Friday, May 25, 2007
New Hampshire says "no" to Real ID...
The NH Senate unaminously approved a bill that bars the state from complying with the Real ID Act, and the Governor says he'll sign it. That's good news in the move to stop the implementation of Real ID.
One refrain that's clear in every rejection is that cost is a huge concern for the states. As documented here and many other places, there are other major problems with the Real ID Act. It's important to keep those other issues at the forefront of this debate in case somehow cost becomes less of a concern due to... well... to someone printing more money, I suppose!
Tuesday, May 22, 2007
Real ID all over
If you want to get up to speed quickly, head on over to PogoWasRight.org's page devoted to Real ID news. You'll see there a link to the Real ID listserv that EPIC has set up as well as all the news in Congress and the states. And check out Dissent's blog there, too, for all sorts of tidbits.
The states continue to show opposition to the Real ID act, but at this point, the action is in Congress and in awaiting the DHS' next iteration of their proposal. Staying informed and active remains important, since this issue isn't going away any time soon....
Wednesday, May 16, 2007
Want some news with your news?
Today comes news from Nevada that they've chopped the budget for Real ID, approving only 100K this year to hire a project manager who would submit the state's plan to implement Real ID. This is kinda a "wait and see" approach -- not opting out, but clearly not pushing forward until any possible repeal or changes are made public.
The news from Oregon is certainly no endorsement of Real ID itself, though while rejecting Real ID, the state senate approved changes to require state licenses only be issued to those who can prove they are in the country legally.
There's news from Missouri, Georgia, and other states as well. The interactive map at the ACLU site is handy-dandy for this. Also, there continues to be lots of good commentary on the web, including John R.'s excellent Real ID Watch blog.
Saturday, May 12, 2007
So much news, so little time....
Sen. Patrick Leahy of Vermont seems to be driving action in the US Senate in terms of revisiting (or perhaps repealing?) Real ID. And at last count, 33 states have pending or passed bills refusing to comply with the Act. Tuesday, for example, Oregon's Senate will be debating such a bill.
The ACLU's Real Nightmare site has this handy-dandy state map to help keep on top of the news. And keep checking in at the Privacy Coalition's Stop Real ID page for updates, too.
Wednesday, May 9, 2007
DHS spokesman: "we received 12,000 comments"
WASHINGTON, May 8 — The Homeland Security Department said Tuesday that it would plow ahead with national standards for driver’s licenses, despite a highly unusual level of activity by state legislatures opposed to the idea, and substantial second thoughts in Congress.Matthew Wald writes in the New York Times. I'm kind of curious what time Knocke gave that estimate; most of the article is a discussion of the Leahy hearing yesterday, which started at 10 a.m. EST ... and I'm sure comments are continuing to trickle in after the deadline. Still, it's a first stake in the ground.The department said it had received about 12,000 public responses to its draft rules, in a 60-day comment period that ended Tuesday. Russ Knocke, a spokesman, said the comments were mixed.
As for "mixed" ... I've been spot-checking comments all week long and they seem to be running at least 80% anti-Real ID both at the individual and the organizational level -- and the chatter in the blogosphere near the deadline was overwhelmingly anti, 95% or more. So we'll see just how "mixed" it really is.
No word in the article about timeframe for posting or responding to comments.
jon
Tuesday, May 8, 2007
Phase 1 completed -- thanks, and what next
This first part of the campaign was a whirlwind -- we only had 60 days to build the campaign, get media coverage, and round up as many people as we could to send in comments. It was a big job. To make our lives more difficult, the DHS had troubles with their fax capabilities and their web site. It was only during the last 24 hours that they made available an email address that people could use to send in their comments. It will likely be at least a week before we know exactly how many people sent in comments.
Now that this phase is done, what do we do?
Now is the time to follow up with congress people, if you haven't done so already. Colorado is now on the list of states that don't want to follow Real ID. I was on a conference call today (May 8) with the EPIC privacy coalition group, and one of the people on the call had just testified before a small group of Senators about the privacy and security flaws with Real ID. He's a security expert and got a very warm reception.
At some point, the DHS will do one of three things: 1) announce that they have adopted a rule to implement Real ID - with or without our comments being taken into account, 2) defer adopting a rule until they get more direction from Congress, or 3) re-open the comment period. In the meanwhile, Congress should be hearing from all of us that we want the Act repealed.
