Senators question smart card ID requirements: March 26, 2007 (IDG News Service) -- Senators and privacy advocates on Monday questioned a U.S. government plan to move ahead with smart card drivers license requirements, saying the cost will run into the billions of dollars and the cards could allow the government to track residents.

The Real ID Act, tacked onto a military spending bill in 2005, would require states to save digital copies of source documents such as birth certificates for drivers licenses and it would require states to share information in their drivers license databases. The goal of the new cards, which would include digital photographs and personal information in a machine-readable chip, would be to better ensure that the people carrying the ID cards are who they say they are.

Congress passed the Real ID Act in response to the Sept. 11, 2001, terrorist attacks on the U.S. The 9/11 Commission recommended that the government take steps to better ensure the validity of U.S. IDs. The pilot of the airplane that crashed into the Pentagon held three state drivers licenses, all of them fake, said Robert Barth, assistant secretary for policy development at the U.S. Department of Homeland Security.

"Real ID is fundamental to the security of our nation," Barth told the Senate Subcommittee on Oversight of Government Management.

But Senator George Voinovich, an Ohio Republican, complained that much of the cost for implementing Real ID would be passed on to states. DHS has estimated the cost of implementing Real ID at $14.6 billion over 10 years.

Voinovich also questioned how secure the cards would be. "You're going to be able to guarantee that information is going to remain private?" he asked Barth.

No one can guarantee that any data will be 100 percent secure, Barth answered, but a federal system would be "vastly, vastly" more secure than 50 separate state drivers license systems. "Whenever you have human beings involved ... you can't say there's zero risk," he said.

Voinovich pressed the question, asking if there were technological methods of defeating the proposed ID cards.

"We're going to provide the safeguards and do everything possible to prevent that from happening," Barth said.

Privacy advocates have also questioned the Real IDs, saying the data on the cards would allow the government to track citizens. "The machine readable zone on each Real ID license will provide a digital trail everywhere it is read," said Timothy Sparapani, legislative counsel for the American Civil Liberties Union.

Members of Congress have proposed that the Real ID card be required in order to vote, get a new job, obtain government benefits and travel on airplanes and trains, Sparapani said. "Senators should expect that no person would be able to function in our society without providing a Real ID-compliance license," he said.

In addition, the advocacy group the Center for Democracy and Technology said during a press briefing last week that the legislation doesn't restrict which employees of state drivers license bureaus can access the databases of private information. The Real ID act has no requirement for the security of the shared databases, said Jim Dempsey, CDT's policy director.

"The act doesn't mention the word privacy, and it barely mentions the word security," Dempsey said.

But Senator John Warner, a Virginia Republican, defended the Real ID Act. "We've got to come to the realization that the life before us is not the life behind us," he said. "We are facing some very, very serious threats."

(Via Computerworld Security News.)