    [Senate Hearing 110-291]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 110-291

     UNDERSTANDING THE REALITIES OF REAL ID: A REVIEW OF EFFORTS TO SECURE
                   DRIVERS' LICENSES AND IDENTIFICATION CARDS

    =======================================================================

                                    HEARING

                                   before the

                      OVERSIGHT OF GOVERNMENT MANAGEMENT,
                         THE FEDERAL WORKFORCE, AND THE
                       DISTRICT OF COLUMBIA SUBCOMMITTEE

                                     of the

                                  COMMITTEE ON
                             HOMELAND SECURITY AND
                              GOVERNMENTAL AFFAIRS
                              UNITED STATES SENATE

                           ONE HUNDRED TENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                 MARCH 26, 2007

                                   __________

            Available via http://www.access.gpo.gov/congress/senate

           Printed for the use of the Committee on Homeland Security
                            and Governmental Affairs

                         U.S. GOVERNMENT PRINTING OFFICE

    34-415 PDF                 WASHINGTON DC:  2007
    ---------------------------------------------------------------------
    For sale by the Superintendent of Documents, U.S. Government Printing
    Office  Internet: bookstore.gpo.gov Phone: toll free (866)512-1800
    DC area (202)512-1800  Fax: (202) 512-2250 Mail Stop SSOP,
    Washington, DC 20402-0001

            COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS

                   JOSEPH I. LIEBERMAN, Connecticut, Chairman
    CARL LEVIN, Michigan                 SUSAN M. COLLINS, Maine
    DANIEL K. AKAKA, Hawaii              TED STEVENS, Alaska
    THOMAS R. CARPER, Delaware           GEORGE V. VOINOVICH, Ohio
    MARK L. PRYOR, Arkansas              NORM COLEMAN, Minnesota
    MARY L. LANDRIEU, Louisiana          TOM COBURN, Oklahoma
    BARACK OBAMA, Illinois               PETE V. DOMENICI, New Mexico
    CLAIRE McCASKILL, Missouri           JOHN WARNER, Virginia
    JON TESTER, Montana                  JOHN E. SUNUNU, New Hampshire

                      Michael L. Alexander, Staff Director
         Brandon L. Milhorn, Minority Staff Director and Chief Counsel
                      Trina Driessnack Tyrer, Chief Clerk

      OVERSIGHT OF GOVERNMENT MANAGEMENT, THE FEDERAL WORKFORCE, AND THE
                       DISTRICT OF COLUMBIA SUBCOMMITTEE

                       DANIEL K. AKAKA, Hawaii, Chairman
    CARL LEVIN, Michigan                 GEORGE V. VOINOVICH, Ohio
    THOMAS R. CARPER, Delaware           TED STEVENS, Alaska
    MARK L. PRYOR, Arkansas              TOM COBURN, Oklahoma
    MARY L. LANDRIEU, Louisiana          JOHN WARNER, Virginia

                       Richard J. Kessler, Staff Director
                         Jennifer Tyree, Chief Counsel
                 Jennifer A. Hemingway, Minority Staff Director
                 David Cole, Minority Professional Staff Member
                          Emily Marthaler, Chief Clerk

                                C O N T E N T S

                                     ------
    Opening statements:
                                                                       Page
        Senator Akaka................................................     1
        Senator Voinovich............................................     3
        Senator Collins..............................................     5
        Senator Warner...............................................     6
    Prepared statements:
        Senator Lieberman............................................    45
        Senator Sununu...............................................    47

                                   WITNESSES
                             Monday, March 26, 2007

    Hon. Richard C. Barth, Ph.D., Assistant Secretary, Office of
      Policy Development, U.S. Department of Homeland Security.......     7
    Hon. Leticia Van de Putte, Texas State Senator, and President,
      National Conference of State Legislatures......................    22
    Hon. Mufi Hannemann, Mayor, City and County of Honolulu, Hawaii;
      accompanied by Dennis Kamimura, Licensing Administrator, City
      and County of Honolulu, Hawaii.................................    23
    David Quam, Director, Federal Relations, National Governors
      Association....................................................    25
    Timothy Sparapani, Legislative Council, American Civil Liberties
      Union..........................................................    36
    Jim Harper, Director, Information Policy Studies, The Cato
      Institute......................................................    38