As for DHS? Option #3 is unlikely. It's unclear which is more likely, option #1 or option #2.
We'll keep posting here as I get new information. Please keep following the news, and help as you can.
Thanks again everyone.
Deborah
PrivacyActivism's comments to DHS on Real ID
The draft rules proposed by DHS to implement the Real ID Act are fatally flawed. Focusing on how to best implement an Act as deeply flawed as this one is not in the best interests of individuals or the states; therefore we recommend that the proposed rule be withdrawn. Ultimately, Privacyactivism believes that the Real ID Act should be repealed, but understands that this is outside of the scope of this rulemaking process. Privacyactivism’s comments will therefore focus on the lack of privacy protections in the proposed rule, and why the lack of these protections require the withdrawal of the proposed rule.
Specifically, our comments will cover these areas: 1) The general lack of privacy and security protections; 2) the difficulty of compliance; 3) exceptions in the draft rule that lead to inadequate security; 4) the cost involved.
See our full comments for the details.
Deborah
Monday, May 7, 2007
E-mail comments!
Emails must have “DHS-2006-0030” in the subject line. Click
here to e-mail (or to type the address yourself: oscomments at dhs . gov) or check the Coalition page for a link with a comment letter (which you may customize!) attached.
File before 5PM EST on Tuesday the 8th!
DHS' own privacy panel declines to endorse...
The Department of Homeland Security's outside privacy advisors explicitly refused to bless proposed federal rules to standardize states' driver's licenses Monday, saying the Department's proposed rules for standardized driver's licenses -- known as Real IDs -- do not adequately address concerns about privacy, price, information security, redress, "mission creep", and national security protections.
Besides being good for the Stop Real ID cause, it's also heartening to see debate on the issue (since Congress hasn't yet had that chance).
File those comments AND the news...
In other news, Slashdot notes that there's opposition in Massachusetts to Real ID. BoingBoing again helps remind folks that the time for comments is now. And tomorrow in the US Senate, the Committee on the Judiciary has a hearing called "Will REAL ID Actually Make Us Safer? An Examination of Privacy and Civil Liberties Concerns"
There's a nice list of speakers to the committee, including Bruce Schneier and Jim Harper, both quoted here before.
Oh, and in case I failed to mention it earlier, it's a good time to go and file your comments!
May 8 deadline approaching; five things you can do today
- File comments, if you haven't already.
- Tell your friends and family, and ask them to file comments. Don't underestimate the power of personal connections; if we each convince five people to file comments, that will make a huge difference.
- Get the word out! Email and post wherever you think it's relevant, and make sure to tell people how to file comments and remind them of the deadline.
- Ask your state legislators to file comments.
- Tell the media to cover the Real ID rebellion
jon
TSA loses hard drive with 100,000 employees' personal info
The Transportation Security Administration has lost a computer hard drive containing Social Security numbers, bank data and payroll information for about 100,000 employees.
TSA, a division of the Homeland Security Department, employs about 50,000 people and is responsible for security of the nation's transportation systems, including airports and train stations.
``It's seems like there's a problem with security inside Homeland Security and that makes no sense,'' said James Slade, a TSA screener and the executive vice president of the National Treasury Employees Union chapter at John F. Kennedy International Airport. ``That's scary. That's my identity. And now who has a hold of it? So many things go on in your mind.''
See Matt Spuzzo's AP article for more -- or the TSA's web site.
Now imagine if this hard drive also had copies of birth certificates, documents providing proof of address, and photos -- as required by Real ID.
See why computer security experts think that Real ID is likely to increase identity theft?
jon
Sunday, May 6, 2007
Again... what's wrong with Real ID
Cost: The estimated pricetag for implementation is over $20 billion... and this will be shouldered almost exclusively by the states and individuals. I believe a DHS speaker at the Town Hall said there is around $40 million in Federal money available. You can do the math as well as I can.
Privacy: the proposed implementation punts on privacy, leaving it to the states or simply hoping, I suppose, that as everything gets put into place, somehow things will work out. Implementing a huge data storage system of incredibly personal data without first coming up with HOW that data will be kept safe is bad news indeed, and simply not a good way to go about business.
