it inspired. The Real ID Act was approved by Congress - underhandedly as a rider I might add - and then signed into law by President Bush in 2005 as part of the government's effort to combat terrorism.

At the time, few lawmakers even knew what they were voting for, or necessarily supported the concept to begin with. Since that time the law has evoked widespread criticism from privacy advocates and civil rights groups, which say it would create a de facto national identity card system that would be hard to manage and even harder to secure. The law requires states to issue new licenses which are supposed to screen potential terrorists and identify illegal immigrants.

This new federal identity document would be required of every American in order to fly on commercial airlines, enter government buildings, open a bank account, and more.

The common reaction from citizens and states across the country has centered on the threat it would pose to individual privacy, the high costs states would incur to implement it, the increased danger of identity theft, and the possible loss of freedoms due to expanded government power. For everything that's wrong with the REAL ID Act, check out the REAL NIGHTMARE site.

The Washington Post Reports on the latest developments:

Homeland Security Secretary Janet Napolitano wants to repeal and replace the controversial, $4 billion domestic security initiative known as Real ID, which calls for placing more secure licenses in the hands of 245 million Americans by 2017. The new proposal, called Pass ID, would be cheaper, less rigorous and partly funded by federal grants, according to draft legislation that Napolitano's Senate allies plan to introduce as early as tomorrow.

The new plan keeps elements of Real ID, such as requiring a digital photograph, signature and machine-readable features such as a bar code. States also will still need to verify applicants' identities and legal status by checking federal immigration, Social Security and State Department databases.

But it eliminates demands for new databases -- linked through a national data hub -- that would allow all states to store and cross-check such information, and a requirement that motor vehicle departments verify birth certificates with originating agencies, a bid to fight identity theft.

Instead, it adds stronger privacy controls and limits such development to a pilot program in Mississippi. DHS would have nine months to write new regulations, and states would have five years to reissue all licenses, with completion expected in 2016.

...

Pass ID also penalizes states that have spent millions to digitize their records, rewards laggards with federal funds and makes new requirements unenforceable, foes said. For example, the new bill kills provisions that would have required the new IDs to board airplanes and that IDs that did not comply with the requirements feature a different color or design.

Meanwhile, privacy groups also objected, saying Real ID should just be killed. "We don't want to end up with National ID Lite," said Chris Calabrese, counsel to the technology and liberty program at the American Civil Liberties Union.

Jim Harper, director of information policy studies at the libertarian Cato Institute, said the plan is "a lot softer" but will still leave more Americans' personal data subject to theft and misuse. Sens. Daniel K. Akaka (D-Hawaii) and George V. Voinovich (R-Ohio), the bill's sponsors, are seeking support from Sens. Joseph I. Lieberman (I-Conn.) and Susan Collins (Maine), the chairman and ranking Republican, respectively, on the Senate homeland security committee, and other centrist lawmakers. So far, no other Republicans have signed on.

So the "centrist theme" of the Obama Administration continues. In this case, while I'm relieved that the REAL ID Act - as once conceived at least - is finally dead, I'm once again disappointed in the Administration's reluctance to take a stronger stance in defense of the principle of privacy as well as its rather weak opposition (or worse...outright support of) to a host of Bush Administration policies that were privacy invasive at the least, and blatantly un-Constitutional (wiretapping being another example) at the worst.

I will have more to say on this "Pass ID" concept floated by the Administration once I get more information and consult some of my "go to" experts. Personally, I think the most welcomed aspect of this announcement is that the REAL ID proposal to create one super database - linked through a national data hub - has been scrapped.

But more on this coming soon...

What's the future of the Real ID Act under Obama?

This issue has been dead for quite sometime, and it appears to be making some headlines again now that the Obama Administration and Homeland Security's new secretary, Janet Napolitano, are beginning to give some hints at how they're going to deal with the headache known as the REAL ID Act. Click here to read the posts I've done on this issue in the past.

As I mentioned on January 5, 2009, little is known about how the Obama Administration was going to proceed on REAL ID, writing:

"Making the issue - and how it all will play out - all the more unknown is the incoming Obama administration and his Secretary of Homeland Security Gov. Janet Napolitano. I say this because, as I have mentioned in previous posts here, we know very little about where Obama stands on REAL ID, or what he intends to do about this beleaguered, privacy invasive program. Further, Gov. Janet Napolitano has a VERY spotty record on the issue of privacy, yet she did oppose REAL ID as the Governor of Arizona (but only because it was expensive, not because it invaded privacy).

So all in all we are left with one big question mark as to how this program will or will not evolve. The good news is, if states keep refusing to comply, as Virginia is apparently going to attempt to do again, we'll be in good shape."