                         Alphabetical List of Witnesses

    Barth, Hon. Richard C., Ph.D.:
        Testimony....................................................     7
        Prepared statement with an attachment........................    48
    Hannemann, Hon. Mufi:
        Testimony....................................................    23
        Prepared statement...........................................    65
    Harper, Jim:
        Testimony....................................................    38
        Prepared statement with attachments..........................    89
    Quam, David:
        Testimony....................................................    25
        Prepared statement...........................................    69
    Sparapani, Timothy D.:
        Testimony....................................................    36
        Prepared statement with an attachment........................    74
    Van de Putte, Hon. Leticia:
        Testimony....................................................    21
        Prepared statement with an attachment........................    57

                                    APPENDIX

    Background.......................................................   108
    September 2006 Report, ``The Real ID Act: National Impact
      Analysis,'' presented by the National Governors Association,
      National Conference of State Legislatures, and the American
      Association of Motor Vehicle Administrators....................   119
    ``New Federal Regulations Get an `F' in Addressing Issues with
      the Real ID Act,'' report submitted by the American Civil
      Liberties Union (ACLU).........................................   179
    Additional prepared statements submitted for the Record from:
        Jay Maxwell, President and CEO of Clerus Solutions...........   198
        Wendy R. Weiser, Deputy Director of the Democracy Program and
          Myrna Perez, Counsel at the Brennan Center for Justice at
          NYU School of Law..........................................   206
        Melissa Ngo, Director of the Identification and Surveillance
          Project, Electronic Privacy Information Center.............   210
        Sophia Cope, Staff Attorney/Ron Plesser Fellow, Center for
          Democracy and Technology...................................   223
        Hon. Mark Sanford, Governor, State of South Carolina.........   240
        George Valverde, Director, Office of the Director, Department
          of Motor Vehicles, Sacramento, California, with an
          attachment.................................................   243
    Questions and responses submitted for the Record:
        Mr. Barth....................................................   246
        Ms. Van de Putte.............................................   260
        Mr. Hanneman and Mr. Kamimura................................   262
        Mr. Quam.....................................................   267

     UNDERSTANDING THE REALITIES OF REAL ID: A REVIEW OF EFFORTS TO SECURE
                   DRIVERS' LICENSES AND IDENTIFICATION CARDS

                                  ----------

                             MONDAY, MARCH 26, 2007

                                       U.S. Senate,
                  Subcommittee on Oversight of Government
                         Management, the Federal Workforce,
                                and the District of Columbia,
                          of the Committee on Homeland Security
                                            and Governmental Affairs,
                                                        Washington, DC.

        The Subcommittee met, pursuant to notice, at 2:30 p.m., in
    room 342, Dirksen Senate Office Building, Hon. Daniel Akaka,
    Chairman of the Subcommittee, presiding.
        Present: Senators Akaka, Voinovich, Collins, and Warner.