Identity theft: as proposed, Real ID would not only give identity thieves one stop shopping for information, but victims of identity theft would have tremendous difficulty in clearing up problems.
Security: if the DHS keeps claiming that the point of Real ID is to make sure that the person sitting next to you on the plane is who they say they are, then they have defined security in a rather different way than I would. Also, with the various exemptions that are in place, the Real ID program has security holes big enough to drive a truck through.
The ACLU Real Nightmare page has more, as does the Stop Real ID wiki. Suffice to say, there are a lot of problems with Real ID, and there are many reasons why there are such diverse groups in the coalition that formed this past week to stop Real ID.
Another reason for commenting....
On more than one occasion, a DHS official made the statement that Real ID was designed so that you’d know that the person sitting next to you on an airplane was actually the person they claimed to be. To illustrate this concept, they had a picture of a 9/11 terrorist and his IDs… yet this terrorist traveled AND got his IDs, flawed though they might have been, under his own name. If the goal of Real ID is truly what was stated, then Real ID would not have made one iota of difference. Somehow the irony of this was not apparent to the DHS speakers.
As I noted in the comment I submitted during the meeting, Dr. Richard Barth of DHS took the above concept further and stated that all a person cares about when they put their spouse or child on a plane is that the person their loved one ends up sitting next to is the person they claim to be. Personally, I care if the person seated next to a loved one is going to harm them. I don’t care what their name is or whether they are traveling under a made up name. Everyone I’ve asked agrees with me, in fact, but again, an emotional button is being pressed – a spouse or child in jeopardy!!!! – and it’s being pressed to distract attention from a legitimate conversation about the issues of Real ID’s implementation.
Finally along these lines, what added to the frustration is not simply that the DHS speakers at the Town Hall referenced 9/11. Of course they did, as it was the 9/11 Commission report that gave rise to what turned into Real ID. What bothered me, instead, was the language they used. “Crashed the planes into…” “Slammed into…” The imagery was designed to create a visceral reaction and take the conversation away from the specifics at hand. As horrific as 9/11 was (and still is), the fact that planes were “slammed” and “crashed” is NOT an answer to how to implement any specific part of the Real ID Act, and that’s what conversation was supposed to be about. Yet those words and images were used over and over in conversations stemming from questions about barcodes, databases, and cost. Clearly, the comments were off point and designed to persuade by fear.
So now, filing comments on the Real ID Act is also a way of saying “I will not be cowed by attempts to instill fear.” That, too, is an important message to send… now, I suspect, more than ever.
Saturday, May 5, 2007
Ask your state legislators to file comments!
EFF and Downsize DC have sites that make it easy to email your legislators. USA.gov has state-by-state directories of legislators if you'd prefer to mail, fax, or phone.
jon
PS: If you know that your legislators have voted against Real ID in your state, start by thanking them. It's so unusual for them to get thanked, they'll probably fall out of their chair -- and once they pick themselves up, they'll be much more inclined to respond to the rest of your mail.
Friday, May 4, 2007
Why comments matter
The impact on politicians is most straightforward:
States are lining up against the Act, although some are on the fence about it. A strong showing from the public will not only let DHS know how we feel about it, but it will also be a boost in the undecided states -- and increase the momentum for a repeal in Congress. The commenting process isn't easy, and so legislators estimate that each comment represents the views of 1,000 people ... your voice matters a lot.
The other two require a bit of context for how the "rulemaking" process works. Briefly, once Congress passed Real ID in 2005 (with no debate, as a rider to a "must pass" spending bill ... but that's another story), DHS has the responsibility proposing a "rule" to implement the law. All proposed rules go through a public commenting period; the proposed rule can be adopted as is, or can be rejected. If rejected, it needs to be redrafted and sent out again for public comment. The current commenting process ends May 8.
Deborah writes:
And these kinds of commenting processes do work to kill bad laws. The example Deborah gave:
The more negative comments DHS receives, the less likely it will be that the rule will be adopted.... If that happens, we have another 30 or 60 days to try to convince Congress to repeal the law.
If no one says anything during the comment period, DHS will say that the public is fine with Real ID, and fine with all of the privacy invasive decisions contained in their draft rule.
The biggest one I've seen involved Secure Flight -- a passenger profiling system that the US wanted.
