REAL ID Revolt Spreads: Good News for Online Privacy

By Dave Wieneke | in Identity, Privacy/security | 14 Apr 2008 | No Comments

This week, Alaska and Idaho passed laws that prohibit the state from taking measures to comply with the REAL ID act of 2005.  That now makes nine states who refuse to participate in the new federal identity system, which is due to start operation in about a month.

My friend and former state government colleague, Dazza Greenwood, provides a level-headed perspective in a recent video interview. He also hosts a video about online identity which was recently released video by MIT’s Media Lab and the E-Commerce Architecture Program.

Here’s where public sentiment seems to be about REAL ID:

• The Senate Judiciary Committee is critical of the Department of Homeland Security for “bullying” states into compliance under a threat of blocking citizens’ travel.
• The Cato Institute describes the privacy and data security consequences arising from REAL ID as immense, increasingly well understood, and probably insurmountable.
• The ACLU report card on REAL ID documents the full range of policy concerns raised, and how, if at all, the government has responded to such issues.
• Montana Governor Brian Schweitzer provided an unusually frank and funny analysis of REAL ID on NPR. Wow, he calls this a “bluff” and tells the federal government to bugger off as only a good-natured Westerner can do.
• Maine’s Secretary of State, Matt Dunlap explains the effect of government which would inspect citizens identities constantly.

How is REAL ID related to online law?

The management of identity is a core issue on the Internet. So are privacy, security, and unfettered access to information. The REAL ID system could eventually be used to identify individuals’ online activities, and combine them with data from real-world actions. The location of your car, cell phone, purchases made, phone and online communications could be associated, analyzed, and used to profile and control individual actions.

Useful Arts has recently blogged on how business and government cooperate in sharing personal data. Such identity management initiatives are going to frame the environment in which people access the Internet, and have the potential be embedded in a wide range of future online legal issues.

What is REAL ID?
The REAL ID act requires states to create a machine-readable standard identification card. The 2005 act requires that the card be used to license drivers and identify air travelers and those entering federal facilities. More recent Congressional proposals have included using the card for pre-employment screening, gaining access to federal housing, and taking out federally backed loans. 

REAL ID provisions require that photos be optimized for mechanical facial recognition and the potential for biometric validation. The Act’s legislation acknowledges that use of the ID may become more widespread, and could be used for access to any public benefit or subsidy, firearm ownership, and voting identification. States will be required to maintain and share data of use to REAL ID cards for official purposes. 

Privacy advocates are concerned that the Act’s legislation completely failed to address privacy issues, or to attempt to limit of the use of the card by public or private entities. Online privacy advocates are concerned that connecting REAL ID identity to Internet use would subject a huge portion of people’s daily lives to scrutiny and analysis.  And security sceptics doubt that the states, or the federal government, will adequately protect this huge data pool from hackers or employees making inappropriate use of the data.

More on REAL ID as its May deadline approaches.