Just for a quick refresher course on the Act and the state revolt that it has inspired:

The Real ID Act was approved by Congress - underhandedly as a rider I might add - and then signed into law by President Bush in 2005 as part of the government's effort to combat terrorism. At the time, few lawmakers even knew what they were voting for, or necessarily supported the concept to begin with. Since that time the law has evoked widespread criticism from privacy advocates and civil rights groups, which say it would create a de facto national identity card system that would be hard to manage and even harder to secure.

The law requires states to issue new licenses which are supposed to screen potential terrorists and identify illegal immigrants. However, it carries with it grave privacy risks, not to mention it will be expensive for states to implement and it could potentially restrict summer travel.

Essentially it would create a national identity card and impose numerous new burdens on taxpayers, citizens, immigrants, and state governments – while doing nothing to protect against terrorism. This new federal identity document would be required of every American in order to fly on commercial airlines, enter government buildings, open a bank account, and more.

The common reaction from concerned public citizens across the country has centered on the threat it would pose to individual privacy, the high costs states would incur to implement it, the increased danger of identity theft, and the possible loss of freedoms due to expanded government power.

For everything that's wrong with the REAL ID Act, check out the REAL NIGHTMARE site.

Now for the latest hints on the Act's future in an Obama Administration...as expected they are taking a "it costs too much" opposition argument rather than a privacy protection one. This is unfortunate...but better than we had under the Bush Administration.

The UK's "The Register" article entitled "Real ID law to receive makeover under Obama" states:

The ex-governor of Arizona, tapped as chief homeland spook by Obama in January, has been an outspoken adversary of the law since its introduction as a rider act for the "Emergency Supplemental Appropriations Act for Defense, the Global War on Terror, and Tsunami Relief, 2005."

Revisions to the law being proposed by Napolitano and other officials, however, appear to be motivated by the cost of implementing the law, rather than out of concern for the privacy of American citizenry or states' rights.

...

While the law allows each state to continue issuing non-complying IDs, the old cards must carry a unique design and be clearly marked to show they cannot be accepted for any federal purpose. But the usefulness of non-complying cards is rather put into question by the federal government's running the show at US borders and security check-ins at the country's airports.

Furthermore, the Act specifies needing a Real ID to enter a federal building or nuclear power plant - but leaves the true scope of what is considered an "official purpose" as an ambiguity. For some officials, it's a tempting opportunity to use the system to track more mundane activities such as purchasing over-the-counter medicines as a means to bust meth labs.

...

Presently, all 50 states have received extensions to the original May 11, 2008 deadline. A few holdout states (http://www.theregister.co.uk/2008/03/25/real_id_revolt/) such as California, Montana, Maine, and South Carolina have either refused to commit to the plan or even passed resolutions not to participate. The current deadline for when all US citizens aged 50 years or younger must have a Real ID license is May 2011.

Electronic Frontier Foundation (EFF) sums up the concerns of privacy advocates perfectly:

Once the IDs and database are in place, their uses will inevitably expand to facilitate a wide range of surveillance activities. Remember, the Social Security number started innocuously enough, but it has become a prerequisite for a host of government services and been co-opted by private companies to create massive databases of personal information. A national ID poses similar dangers; for example, because "common machine-readable technology" will be required on every ID, the government and businesses will be able to easily read your private information off the cards in myriad contexts.

As we move forward on this issue we must also be aware that Napolitano has also advocated for states rights to individually implement so-called "enhanced driver's licenses," which include an embedded RFID chip that allows for remote tracking.

So we are by no means out of the woods.

Click here to read the article in its entirety.

Privacy Rights Groups Sound Alarm Over DMV Attempt to Bypass Legislative Process

Today I get to report on something we at the CFC are directly involved in.

Let's start from the beginning of what has now been a few days of hurried activity among a coalition of organizations to stop a rather blatant attempt by the California DMV and the California Department of Finance to bypass proper legislative oversite.

On January 14th the California Department of Finance – without notifying the public – sent a letter to inform the state Joint Legislative Budget Committee that it planned to issue a new vendor contract for production of California Driver’s Licenses, ID cards and Salesperson cards starting in June of 2009.

Hidden in the fine print, the proposal called for “enhanced” biometric identification in state IDs. Unless this legislative committee objects to this plan within 30 days, the Department of Motor Vehicles will be free to begin implementing the biometric technology.

What are Biometrics?

Biometric technology is the computerized matching of an individual’s personal characteristics (like a thumbprint or facial scan) against an image or database of images. In other words, the DMV and the Department of Finance are seeking to create a massive government database of biometric information from virtually every Californian over the age of 16 without debate or review - raising significant concerns regarding the increased surveillance, monitoring and tracking of individuals.