DHS and DoT published a draft rule in the Federal Register .... We commented it to death, we hit all of the press we could, and basically forced them to convene a committee (DHS put it together). A scathing report was issued, and guess what? Secure Flight was killed. It's still dead.
So yes, this is a difficult and somewhat obscure process ... but it's well worth doing.
jon
National ID cards in last night's Republican debate
... Giuliani and Romney backpedaled and clarified that they only meant this to apply to immigrants (um, isn't this called a "green card").
The Psychology of Security and Real ID
One of the things I flashed on was the Real ID Town Hall webcast. Gina Scott described this well in her GovTech article:
Unfortunately, many people were put on the defensive at the meeting when, in the opening remarks, a picture of the Florida driver's license of one of the 9-11 highjackers was put on the overhead screen. The apparent attempt to show the ease in which such terrorists were able to attain state-issued identification drew the proverbial line in the sand for the state DMVs. For the regular citizens, many saw the use of the highjacker's card as a threat. One citizen commented that the use of the photo was offensive, especially "in a time when we are going through a period of distrust in this country."
Intentionally or not, showing the hijacker's ID card triggers all of these factors that lead people to overestimate risks: it personifies the risk; relates it to a rare, spectactular, much-talked-about event; etc. etc.
In the Q&A after the talk, I asked what approaches we should use to counter this -- basically to get people into a framework where they're getting beyond their instinctual fears to think through the security tradeoffs at a public policy level in a way that better reflects the real risks. "It's hard," he replied. "Fear is so visceral, so powerful." I suggested that one of the things we should look at is countering with more positive emotions (Stephen Duncombe's Dream: Reinventing Progressive Politics in an Age of Fantasy makes a similar suggestion in a more general context). He agreed that this was worth looking at, as well as various framing approaches ... and I agreed that it's really difficult -- especially when the mass media's coverage tends to reinforce the fear.
Schneier's essay on the subject covers the same ground as his talk, in somewhat more detail, looking at research from behavioral economics, pscyhology of risk, neuroscience. Strongly recommended.
jon
A quick roundup...
Over at Govtech.com, they had a fine summary of the Town Hall meeting. Here was a list of some of the issues they highlighted as coming up at the meeting:
- Lack of inclusion of states in decision making process
- Privacy and security of records
- Types of information stored in databases
- Identity theft and inside jobs
- Use, and types of biometrics included
- Ease in which people with disabilities, and the elderly will be able to get cards
- Putting addresses on cards and the danger to people escaping violent environments
- Religious discrimination
- Gender options on cards
- Costs to states and individuals
And Deborah Pierce of Privacy Activism (and this blog) noted in a thread on Tribe.net that...
The commenting process isn't easy, and so legislators estimate that each comment represents the views of 1,000 people ... your voice matters a lot.
Indeed it does! Yet one more reason why it's time to write those comments....
Thursday, May 3, 2007
Tell the media to cover the Real ID rebellion
So says DownsizeDC, and I couldn't agree more. They're not just complaining, though: they're starting up an email campaign with a page that lets you send a message to Neil Cavuto on FoxNews, Keith Olbermann on MSNBC, and Wolf Blitzter on CNN. Good thinking! I just tried it out (I'll include my letter in a response) and it seems to work just fine.
On Homeland Stupidity, Michael Hampton quotes Jim Babka of Downsize DC on why this is so important:
Congress may not always care what citizens think, until they’re forced to, but Congress always cares what the media thinks.... We need to get the media to cover the nationwide revolt against the REAL ID Act.
Security experts: "National ID card a disaster in the making"
As well as bringing up the risks of identity theft ("one wonders how vulnerable this system-of-systems will be to data loss or identity theft resulting from unscrupulous employees, flawed technologies, external compromises or human error--even under the best of security conditions" -- this is pretty similar to the pont I brought up in my question and comments at the town hall meeting) and pointing out the risks of mission creep ("Other homeland security initiatives, such as the Patriot Act, have been used and applied--some say abused--for purposes far removed from anything related to homeland security. How can we ensure the same will not happen with Real ID?"), they make an excellent point about how Real ID makes the people who aren't eligible for it -- or live in states that have rejected it -- into second-class citizens:
In a nod to states' rights advocates, DHS declares that states are free not to participate in the Real ID system if they choose--but any identification card issued by a state that does not meet Real ID criteria is to be clearly labeled as such, to include "bold lettering" or a "unique design" similar to how many states design driver's licenses for those under 21 years of age.In its own guidance document, the department has proposed branding citizens not possessing a Real ID card in a manner that lets all who see their official state-issued identification know that they're "different," and perhaps potentially dangerous, according to standards established by the federal government. They would become stigmatized, branded, marked, ostracized, segregated. All in the name of protecting the homeland; no wonder this provision appears at the very end of the document.
