Does Real ID really work?
The Real ID act was passed without significant debate, but the states saddled with the cost are forcing a public dialog on the question of a national ID.
SAN FRANCISCO ? The 2-year-old Real ID act was passed without significant public debate, but the states saddled with the cost of implementing the act are forcing a public dialog on the question of a national ID, according to Eric Rotenberg of the Electronic Privacy Information Center.
Rotenberg was part of an international panel discussing what works and what doesn't in government ID cards at the RSA IT security conference. There are more examples of what does not work than what does, and the Real ID card also has come in for its share of criticism.
"Privacy advocates are not against any kind of ID," Rotenberg said. "They're just against this form of identification."
Real ID establishes a de facto national ID by establishing national standards for state driver's licenses and ID cards. It mandates that states maintain accessible databases of documents used to establish identity but makes no provision for securing this data or controlling how data on the card is used.
Other countries have made similar missteps by making ambitious use of sophisticated cards. The United Kingdom is in the process of rolling out its own national smart ID card. Toby Stevens, director of the UK's Enterprise Privacy Group, said the card offers little return to the user for the expense and effort it will require.
"I'm a big fan of ID cards," he said. "It is inconceivable we can move forward in the electronic age without some strong method of authentication." But the U.K. card is built around national security rather than citizen convenience, he said. "They don't deliver any immediate benefit to me. Instead, it's going all to the state."
Australia is tackling the rollout of a new access card for health and social services, which will replace up to 17 existing cards for 16.7 million people. The card is defined primarily by what it is not, said Marie Johnson, chief technology architect of the Access Card Office.
"The access card is not an identity card," she said. It belongs to the person it is issued to and cannot be demanded by a government official. It will contain no history or records. It will have no address printed on it. The government has made a public relations effort to convince people that the new card will be benign and not pose a threat to privacy.
In this country, Maine has passed a resolution opposing the Real ID card, and other states are considering such actions.
"I think we're about to have a big debate in this country about Real ID and identification," Rotenberg said.
Rotenberg said that a good ID card, in addition to being securely tied to the person it is issued to, should be user controlled so that government cannot compel its use; make data available contextually, rather than making everything accessible in any transaction; and be protected with secure back-in processing.
William Jackson is a staff writer for Washington Technology's affiliate publication, Government Computer News.