                   OPENING STATEMENT OF SENATOR AKAKA

        Senator Akaka. I call the Subcommittee on Oversight of
    Government Management, the Federal Workforce, and the District
    of Columbia to order.
        I want to welcome Senator Collins here. It seems as though
    our border States are vitally interested in the issue before us
    today.
        Before we begin, I want to extend a warm welcome to all of
    our witnesses today and especially to Honolulu Mayor Mufi
    Hannemann, who presented me this lei, and who is accompanied by
    Dennis Kamimura, the Licensing Administrator for the City and
    County of Honolulu. I greatly appreciate you coming all the way
    from Hawaii, Mufi, and I look forward to discussing how REAL ID
    impacts the State of Hawaii and the County of Honolulu.
        Today's hearing, ``Understanding the Realities of REAL ID:
    A Review of Efforts to Secure Drivers' Licenses and
    Identification Cards,'' will review the REAL ID Act of 2005 and
    the proposed regulations implementing the Act recently issued
    by the Department of Homeland Security.
        In 2004, the 9/11 Commission reported that all but one of
    the September 11 hijackers acquired some form of U.S.
    identification, some by fraudulent means, which assisted them
    in boarding commercial flights, renting cars, and other
    activities. As a result, the Commission recommended the Federal
    Government set standards for issuing sources of identification
    such as drivers' licenses.
        In December 2004, Congress passed the Intelligence Reform
    and Terrorism Prevention Act to establish a negotiated
    rulemaking process among the Federal Government, State, and
    local governments, privacy groups, and other stakeholders to
    develop standards for drivers' licenses and identification
    cards. However, the Act provided States with flexibility for
    complying with Federal requirements and ensured privacy
    protections.
        Without the benefit of Congressional hearings and before
    the negotiated rulemaking committee held its second meeting,
    the REAL ID Act was included in the 2005 Emergency Supplemental
    Conference Report, thus replacing the collective effort to
    address the 9/11 Commission's recommendation.
        From its inception, REAL ID has been controversial and
    criticized by both ends of the political spectrum. The Act
    places a significant unfunded mandate on States and poses a
    real threat to privacy and civil liberties.
        In issuing the REAL ID regulations, DHS has acknowledged
    the implementation problems and the need to address the burdens
    placed on the States. Secretary Chertoff announced that States
    could easily apply for a waiver for the compliance deadline and
    could use up to 20 percent of the States' Homeland Security
    Grant Program (SHSGP) funds to pay for REAL ID implementation.
    To me, this proposal does nothing to address the cost of REAL
    ID which DHS makes estimates to be anywhere from $17.2 billion
    to $23.1 billion. Moreover, the President's fiscal year 2008
    budget proposes to cut SHSGP by 52 percent. On top of this,
    States have already designated SHSGP funds for particular
    homeland security projects, such as interoperability equipment,
    physical security structures, training, and evacuation
    planning.
        My other concern is a serious threat by REAL ID to the
    privacy of Americans' personal information. The massive amounts
    of personal information that would be stored in State databases
    that are to be shared electronically with other States, as well
    as unencrypted data on the card, could provide one-stop
    shopping for identity thieves.
        In addition, the DHS regulations failed to address redress
    mechanisms for individuals whose data is lost or stolen in
    another State or guidance on how States are to secure source
    documents.
        As a result, REAL ID may make us less secure by giving us a
    false sense of security. Unfunded mandates and the lack of
    privacy and security requirements are real problems that
    deserve serious consideration and workable solutions.
        Congress has a responsibility to ensure that drivers'
    licenses and ID cards issued in the United States are
    affordable, practical, and secure, both from would-be
    terrorists and identity thieves.
        Over half of our Nation's State Legislatures, 28, have
    acted to introduce or to pass legislation expressing concern or
    calling for repeal of REAL ID. Two States, Maine and Idaho,
    have passed legislation to opt out of complying with REAL ID.
    In Hawaii, a resolution passed the State Senate which calls for
    repeal of those provisions of REAL ID that violate the rights
    and liberties guaranteed under the Hawaii State Constitution
    and the Constitution of the United States and create unfunded
    mandates for the State without any plan for financial
    subsidization for implementation.
        To address these concerns, I reintroduced the Identity
    Security Enhancement Act, S. 717, with Senators Sununu, Leahy,
    and Tester, to repeal REAL ID and replace it with a negotiated
    rulemaking process and the more reasonable guidelines
    established in the Intelligence Reform and Terrorism Prevention
    Act of 2004. It is in the interest of Americans that this
    hearing shed light on the problems with REAL ID and provide a
    forum to discuss solutions that both protect the Nation and
    Americans' privacy and civil liberties.
        I now turn to my good friend and partner on so many issues
    to improve government programs, Senator Voinovich, for any
    opening statement he may want to make. Senator Voinovich.

