Small Government Watch: States Balk At National ID Card Plan

[Taco John]

It's good to see when the system gets it right! Go States!


By SUZANNE GAMBOA
Associated Press

States are threatening to challenge in court and even disobey new orders from Congress to start issuing more uniform driver's licenses and verify the citizenship or legal status of people getting them.
There is concern among some states that they'll get stuck with a large tab to pay for implementing the new rules and that getting a driver's license will become a bigger headache for law-abiding residents.

"Governors are looking at all their options. If more than half of the governors agree we're not going down without a fight on this, Congress will have to consider changing this unfunded federal mandate," said Arkansas Gov. Mike Huckabee, vice chairman of the National Governors Association. A Huckabee aide said the options include court action.

States fear the new rules may force applicants to make more than one trip to motor vehicle departments, once to provide documents such as birth certificates that states must verify and a second time to pick up the license, state officials said.

"What passed is something that will be an enormous amount of work and it's questionable what it's going to yield," said Democrat Matt Dunlap, Maine's secretary of state. "Is it going to yield national security or is it going to be hassle for people already complying with the law?"

The immigration requirements were attached to an $82 billion spending package for military operations and construction in Iraq and Afghanistan that the House passed last week. The Senate is expected to vote this week and send the bill to President Bush.

"We'd like to work with people to implement the needed reform and will be very disappointed if these groups thwart these important rules," said Jeff Lungren, spokesman for Wisconsin Republican Rep. James Sensenbrenner, who wrote the new requirements.

Sensenbrenner said last week that waiting a little longer in line is "a small price to pay" to prevent future terrorism.

All but one of the 19 hijackers in the Sept. 11, 2001, attacks had some form of U.S. identification, some of it fraudulent, the Sept. 11 Commission found. The commission recommended the federal government set standards for birth certificates and other identification documents, including driver's licenses.

Some states already have been increasing their license requirements, but their work may not be enough.

Maine's motor vehicle department is upgrading its computer system. But the upgrade doesn't include computer coding to comply with at least one of the new rules: ensure driver's licenses issued to temporary legal residents expire when the resident's authorized time in the U.S. is up.

"That adds to the cost and throws everything into the woods," Dunlap said.

Virginia's motor vehicle department estimated it would have to spend $237 million to comply with the bill passed by the House if it maintains its current level of customer service. Some changes to the final legislation could alter the estimate, a spokeswoman said.

The bill allows the Homeland Security secretary to offer grants to help states to comply, but doesn't provide money.

States will have three years after the president signs the bill to obey the rules. If they don't, their residents won't be able to board planes or enter federally protected buildings.

States also question how they will verify birth certificates, whose appearance vary widely by state and county. Dunlap said his state has only a portion of birth certificates online.

Thirty-six states and the District of Columbia verify Social Security numbers online with the federal government or by another method, said Mark Lassiter, Social Security Administration spokesman.

In fiscal 2004, which ended Sept. 30, Social Security handled 18 million verification requests, rejecting 2 million numbers, Lassiter said. But the system isn't foolproof.

California found many numbers were rejected for women who failed to change their name with when they married, said Bill Branch, motor vehicle department spokesman.

Another concern for states is preventing identity theft if licenses carry more information, said Michael Balboni, a Republican New York state senator. Balboni and Dunlap represented the National Conference of State Legislatures on a now defunct panel Congress created in December to design new driver's license rules. The conference opposes the new rules.

"What's so ironic about this bill is everybody agrees with the concept, one person, one driver's license," Balboni said. "How you get there is really the tough issue."

___

The bill is HR 1268

On the Net:

National Governors Association: http://www.nga.org

National Conference of State Legislatures: http://www.ncsl.org

Rep. James Sensenbrenner: http://www.house.gov/sensenbrenner/

© 2005 The Associated Press


http://www.capitolhillblue.com/artman/publish/article_6695.shtml

[Cochise]

Good, this is one thing that makes me really leery of what they plan on using it for down the road.

[Ultra Peanut]

Cool.

[Logical]

I wish they would require a US birth certificate for a National ID card and make the ID card mandatory. However making drivers licenses the national ID card seems a little problematic as many people legally obtain Drivers licenses who are not citizens. The Social Security card system seems to be a better candidate, but not perfect either.

[jAZ]

I don't understand why people are "afraid" of a Social Secuirty card with a photograph on it.