One would expect, in light of the ongoing and intensifying debate over the REAL ID Act (a federal plan to create a national identity card based on drivers’ licenses) and the increasing number and degree of privacy violations committed by the federal government in recent years, that such a program would be fully debated, in the open, by our representatives in the State Legislature and with public comment, before it could ever be enacted.

Because no such debate has occurred, and no attention has been given to the privacy concerns such a program warrants, the Consumer Federation of California has joined organizations from across the political spectrum – including the ACLU, Liberties Union, Electronic Frontier Foundation, California Eagle Forum, Consumers Union, Privacy Activism, Privacy Rights Clearinghouse, and the World Privacy Forum - to urge the legislature to reject this request while there’s still time.

Our case against the proposal is twofold.

(1) The first is procedural: the DMV is attempting to use a routine contract renewal process to effectuate major policy changes. As the ACLU notes:

• A 30-day expedited opt-out letter to the Legislature is an inappropriate vehicle to move from photographs and thumbprints of millions of Californians to advanced facial recognition technology and biometric systems that pose a number of privacy and security concerns if not handled carefully.

• The DMV does not appear to have authority to implement biometric technologies that the Legislature has considered and rejected over the years, without the issues being fully considered and addressed in policy and budget hearings.

(2) The second relates to privacy and security: the underlying proposal to use biometric technologies has yet to establish appropriate safeguards to protect against identity theft and unwarranted government snooping into our private lives.

It’s important to understand the limitations of biometrics as well as their strengths. The fact is, biometrics are easy to steal. Our fingerprints are left everywhere we touch, and our iris scans are everywhere we look.

According to experts, biometrics work only if two things can be verified by the verifier: one, that the biometric came from the person at the time of verification, and two, that the biometric matches the master biometric on file. If the system can't do that, it can't work.

Once again, the ACLU provides some critical insights:

• Where a biometric identifier is used as a unique identifier to catalogue personal information about an individual, it would enable the surveillance, monitoring and tracking of individuals. Law enforcement currently has access to DMV’s database of more than 25 million people. It appears that the biometric thumbprints and facial scans from the DMV will be used in criminal investigations. As public and private surveillance cameras become more ubiquitous, the likelihood increases that use of facial recognition devices will go beyond legitimate criminal investigations and become a tool to track and record the movements of innocent people.

• If a biometric database is hacked, an identity thief could substitute his or her fingerprints or facial scan in someone else’s file. Security of any biometric database is a paramount concern that should be addressed in a public legislative hearing process, not by massively expanding the scope of work in a routine contract renewal notice from Department of Finance.

• It is far from clear that biometric imaging as proposed by DMV is required by the Real ID Act. While the Bush Administration’s Department of Homeland Security was pushing for biometric facial image capture, it did not require biometric finger printing. The Obama Administration has already committed to revisiting Real ID. Today, there is no federal impetus behind this move by the DMV.

• How does California pay for the whole new system? The Department of Finance memo speaks of “significantly higher cost of doing business in the current market and economic environment” as compared to the last vendor contract issued ten years ago. At a time when California is going broke, can we afford the immediate projected costs of $4.3 million in this fiscal year, and estimates of $12.5 million per year in each subsequent year?

Which teachers and police officers will be laid off to cover the added costs of a system that the legislature never approved?

Bruce Shneier, president of Counterpane Systems, and author of Applied Cryptography, is considered to be one of the nation’s foremost experts on biometrics. In January of this year he wrote:

“We haven't yet had an example of a large biometric database being hacked into, but the possibility is there. Biometrics are unique identifiers, but they're not secrets.”

Schneier continues:

“One more problem with biometrics: they don't fail well. Passwords can be changed, but if someone copies your thumbprint, you're out of luck: you can't update your thumb. Passwords can be backed up, but if you alter your thumbprint in an accident, you're stuck. The failures don't have to be this spectacular: a voiceprint reader might not recognize someone with a sore throat, or a fingerprint reader might fail outside in freezing weather. Biometric systems need to be analyzed in light of these possibilities.”

Joint Legislative Budget Committee Must Reject Proposal by February 11!

Our coalition is therefore urging the Joint Legislative Budget Committee to object to the DMV’s proposal to impose sweeping new biometric technologies as an element in a renewal of a vendor contract to produce driver’s licenses and ID cards. A change of this magnitude should be a policy matter for the legislature to decide, after considering whether it is effective, affordable, and if it contains the appropriate privacy safeguards.

For more information on biometrics, check out this article by Bruce Schneier.

Virginia to join list of states to reject Real ID?

