Doug Ross @ Journal

Really, really bad idea: REAL ID

Picture credit: EU Politix
The invaluable Bruce Schneier led his most recent Cryptogram newsletter with a piece on REAL ID. The REAL ID act creates a set of uniform rules for how the states issue driver's licenses. The rules go into effect within three years. What's really strange is that the bill happened with little fanfare, virtually no debate in Congress, and was attached to completely unrelated legislation (military funding in Iraq).

Aside from creating a virtual national ID card, Bruce points out that it will make identity theft easier, not harder. Unlike many European countries with strong legal penalties for disclosure of privacy data, the US has no laws that protect consumers' privacy data.

The incentive for companies like ChoicePoint to broker information about your national ID card will be immense. Many businesses will want to scan your national ID card (say, to prove age in a restaurant serving alcoholic beverages) and they'll also want to sell that information to aggregators like ChoicePoint. Without any legal framework for protecting consumer data, it's certain that identity theft will rise -- not fall -- with REAL ID.

And the unintended consequences of the law will be devastating.

If, for instance, an illegal alien can't get a driver's license, that person will simply drive without a driver's license. And therefore without any automobile insurance. The result will be a higher number of uninsured motorists and a resulting increase in accidents in which one or multiple motorists have no insurance. The repercussions will be costly and painful: dramatically higher insurance premiums and all sorts of litigation.

If you haven't heard much about REAL ID in the newspapers, that's not an accident. The politics of REAL ID was almost surreal. It was voted down last fall, but was reintroduced and attached to legislation that funds military actions in Iraq. This was a "must-pass" piece of legislation, which means that there was no debate on REAL ID. No hearings, no debates in committees, no debates on the floor. Nothing. And it's now law. We're not defeated, though. REAL ID can be fought in other ways: via funding, in the courts, etc. Those seriously interested in this issue are invited to attend an EPIC-sponsored event in Washington, DC, on the topic on June 6th. I'll be there. Resources: http://www.epic.org/privacy/id_cards/ http://www.unrealid.com/ EPIC's Washington DC event: http://www.epic.org/events/id/savethedate.html