WHO ARE YOU?

Immigration officials and law enforcement agents arrested 24 people and seized fake documents and counterfeiting equipment near the Adams-Morgan neighborhood of Washington, D.C. in early May. Officials seized 360 bogus green cards, 281 fraudulent social security cards, 70 fake employment authorization cards and 46 counterfeit driver’s licenses from California, Utah and Florida.

But even legally-obtained identification credentials can be problematic: The majority of the 19 hijackers on Sept. 11 had followed steps to obtain identification without raising any red flags.

Proposals are being heard in Washington and elsewhere about the need for a national ID card system, or at least a plan to improve our system of de facto identification cards — the state-level driver’s licenses.

Tools exist — from biometrics to smart cards — that are capable of increasing our nation’s security by ensuring the integrity of our citizens’ identification documents. But as proponents clamor for a standardized national ID system, others scramble to oppose it. While admitting that the events of Sept. 11 highlighted gaps in our Homeland’s defense, opponents see a national identification system as more knee-jerk reaction than an effective plan. Still, with identification so easily obtainable, a need to tighten existing standards — or create new ones — has evolved.

Nearly 114 countries already have a national identification system in place, and yet a broad-based national system seems somehow un-American. Arguments against this idea raise questions worthy of discussion: Who would an ID card protect? Would the system be mandatory? Who would have access to a cardholder’s information? Who would be responsible for logging, updating and maintaining the data?

Whether it be in the form of computer database, biometrics or smart card, technology is available to vastly transform how we identify people and what information we collect about them — how to use it is the question.

The Root of the Problem

Traditionally, so-called breeder documents — such as birth certificates and passports — are required to obtain state or government-issued identification, such as driver’s licenses and social security cards. Additionally, certified naturalization documents, immigration identification cards, passports, resident alien cards or valid employment authorization cards can also pass as breeder documents in obtaining government-issued identification. The nation depends on the validity of such breeder documents to verify identity, but all too often, these documents are compromised.

“The real hole in security systems today is that people are presenting false documents,” says Bill Thalheimer, CEO of Imaging Automation, a Bedford, N.H.-based supplier of authentication technologies.

In early June, someone broke into the Tacoma, Wash., Immigration and Naturalization Service (INS) inspection office, stealing four stamps used to allow foreigners to enter the U.S. Although the intent in that case was apparently not to steal INS equipment per se; in the wrong hands, the stamps could have potentially approved visas, visa extensions and temporary green cards — a result, investigators admitted, that could have facilitated forgery. If a false breeder document can pass to legally obtain government-issued identification, then the issue of identity has not been solved. Mike Shlasko, director of business development for Symbol Technologies, Holtsville, N.Y., says, one must be protected before the other. “If we can’t control visas,” for example, Shlasko says “we’re not going to be able to solve the problem of securing [any other government-issued] identification documents stemming from them.”

On December 19, 2001, the Document Security Alliance (DSA), an ad hoc group of industry leaders associated with ID-card document processes, met to discuss methods by which document security and security procedures could be improved. The DSA represents more than 60 companies and government agencies and consists of more than 80 members, including card and smart card manufacturers, biometric providers, system integration houses, security laminate/document providers, encryption organizations, data processing companies, proximity card providers and card printer manufacturers.

In its forum, a significant amount of time was spent on fraud associated with breeder documents. The meeting began with presentations by the U.S. Secret Service, where members reviewed cases and samples of document fraud. Accordingly, members agreed, the forensic task of determining document origin has become far more difficult.

Driver’s Licenses and Beyond

The identity discussion starts with our current system of state driver’s licenses. Driver’s licenses are already used to drive a car, buy cigarettes or alcohol, vote, establish a bank account or credit card, or board an airplane. Already required to secure transactions such as getting a job, cashing a check or buying a gun — it seems natural for driver’s licenses to be used for other security measures as well. “Federal and state governments have all agreed that driver’s licenses serve as an identification document — but it needs to be strengthened,” Shlasko says.

How to standardize and add functionality to state licenses is among the plans being discussed. An open question is how far should we go — or more accurately, how far do we need to go?

The American Association of Motor Vehicle Administrators (AAMVA) proposes standardization of our system of state driver’s licenses. Several congressmen and government advisory committees — such as the Office of Homeland Security — back this plan. Larry Bowne, chairman of the DSA and senior industry manager, identification systems for Eltron Card Printer Products, Camarillo, Calif., also serves as a representative on AAMVA’s Industry Advisory Board (IAB). Bowne represents the card printer unit on the IAB, and several AAMVA members are a part of the DSA.

“In relevance to the question of the rationale behind standardizing driver’s licenses,” Bowne says, “it relates to two issues” — from Homeland security to safer drivers.