Despite failing in numerous attempts last year, some Virginia legislators are back in hopes of garnering enough votes to join the growing chorus of states that have defied the federal government by refusing to participate in a national identification program - also known as REAL ID.

The two pieces of legislation in question when lawmakers return to Richmond on Jan. 14 would call for Virginia to ignore the federal mandate to come into compliance with the Real ID Act by the beginning of next year. The looming deadline for state compliance should give the issue new urgency for not just Virginia, but for dozens of others that have yet to take a stand.

Making the issue - and how it all will play out - all the more unknown is the incoming Obama administration and his Secretary of Homeland Security Gov. Janet Napolitano. I say this because, as I have mentioned in previous posts here, we know very little about where Obama stands on REAL ID, or what he intends to do about this beleaguered, privacy invasive program. Further, Gov. Janet Napolitano has a VERY spotty record on the issue of privacy, yet she did oppose REAL ID as the Governor of Arizona (but only because it was expensive, not because it invaded privacy).

So all in all we are left with one big question mark as to how this program will or will not evolve. The good news is, if states keep refusing to comply, as Virginia is apparently going to attempt to do again, we'll be in good shape.

Virginia News reports:

Since the law's enactment in 2005, at least 42 states have considered anti-Real ID legislation, and more than half have passed measures either forbidding their states from participating or urging Congress to amend or repeal the law. At least five states have gone the other direction, passing bills bringing their programs into compliance. Critics say they expect other states to join Virginia in 2009 to fight against Real ID.

...

States had until May of 2008 to implement Real ID, but the department extended that until Dec. 31, 2009. If they need more time and have met certain benchmarks, states can request an extension until May 11, 2011.

"The bottom line is that citizens of states who do not move forward with the Real ID mandate from Congress will see real consequences," said Laura Keehner, a spokeswoman for the Department of Homeland Security, which is in charge of the program.

...

Critics also claim Real ID diminishes privacy and they object to a national ID that would have to be shown for everyday identification purposes.

"Certainly people should be identified by high standards when that's called for, but it's not called for when you're going to buy beer," said Jim Harper, director of information policy studies for the Cato Institute, a libertarian think tank. "If we're going to have our identity recorded every time we buy beer or use a credit card or buy gas, that turns into one big surveillance system," he said.

One quick remark on the "politics" of this issue. The good news when it comes to the issue of privacy - and I can say this through direct experience on issues ranging from RFID to the sharing of prescription medical records - is the growing coalition that unites both the conservative side of the spectrum with the progressive.

In some ways it appears it's the "middle" of the ideological spectrum that is most absent in this all important debate. But, the fire and passion most definitely is found in the opposing "base's of support", and they (we) agree on something: privacy is a constitutional right.

Click here to read the article in its entirety.

How bad of a mess is Obama inheriting with Real ID?

I just want to briefly follow up on my December 12th post that delved into the question where Obama/Napolitano might stand in regards to REAL ID. In that post, I made the point that we really don't know a whole lot about how the new administration will approach the program. I stated:

Here's what we do know: Janet Napolitano opposed REAL ID as Governor of Arizona, but did so on the grounds that it was too expensive and burdensome for the states to implement. I have yet to read any strong statement from the Director of Homeland Security to be on the issue of privacy and the concept of a National ID card...Making matters worse, or at least less clear, is President Elect Obama's near silence on the issue, with a couple quips here and there about "it being too expensive and burdensome for states", (I'm paraphrasing). Again, this isn't exactly the kind of condemnation and outright opposition we would hope for.

I found a useful addendum to that post in an article written by the same author in Computerworld today. Let's just say the program is an unadulterated mess...

Jaikumar Vijayan writes:

As President-elect Barack Obama prepares to take office, it's unclear how his administration will proceed on the technology-heavy Real ID program. But what is all too clear is that the three-year-old effort to impose identification-card standards on state governments remains mired in controversy.

...

There's no mandate that states issue Real ID cards. But eventually, all citizens will need IDs that comply with the requirements in order to board planes, enter federal buildings and receive federal benefits.

The outpouring of protests has prompted the DHS to ease up on its implementation deadlines. For instance, under the final rules set by the agency last January, existing driver's licenses will continue to be accepted as federal identification until December 2014. And people who are age 50 or above at that time won't have to show Real ID cards for another three years.

...

At this point, the only reasonable way forward is for the DHS to work more cooperatively with states on Real ID implementations instead of continuing to "dangle sabers over their heads," said Chris Dixon, an analyst at Input, a government IT consulting firm in Reston, Va.

I think it goes without saying that an Obama/Napolitano team will bring with it a lot more common sense and basic respect and understanding of the Constitution...but big questions still remain...like are we still headed towards a National ID?

Click here to read the article in its entirety.