I'm in favor of exactly what they are doing... attempting to unify state issued ID cards in order to allow them to be used to establish an National ID system.

I don't see the point in recreating the wheel on this one, but I do see value in having a nationally recogized ID card.

I also don't have any problem with states telling the Fed to F-off until the fed funds these changes. It's not the state who has any interest in an ID card, it's certainly not on them to pay for changes to a system that as far as they are concerned, works exactly the way they want it right now.

[Taco John]

Moo.


http://cache.corbis.com/pro/crop4/images/consume/pg20.jpg

[Taco John]

http://www.schneier.com/crypto-gram-0404.html#1


As a security technologist, I regularly encounter people who say the United States should adopt a national ID card. How could such a program not make us more secure, they ask?

The suggestion, when it's made by a thoughtful civic-minded person like Nicholas Kristof in the New York Times, often takes on a tone that is regretful and ambivalent: Yes, indeed, the card would be a minor invasion of our privacy, and undoubtedly it would add to the growing list of interruptions and delays we encounter every day; but we live in dangerous times, we live in a new world....

It all sounds so reasonable, but there's a lot to disagree with in such an attitude.

The potential privacy encroachments of an ID card system are far from minor. And the interruptions and delays caused by incessant ID checks could easily proliferate into a persistent traffic jam in office lobbies and airports and hospital waiting rooms and shopping malls.

But my primary objection isn't the totalitarian potential of national IDs, nor the likelihood that they'll create a whole immense new class of social and economic dislocations. Nor is it the opportunities they will create for colossal boondoggles by government contractors. My objection to the national ID card, at least for the purposes of this essay, is much simpler.

It won't work. It won't make us more secure.

In fact, everything I've learned about security over the last 20 years tells me that once it is put in place, a national ID card program will actually make us less secure.

My argument may not be obvious, but it's not hard to follow, either. It centers around the notion that security must be evaluated not based on how it works, but on how it fails.

It doesn't really matter how well an ID card works when used by the hundreds of millions of honest people that would carry it. What matters is how the system might fail when used by someone intent on subverting that system: how it fails naturally, how it can be made to fail, and how failures might be exploited.

The first problem is the card itself. No matter how unforgeable we make it, it will be forged. And even worse, people will get legitimate cards in fraudulent names.

Two of the 9/11 terrorists had valid Virginia driver's licenses in fake names. And even if we could guarantee that everyone who issued national ID cards couldn't be bribed, initial cardholder identity would be determined by other identity documents... all of which would be easier to forge.

Not that there would ever be such thing as a single ID card. Currently about 20 percent of all identity documents are lost per year. An entirely separate security system would have to be developed for people who lost their card, a system that itself is capable of abuse.

Additionally, any ID system involves people... people who regularly make mistakes. We all have stories of bartenders falling for obviously fake IDs, or sloppy ID checks at airports and government buildings. It's not simply a matter of training; checking IDs is a mind-numbingly boring task, one that is guaranteed to have failures. Biometrics such as thumbprints show some promise here, but bring with them their own set of exploitable failure modes.

But the main problem with any ID system is that it requires the existence of a database. In this case it would have to be an immense database of private and sensitive information on every American -- one widely and instantaneously accessible from airline check-in stations, police cars, schools, and so on.

The security risks are enormous. Such a database would be a kludge of existing databases; databases that are incompatible, full of erroneous data, and unreliable. As computer scientists, we do not know how to keep a database of this magnitude secure, whether from outside hackers or the thousands of insiders authorized to access it.

And when the inevitable worms, viruses, or random failures happen and the database goes down, what then? Is America supposed to shut down until it's restored?

Proponents of national ID cards want us to assume all these problems, and the tens of billions of dollars such a system would cost -- for what? For the promise of being able to identify someone?

What good would it have been to know the names of Timothy McVeigh, the Unabomber, or the DC snipers before they were arrested? Palestinian suicide bombers generally have no history of terrorism. The goal is here is to know someone's intentions, and their identity has very little to do with that.

And there are security benefits in having a variety of different ID documents. A single national ID is an exceedingly valuable document, and accordingly there's greater incentive to forge it. There is more security in alert guards paying attention to subtle social cues than bored minimum-wage guards blindly checking IDs.

That's why, when someone asks me to rate the security of a national ID card on a scale of one to 10, I can't give an answer. It doesn't even belong on a scale.