The Department of Homeland Security fronted up as a reasonable gent yesterday when it granted state civil servants extra time to implement the Real ID Act.
In what amounted to a standard "we're listening" tip of the hat to civil liberties campaigners, the DHS issued guidelines for implementing the Real ID Act, which play down many of the most contentious aspects of program to nationally standardise identity documents.
The long-awaited rules (PDF), issued on Thursday in Washington DC, will ease the timetable for state governments to adopt the Act, and delay an initial insistence on RFID technology and biometrics.
The Real ID Act had required states to put the new system in place by May 11 2008. The DHS recommendation will allow extensions until the end of 2009. The program should see the country's 245 million licensed drivers Real ID-compliant by the close of 2013.
The DHS agreed that the expected cost to state governements of implementing Real ID, will be $11bn. Congress in Washington has ponied up $100m.
At a press conference to set out the rules, DHS chief Michael Chertoff, played the Honest Joe card: "It's very simple and it's really a matter of common sense. Applicants for driver's licenses will need to bring documents to their state Department of Motor Vehicles offices to validate or prove five things: who they are, what their date of birth is, what their legal status is in the United States, their social security number and their address. None of this is top secret stuff."
There are no solid plans to encrypt the barcode, meaning for example that bars might have access to patrons' home addresses. Inviting comment in its recommendations, the DHS said it "leans toward" scrambling the data, but said that cost might outweigh any privacy benefits. Further, Chertoff said the way that organisations use data from a Real ID is a matter for state legislatures.
RFID is still under consideration. But to begin with, Real ID driving licenses and ID cards will carry a two-dimensional barcode. Chertoff played down the distinction between data on a chip and data printed on plastic or paper. He said: "I don't think that technology increases the threat to privacy. Whether you read the card and copy it down or whether you run the magnetic strip through like you do with a credit card, I think the bottom line is the person who gets the card can read the information."
He added: "I don’t think that technology makes it worse. In fact, I actually think it makes it better."
Such a comment is unlikely to pacify opponents: the rules would effectively create a national database of personal data callable by any state. The history of such systems, such as the National DNA Database in the UK, suggest they are susceptible to mission creep; civil libertarians point out that once established, the only way for a database to go is bigger.
The DHS is taking comments for 60 days. ®