Volgens Schneier:
The United States is getting a national ID card. The
REAL ID Act (text of the bill and the Congressional Research
Services analysis of the bill) establishes uniform standards
for state driver's licenses, effectively creating a national
ID card. It's a bad idea, and is going to make us all less
safe. It's also very expensive. And it's all happening
without any serious debate in Congress.
I've already written about national IDs. I've written about
the fallacies of identification as a security tool. I'm not
going to repeat myself here, and I urge everyone who is
interested to read those two essays (and even this older
essay). A national ID is a lousy security trade-off, and
everyone needs to understand why.
Aside from those generalities, there are specifics about
REAL ID that make for bad security.
The REAL ID Act requires driver's licenses to include a
"common machine-readable technology." This will, of course,
make identity theft easier. Assume that this information
will be collected by bars and other businesses, and that it
will be resold to companies like ChoicePoint and Acxiom. It
actually doesn't matter how well the states and federal
government protect the data on driver's licenses, as there
will be parallel commercial databases with the same information.
Even worse, the same specification for RFID chips embedded
in passports includes details about embedding RFID chips in
driver's licenses. I expect the federal government will
require states to do this, with all of the associated
security problems (e.g., surreptitious access).
REAL ID requires that driver's licenses contain actual
addresses, and no post office boxes. There are no exceptions
made for judges or police -- even undercover police
officers. This seems like a major unnecessary security risk.
REAL ID also prohibits states from issuing driver's licenses
to illegal aliens. This makes no sense, and will only result
in these illegal aliens driving without licenses -- which
isn't going to help anyone's security. (This is an
interesting insecurity, and is a direct result of trying to
take a document that is a specific permission to drive an
automobile, and turning it into a general identification
device.)
REAL ID is expensive. It's an unfunded mandate: the federal
government is forcing the states to spend their own money to
comply with the act. I've seen estimates that the cost to
the states of complying with REAL ID will be $120 million.
That's $120 million that can't be spent on actual security.
And the wackiest thing is that none of this is required. In
October 2004, the Intelligence Reform and Terrorism
Prevention Act of 2004 was signed into law. That law
included stronger security measures for driver's licenses,
the security measures recommended by the 9/11 Commission
Report. That's already done. It's already law.
REAL ID goes way beyond that. It's a huge power-grab by the
federal government over the states' systems for issuing
driver's licenses.
REAL ID doesn't go into effect until three years after it
becomes law, but I expect things to be much worse by then.
One of my fears is that this new uniform driver's license
will bring a new level of "show me your papers" checks by
the government. Already you can't fly without an ID, even
though no one has ever explained how that ID check makes
airplane terrorism any harder. I have previously written
about Secure Flight, another lousy security system that
tries to match airline passengers against terrorist watch
lists. I've already heard rumblings about requiring states
to check identities against "government databases" before
issuing driver's licenses. I'm sure Secure Flight will be
used for cruise ships, trains, and possibly even subways.
Combine REAL ID with Secure Flight and you have an
unprecedented system for broad surveillance of the population.
Is there anyone who would feel safer under this kind of
police state?
Americans overwhelmingly reject national IDs in general, and
there's an enormous amount of opposition to the REAL ID Act.
This is from the EPIC page on REAL ID and National IDs:
More than 600 organizations have expressed opposition to
the Real ID Act. Only two groups--Coalition for a Secure
Driver's License and Numbers USA--support the controversial
national ID plan. Organizations such as the American
Association of Motor Vehicle Administrators, National
Association of Evangelicals, American Library Association,
Association for Computing Machinery (pdf), National Council
of State Legislatures, American Immigration Lawyers
Association (pdf), and National Governors Association are
among those against the legislation.
And this site is trying to coordinate individual action
against the REAL ID Act, although time is running short.
It's already passed in the House, and the Senate votes tomorrow.
If you haven't heard much about REAL ID in the newspapers,
that's not an accident. The politics of REAL ID is almost
surreal. It was voted down last fall, but has been
reintroduced and attached to legislation that funds military
actions in Iraq. This is a "must-pass" piece of legislation,
which means that there has been no debate on REAL ID. No
hearings, no debates in committees, no debates on the floor.
Nothing.
Near as I can tell, this whole thing is being pushed by
Wisconsin Rep. Sensenbrenner primarily as an
anti-immigration measure. The huge insecurities this will
cause to everyone else in the United States seem to be
collateral damage.
Unfortunately, I think this is a done deal. The legislation
REAL ID is attached to must pass, and it will pass. Which
means REAL ID will become law. But it can be fought in other
ways: via funding, in the courts, etc. Those seriously
interested in this issue are invited to attend an
EPIC-sponsored event in Washington, DC, on the topic on June
6th. I'll be there.
http://www.schneier.com/blog/archives/2005/05/real_id.htmlhttp://www.epic.org/events/id/savethedate.html