                 OPENING STATEMENT OF SENATOR VOINOVICH

        Senator Voinovich. Thank you, Mr. Chairman, for holding
    this important hearing today to discuss the proposed
    regulations for implementation of REAL ID. The statutory
    requirement to issue 245 million--245 million--secure drivers'
    licenses in 5 years places a significant burden on our States,
    which bear the bulk of the responsibility for meeting the
    mandate.
        The long-awaited draft regulation to implement REAL ID was
    released earlier this month. I want to begin by commending the
    Department of Homeland Security for its outreach process. The
    draft regulation clearly reflects a number of common sense
    recommendations that have been made by the States.
        I had the opportunity to meet Secretary Chertoff last month
    to discuss REAL ID and was heartened by his sincere commitment
    to make full use of the flexibilities provided in the draft
    regulation. Secretary Chertoff is firmly committed to waiving
    the May 2008 compliance deadline until the end of 2009 for any
    State that makes a reasonable request.
        However, I am concerned by the number of hurdles that stand
    in the way, including the cost to States and the lack of
    availability of electronic verification systems. It is
    important that we work together to find solutions to these
    challenges before us. The relationship between the Federal
    Government, State, and local governments should be one of
    partnership. Sadly, that is not always the case as the Federal
    Government has a tendency to force new responsibilities on
    State and local governments without providing adequate funding
    to cover the true cost.
        As Governor of Ohio, I became particularly concerned with
    the cost of Federal mandates. During my tenure, I worked
    tirelessly with State and local government groups to pass the
    Unfunded Mandates Reform Act. As a matter of fact, the first
    time in my life that I set foot on the floor of the U.S. Senate
    was when the unfunded mandates relief legislation passed. I was
    in the Rose Garden representing State and local governments
    when President Clinton signed the legislation in 1995 and that
    pen is proudly displayed in my office today.
        DHS estimates that the cost for States to comply with REAL
    ID will exceed $14 billion, and that most of these costs will
    be incurred in the first 5 years. Ohio, my State, estimates
    that it will need $45 million to comply and $11 million
    annually to run the program. As someone who has been
    responsible for balancing a public budget, I can assure you
    these are significant costs that require tough choices.
        This unfunded mandate poses a significant financial burden
    on States, many of whom are facing tight budgets. Though I am
    pleased the Department will allow States to use 20 percent of
    their State Homeland Security Grant Program funds to help
    implement REAL ID, I worry about the unmet homeland security
    needs that will be put on the back burner if States select this
    option.
        For example, last month, I was in Cuyahoga County, the
    largest county in Ohio, to discuss the cost of implementing
    their interoperability program, which is $114 million. It is
    ridiculous to ask States to use 20 percent of their State
    homeland grant programs, which in most cases have already been
    allocated, to implement REAL ID.
        I question whether Congress understands the huge cost
    burden we are placing on States, and I believe that the Federal
    Government should provide the necessary funding to aid States
    as they reconfigure their drivers' license requirements to meet
    their new Federal responsibility.
        Technology will also be a key factor in the successful
    implementation of REAL ID. States will need functional access
    to a number of databases for verification of an individual's
    identity. Given the limited time frame, our Federal Government
    must move quickly to ensure nationwide access to the required
    databases. As we ask States to do their part, we must be sure
    the Federal Government is also meeting its responsibility in a
    timely manner.
        The implementation of REAL ID comes at a time when the
    Federal Government is developing a number of new identification
    documents, including the Pass card, biometric passports, the
    TWIC card, and the Fast card. It seems to me that we ought to
    take a fresh look at the various identification requirements
    and consider whether or not some of these documents could be
    used for multiple purposes. For example, common sense would
    suggest that residents could use their REAL ID cards to cross
    our Northern land border instead of having to also apply for
    either a Pass card or a passport.
        My concern should not suggest that I am opposed to REAL ID.
    Rather, I want to be sure that as we move forward with
    implementation, we are honest about the true cost of
    compliance. DHS must also redouble its efforts to work closely
    with States to help ensure a seamless implementation. This
    partnership is essential to the success of REAL ID, and more
    importantly, to securing our homeland from another terrorist
    attack.
        Mr. Chairman, today's hearing marks an important first step
    in our oversight of REAL ID. As implementation moves forward, I
    would suggest that we invite some of our witnesses today,
    including DHS, to report back to us in 3 months on their
    progress.
        Senator Akaka. Thank you very much, Senator Voinovich.
        Now I will ask for the statement from the Senator from
    Maine, Senator Susan Collins, who has been a great leader in
    the Senate and especially with the Homeland Security Committee
    here. As I mentioned earlier, her State has already taken
    action on REAL ID, so, we are glad to have you here, Senator
    Collins.