But some proponents maintain a distinction between driver’s licenses and national ID cards. “If you’re trying to put this issue in with the national ID card debate,” says Jason King, a representative of the AAMVA, “then you’ve got it all wrong.” While King contends the driver’s license is the most widely used form of identification in the U.S. today, it was never intended to be so. The AAMVA is looking to Congress to mandate a more unified look to state’s driver’s licenses — not turn them into a national ID card. King admits that loopholes in our driver’s license framework are one of the biggest threats to our national security system. However, he quickly points out why driver’s licenses should not be used as a de facto national ID card — a national ID card is government-issued and mandatory; a driver’s license is state-issued and voluntary. “What we’re trying to do, while balancing both security and privacy,” King says, “is to strengthen the issuance of driver’s licenses.”

The AAMVA, which is looking to Congress to mandate a more unified look to state’s driver’s licenses, recommends that driver’s licenses should have common identification features, so that departments of motor vehicles (DMVs) will be able to locate fraudulent cards; thus, securing the nation against illegal cardholders and eliminating issuing more than one card to the same person.

State-linked databases for triple validation

To verify that a cardholder has already been entered into the system, eliminating the possibility that a person can obtain more than one license, the AAMVA has also asked that driver’s license databases be linked state to state. It’s a process already in place by the AAMVA for commercial driver’s licenses. The proposed plan would link each state’s DMV records to a central database used by local and state law enforcement personnel. Law enforcement officials would be able to access personal identification such as name and address and would also have access to the cardholder’s driver history. By providing this information in a central database, the AAMVA intends to create safer highways, reduce license forgery and strengthen the validity of the cardholder’s identity. Says Bowne, “There’s a tremendous wealth of technology and experience that could be brought to bear in issues such as this” — specifically, he says, the inoperability of available information.

Senator Richard Durbin (D-Ill.), in a hearing outlining the current state of driver’s license security, said he would introduce legislation to improve the reliability and security of state-issued driver’s licenses as well as state-issued identification cards for non-drivers. Durbin supports the efforts of the AAMVA and favors uniform standards for issuance and administration of state-issued licenses and stricter penalties for the fraudulent use of state IDs. “After Sept. 11, use of fake IDs is no longer just a teenaged trick or merely about drunk drivers trying to hide their bad driving records,” Durbin said. “It is about our national security.”

It makes sense then that Durbin would propose that the AAMVA set standards of identifying driver’s license applicants before issuing them a card. If his bill is passed, Durbin proposes that the same state law enforcement officials who have access to the database also have moderate access to Social Security Administration and INS databases, to “cross-check” a cardholder’s identification.

Setting standards

With the identification system being managed by the states, the Progressive Policy Institute (PPi), Washington, says, “Congress has an important role in setting minimal standards to ensure the system’s security and integrity. In a policy report entitled, “Modernizing the State Identification System,” PPi recommends that Congress “set minimum standards for documentation that states must require before issuing an ID card.”

The Security Industry Association’s (SIA) Homeland Security Advisory Council has also recommended that Congress enact legislation to secure such standards. SIA suggests legislation that would secure, standardize and modernize existing technology and practices used to identify and authenticate individual identity (specifically state and federal IDs); and develop a policy to drive standardization designed to keep citizens safe, while not infringing on civil liberties. Among the suggested baseline standards, the SIA suggests:

• uniform appearances such as types of ink, paper, size and shape;

• data to be included on the card’s database, including a photograph, address, date of birth, and a digitally-imprinted thumb print;

• incorporated technology such as holograms, microchips, magnetic stripes, barcodes, proximity cards and readers;

• production requirements such as material specifications; and

• protocols and conditions for identification issuance such as background checks, or the establishment of a two-day waiting period.

Biometrics to the rescue

Driver’s licenses use photographs, height, age, weight and address to verify that the cardholder is actually who he claims to be. But biometrics, such as fingerprints and digital signatures, can add additional layers of security that traditional identification documents cannot. The AAMVA proposes to standardize state’s biometric identifiers, as well as its means of encoding them, mandating that each state use the same type of biometric identifier on the same type of encoding system. This would help DMVs nationwide recognize each other’s identifier.

This summer, the INS plans to use electronic fingerprinting in airports across the U.S., scanning foreign visitors to ensure their identities. So-called smart cards — cards containing computer chips — are also a possibility. With chips that store biometric data, such as a fingerprint or eyescan, government officials view them as a solution to securing identification in unauthorized areas. So agrees the Smart Card Alliance, Princeton Junction, N.J., which views smart cards with biometric features as “capable of meeting the requirements of a wide range of policy and legal mandates” and suitable for “providing the technical solution for secure identification.”

Security technology providers propose magnetic stripes, barcodes or electronic “smart” chips be integrated in driver’s licenses to hold identification information. Symbol Technologies is focusing on card technology, promoting standardizing biometrics and digital signatures through the use of a 2D barcode. Companies such as Datastrip Inc., Exton, Pa., also propose a 2D barcode be printed on identification cards to store personal and demographic information, as well as one, or multiple biometric identifiers. Says Charles Lynch, vice president of marketing and sales for Datastrip: “Because all the information is stored on the card, and not the computer, there’s virtually no chance of identity theft. We believe that there should be a universally accepted way to identify individuals.”