In the news....
The Mercury News had a good summation of the meeting, as did the UC Davis daily, the California Aggie. And as noted here earlier, Wired had a good write-up as well.
There's also been some coverage of the announcement of 43 (now up to 50) groups uniting in a drive to submit comments on the Real ID Act ahead of the May 8th close of the public comment period -- the article in FCW.com and mention in Homeland Stupidity's Who wants a national ID?" are good examples.
Wednesday, May 2, 2007
Notes from CFP's opening panel: Where People and the Surveillance Society Collide
The Real ID Act is viewed as one of the biggest problems in the transgender community in the US. Documentation is increasingly hard to get, especially for certain kinds of people (low-income, elderly, transgender, immigrant); and you need it for more and more things: starting a bank account, buying cigarettes … gender is recorded on the driver’s license; the fact of a name change is recorded on the 2d barcode – Mark to Mara, for me. Not sure about the gender change, but this is certainly in the database . Every time you go to a bar, you’re outed; in an airport. Maybe not such a big issue in a big city; what about in a small town – or where you know the TSA agent’s family?Russell Roundpoint (Chief Administrative Officer, Mohawk Council of Akwasasne) talked about the difficult situation of the Akwasasne community, which spans five jurisdictional districts (Canada, the US, Quebec, Ontario, and New York) -- and the extra challenges for people like his wife, who is a US citizen despite never having lived here, but does not fall under any of the standard categories of exceptions, and so has a hard time getting a passport. At yesterday's town hall meeting, a gentleman from the Arizona DMV had highlighted their experiences with the rural Native American population, and strongly cautioned DHS that the current regulations did not take this into account; I found myself wondering whether the Akwasasne situation had been considered.
Journalist Dave Jamieson talked about surveillance cameras in Washington DC (his Washington City Paper story Speaker of the House is a great read). While not specifically ID-related, the experience about how cameras and speakers so that the camera watchers can give orders are increasingly being installed in low income housing complexes is a good reminder that the burden of surveillance technologies (and that's what Real ID is) tends to fall very heavily on lower-income people or others who are marginalized -- the same point Mara brought up.
Lots of great stuff in the panel; see my detailed notes here.
jon
An interesting post-webcast tidbit ...
Assistant Secretary Richard Barth, flanked by Jonathan Frankel and Darrell Williams, denied they were building a national identification card, and tried to empasize that the proposed requirements were intended to keep terrorists off airplanes.
But afterwards, Frankel told Wired News that applicants for Real ID licenses won't be compared against the government's centralized terrorist watchlist unless states choose to do so, a policy choice made to prevent people from feeling a heavy hand from the government.
Right. There's nothing else in Real ID that would make people feel a heavy hand ... and why would we want to check those terrorist watch lists anyhow? Hmm....
jon
Tuesday, May 1, 2007
Six more groups join anti-Real ID public comment coalition
jon
First impressions after the Town Hall
There seemed to be a lot of recurring themes, concerns and phrases. To highlight a few....
"This is not a Federal program; it is a partnership with the states." Variations on this popped up all the time, but what was never addressed was exactly WHO in the states this is a partnership with. A majority of Governor's oppose it. Five states have rejected it, with legislation pending in others. DMV's don't seem to support this implementation (see below). So... who?
Security threats to the databases. This came up in comments from folks who were not otherwised focused on privacy concerns. And here the DHS members of the panel agreed with concerns, and bully for them for doing so, though they still tried to minimize the risk by noting that, for example, there is no design to have a single, centralized database with all the information. True, that single one cannot be hacked, but soooo many others now can. Here's a good link of some of the data losses that have already occured. NOT dealing with this in advance doesn't really seem so wise, does it?