                  OPENING STATEMENT OF SENATOR COLLINS

        Senator Collins. Thank you very much, Mr. Chairman. I must
    say, I am very envious of the gift that the Honolulu Mayor
    brought to you. You look quite festive decked out in your lei
    there.
        Mr. Chairman, I am very pleased to join today in the
    discussion of the REAL ID Act of 2005 and the draft regulations
    that the Department of Homeland Security has recently issued to
    implement this program and I very much appreciate the comments
    that both the Chairman and Senator Voinovich have been making
    on this issue.
        I first became involved in this issue back in 2004 when
    Senator Lieberman and I were working on legislation to
    implement the recommendations of the 9/11 Commission, which
    included recommendations for more secure identity documents,
    including drivers' licenses. The Commission pointed to the fact
    that several of the hijackers used drivers' licenses to gain
    access to airplanes and that they had obtained them in some
    cases through fraudulent documents.
        To respond to that legitimate concern, Senator Lieberman
    and I drafted negotiated rulemaking provisions that were put
    into the Intelligence Reform Act of 2004 that called upon the
    Department of Transportation to convene a group to work with
    State officials, privacy advocates, and technological experts
    to come up with a workable, practical solution to the problem
    identified by the 9/11 Commission.
        And indeed, this committee, this rulemaking committee, was
    appointed. Maine's Secretary of State was one of the members
    and they were working along, making progress, doing exactly
    what they were charged with when, unfortunately, the House
    moved ahead and tacked on the REAL ID Act to an emergency war
    supplemental bill. This Act repealed the negotiated rulemaking
    provisions of the Intelligence Reform Act, and proceeded to
    direct the Department to unilaterally draft regulations.
        Well, now we find ourselves 2 years from the passage of the
    REAL ID Act, which repealed these 2004 provisions before they
    were given a chance to work, and only a year from the statutory
    deadline for compliance. I am very pleased that in response to
    concerns that many of us raised, the Department of Homeland
    Security has responded by extending the compliance deadline
    considerably and by trying to put back in place the negotiated
    rulemaking process, albeit as a response to the preliminary
    regulations rather than starting from scratch, and those
    provisions are similar to the bill that Senator Akaka and
    Senator Sununu have introduced to try to reintroduce negotiated
    rulemaking. I think that is going to greatly improve the
    process.
        We need to make sure that in the pursuit of more secure
    drivers' licenses that we are not jeopardizing the fundamental
    liberties of our citizens and that we are not simply handing
    the bill, an enormous bill, over to the states that requires
    them to divert funds from other vital homeland security
    activities. In that regard, I want to associate myself with the
    comments made by the Senator from Ohio, who is both a former
    governor and a former mayor and has a special appreciation for
    unfunded mandates.
        The State of Maine has estimated that the cost of complying
    with the REAL ID Act would be six times the cost of the entire
    budget for the Bureau of Motor Vehicles. So the cost of this
    remains a concern, and while I appreciate the Department trying
    to introduce flexibility, the fact is that the need for
    Homeland Security grant monies for a host of other vital and
    urgent needs remains, and I think it is going to be very
    difficult for States to use 20 percent of those funds to pay
    for compliance with the REAL ID Act.
        So I think this is an issue that we are going to have to do
    more work on, on the cost issues, on the privacy issues, and on
    the technology issues. This is not an easy task to make sure
    that States can tap into databases of other States and it
    raises many security concerns.
        So, Mr. Chairman, I thank you for holding this hearing, a
    hearing that had the normal course been followed with the REAL
    ID Act, we would have held years ago and I think we would have
    ended up with more reasonable legislation. So thank you.
        Senator Akaka. Thank you very much, Senator Collins.
        Now, before we move on, I would like to ask Senator Warner
    for any statement that he may have.