As the need for security increases, so does the need for technology. But there must also be a means of authenticating that technology. “So often, the person who’s in charge of authenticating [whether a document is real] doesn’t always know what factors should be included in the process,” Thalheimer says. Imaging Automation offers technology that detects whether identification documents are real — perhaps a less-invasive approach than adding an additional identifier to the card itself. Imaging Automation’s BorderGuard product claims to view plain text, encoded machine-readable text, ID photos and logos on identity cards. But it also claims to view IR ink, UV patterns, secure laminate, tamper marks and facial biometrics to the cardholder’s identification. Additionally, BorderGuard uses five different kinds of light, high-resolution cameras and an embedded PC in its application to focus on biometric analysis, pattern matching and character recognition.

Whether attached to a driver’s license or a separate ID card, Symbol suggests the building of a solid infrastructure, enhanced security of documents both visibly and invisibly, and more standardized use of machine-readable documents. Adds Shlasko: “You can’t take a simplistic view in this, the issue has grown with technology.”

Magnetic stripes, barcodes and electronic chips are able to store many bytes of information, thus leaving additional room, after required information is stored, to be used by the cardholder for convenience transactions. Incorporating a cardholder’s banking or healthcare information for example, would provide a single platform for transactions.

Expanding functionality to a national identification system could ease the public’s initial resistance to adopting a national ID card. Cardholders could choose what type of information they would like to have on their cards, and ultimately, get a sense of control of the amount of information others could access. Not being able to access this information without a physical biometric, such as a fingerprint or retinal scan, actually further secures the information stored on the card. “The user controls the database because they provide the biometric,” says Lynch. “[When] all the information is stored on the card, there’s virtually no [chance of] identity theft.”

Arguments against

Studies show that generally, Americans are willing to give up some civil liberties in exchange for a more secure environment. In a Pew Research Center poll taken just eight days after Sept. 11, more than half of total respondents (55 percent) agreed that to curb terrorism in this country, it would be necessary for the average person to give up some civil liberties. Other surveys have gathered similar responses. A Gallup poll taken between January 28 and March 22 concluded that four of five Americans are willing to trade some freedoms for security, and seven in 10 favor a national ID.

But privacy advocates and civil liberties groups, those like Privacy International and the American Civil Liberties Union (ACLU), stand in steadfast opposition. Supporters of a national ID card wonder, “What’s to fear if you’ve got nothing to hide?” Privacy International contends that the debate is not so much about privacy, but more about losing control of such private information. The Group notes the debate can be seen in a three-stage process:

Stage one

At first, a popular view is expressed that identification is not an issue related to individual rights — when an identity card is proposed, public discussion is initially focused on the possession of the card itself — who will mandate it, who will control it, who is responsible for it.

Stage two

The second stage is marked by a growing awareness of the hidden threats an identity card holds — function creep, potential abuse by authorities and problems arising in losing the card.

Stage three

Eventually, the last stage of discussion involves more complex questions about rights and responsibilities — the significance of the computer backup and the numbering system.

At each level, ownership seems to be re-routed — from having great control to having no control at all — and opponents feel as if their civil liberties are being taken away.

Benjamin Miller, founder and chairman of the CardTech/SecurTech Conference, has worked with such companies as American Express, IBM, MasterCard, and the U.S. Departments of Energy and Defense in consulting on card and biometric strategies. “When the national ID card issue is raised, it’s not necessarily good for the industry, because it elicits such extreme reactions,” he says. Miller points out that, all too often, technology is misrepresented, and opponents are stuck with the idea of a national ID card turning into an “Orwellian nightmare.”

National ID Cards vs. Driver’s Licenses

Despite being armed with tools capable of increasing our nation’s security, fundamental problems are keeping such technologies at bay. Standardizing driver’s licenses raises the eyebrows of privacy and civil liberties advocates who already view driver’s licenses as de facto national ID cards. The possibility of the card — and most importantly, the information it would hold — being used for sinister purposes, is of monumental concern to its adversaries. In an article outlining reasons national ID cards should be rejected, the ACLU states: “Once put in place, it is exceedingly unlikely that such a system would be restricted to its original purpose” — a statement that applies to the fear of linking state DMV databases with those of federal agencies. What starts out solely as a safer driver’s license, opponents fear, may turn into something else.

Should national ID cards be tied into government databases for security reasons, electronic trails of other information might be accessible as well. “We’re increasingly facing the likelihood of the government trying to dupe the American public by bringing forth a national ID scheme through a legislative back door,” says Katie Corrigan, an ACLU legislative counsel.

What’s next

The creation of a modernized identification system — whether through a separate national ID card, or an existing driver’s license — will rely on more than new hardware and legislation. It will also take money and time. Just how long would it take to implement a national ID card system? Both sides agree: Security is needed now, not eight to 10 years down the road.

While a complete plan has yet to surface, several quick-fixes are emerging to stave off future identity-crisis issues such as those of Sept. 11. Legislation has been passed to allow some states to coordinate driver’s licenses with immigration visas — so that when one expires, the other will too. Additionally, some states have raised the bar on acceptable forms of identification and proof of residency.

What’s next in identification? Biometrics will likely have a role, so will smart cards. But at what price to privacy?

State-Level Activity

Here is an overview of some proposed legislation relating to driver’s licenses