"You want to know that the person sitting next to you on the plane is the person they say they are." A UC-Davis grad student, I believe, called this "solving the wrong problem." And it is not only that, but it's an attempt at putting emotions into the argument to pull attention away from the issues at hand. Here are far more cogent thoughts on why this is the wrong problem.
DMV front line workers and administrators spoke up about a raft of issues beyond cost. And they're complex issues that all point to the fact that the Real ID Act needs far fuller debate and discussion.
And finally, "the 9/11 commission recommended this." The 9/11 Commission recommended a concept. Real ID, however, is an explicit set of proposals. That is a difference... and a major one at that. Does Real ID address the concerns of the Commission and is it the best implementation of the concept? Those are the questions that need debate.
More to come... and feel free to share your reactions to the Town Hall.
My submitted comment...
The recent Zogby poll that has continually been quoted here today asked people whether they supported "the REAL ID program, which requires each state to change their driver's license systems to meet national standards and ensure that their databases are compatible with other states."
That is a far different question than asking if people support the specific rules proposed in the DHS implementation of the Real ID Act. Do you believe that if you were to sit down with those surveyed and explain to them all the costs and issues associated with the Act – issues which you have acknowledged – the 70% figure would remain? If not, then using that figure is misleading.
Also, when you say that all I care about when I put my spouse or child on a plane is whether the person they are sitting next to is the person they claim to be, you do not speak for me or, in fact, any spouse or parent I know. What I care about, and what everyone I’ve asked cares about, is whether the person in question is going to do harm. People do harm under their real names all the time, including, quite horrifically, the 9/11 terrorists.
It is hard to have a debate about the issues when emotional trump cards are continually played. While I tremendously appreciate your being here today and allowing us this forum, I would ask that you do not speak for me… but instead listen to me and accept that in issues as complex as this, there is a need to have open dialogue and not rely on sound bites.
Greg
More webcast notes...
Real ID is a very specific set of rules. The idea of secure, national driver's license standards is a different thing entirely, and it's important to keep that distinction.
Quick webcast notes ...
If you get a chance, tune it ...
jon
Town Hall meeting update...
Remember, you can still register and watch at realidtownhall.com
Town Hall meeting -- register to send questions and listen
43 organizations announce campaign to solicit comments!
Our media release is up on the Privacy Activism site, and the Privacy Coalition site is tracking the announcements of all the groups involved -- as well as providing links to our instructions for filing comments, along with EFF's and the ACLU's. Here are a couple of excerpts:
The timing of this announcement, right before the webcast, is perfect ... it should give a lot of momentum to the last week's drive for comments."The breadth and diversity of the opposition is real testimony to how harmful Real ID is to so many different communities," said Deborah Pierce, Executive Director of PrivacyActivism.org and one of the founders of the Stop Real ID Now! activism campaign. "By getting people and groups who are usually excluded from the debate involved at the grassroots level, we can stop Real ID."
"The Real ID Act of 2005 turns our state driver's licenses into a national ID card, costs over $20 billion dollars, infringes privacy, and imposes major burdens on taxpayers, anybody renewing a driver's license, seniors, immigrants, transgender people, and state governments -- while doing nothing to protect against terrorism," said privacy activist Jon Pincus, another founder of the Stop Real ID Now! activism campaign. "This commenting process is a great chance for the American people to tell DHS and Congress the Real ID Act is a bad law that needs to be repealed."
So please, forward broadly!
Deborah
PS: see the comments for the list of groups who are initially joining -- and we're expeecting more!
Action in the blogosphere!
The interactive webcast will only happen for users running Windows with ActiveX, Java and JavaScript enabled. Firefox is not supported. Mac users will be able to watch, but not interact or view online documents.
John07801's diary on DailyKos has some pointers to the local coverage in Davis, and Adam Shostack on Emergent Chaos notes that DHS is sending an "Assistant Secretary, Office of Policy Development" rather than somebody higher-powered ... well, okay, actually he calls the DHS representative a "flunky". Catherine of Siena comments on Threshing Grain that she's trying to get WorldNetDaily to cover the story, and Liam Ferris has a great title for his post: Homeland Security feigns interest, so tell them what you think.
Just a blip, or the start of a trend? We shall see ...
jon