                  OPENING STATEMENT OF SENATOR WARNER

        Senator Warner. Thank you, Mr. Chairman. I am pleased to be
    here because I am quite interested in this whole concept. I
    really think America needs to explore this particular concept
    in the national security interest. This is where my primary
    concern arises.
        We have now learned that the duplication and the
    falsification of drivers' licenses is quite feasible. Our
    security here at home is highly dependent in certain areas,
    like when boarding aircraft and otherwise, to have some sense
    of confidence that the individual that displays the card is, in
    fact, the rightful owner of it. And this card, because of
    technical advances, can be produced in such a way as to greatly
    increase the security as associated with any type of
    identification individual proffers, whether it is for the
    airlines or other purposes.
        So I approach this with an open mind, leaning hard towards
    seeing what we can do to help the States facilitate the law as
    it is now written, and if necessary, to change the law that is
    written to try to further help our States. But the bottom line
    is we have got to come to the recognition that the life before
    us is different than the life behind us and that we are faced
    with very serious threats from abroad and perhaps, regrettably,
    some internally, and this type of identification will go a long
    way to, I think, make us more secure here at home.
        I thank the Chairman.
        Senator Akaka. Thank you very much, Senator Warner.
        Senator Warner. I would ask to put the balance of my
    remarks in the record.
        Senator Akaka. It will be included in the record.
        [The prepared statement of Senator Warner follows:]
                      PREPARED STATEMENT OF SENATOR WARNER
        Thank you for calling today's hearing as I feel it is one that
    deserves greater attention in this Committee and indeed the entire
    Senate. Since the passage of the Real ID Act many have criticized the
    program for reasons of cost, inefficiency, and privacy. It is my hope
    that we may today explore these concerns and some potential solutions.
        I believe that standardized identification criteria among the
    States will make for a more secure country. We can eliminate fraud,
    provide a barrier to crime, and ultimately protect the American public
    better if we can rely on the authenticity of state issued drivers'
    licenses and identification cards. I believe that the sooner we have
    Real ID in place, the better. However, I have one significant concern
    with the program as it has been proposed--the passing of an unfunded
    mandate onto the States.
        It is my firmly held belief that the primary responsibility of the
    Federal Government is to provide for the national defense. And I also
    believe that the Real ID program is a part of this responsibility. What
    I do not understand is why this federal responsibility is not being
    funded by the Federal Government.
        The National Governors Association has estimated that the cost of
    compliance to the States with Real ID will be approximately $11
    billion. The Administration has argued that the costs should simply be
    passed on to the users in the form of increased fees for drivers
    licenses. Certainly larger states that issue millions of licenses can
    absorb these costs much easier than smaller states that may only issue
    a few hundred thousand.
        I am pleased that the Department of Homeland Security has
    recognized this issue and intends to help the States with some of the
    costs of compliance by paying for the network build-out but am
    concerned that this only represents a fraction of the costs to the
    States.
        I look forward to hearing more from our witnesses about their
    concerns and am hopeful that we may come together on some common ground
    on this important issue.

        Senator Akaka. I want to welcome the Hon. Richard Barth,
    Assistant Secretary for the Office of Policy Development at the
    Department of Homeland Security, to this Subcommittee hearing
    today.
        Mr. Barth, it is the custom of this Subcommittee to swear
    in all witnesses, so please stand and raise your right hand.
        Do you solemnly swear that the testimony you are about to
    give this Subcommittee is the truth, the whole truth, and
    nothing but the truth, so help you, God?
        Mr. Barth. I do.
        Senator Akaka. Let the record note that the witness
    answered in the affirmative.
        Thank you. While statements are limited to 5 minutes, I
    want all of our witnesses to know that their entire statements
    will be included in the record.
        Mr. Barth, will you please proceed with your statement.

      TESTIMONY OF HON. RICHARD C. BARTH,\1\ ASSISTANT SECRETARY,
       OFFICE OF POLICY DEVELOPMENT, U.S. DEPARTMENT OF HOMELAND
                                SECURITY

        Mr. Barth. Chairman Akaka, Senator Voinovich, and
    distinguished Members of the Committee, thank you for the
    opportunity to appear before you today to discuss REAL ID.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Mr. Barth with an attachment appears
    in the Appendix on page 48.
    ---------------------------------------------------------------------------
        I also want to take this opportunity to thank you for
    introducing S. Res. 94 earlier this month to honor the
    employees of the Department of Homeland Security on the
    Department's fourth anniversary. It was gratifying to the
    employees to receive this recognition by the Senate.
        Your subject for this hearing, ``Understanding the
    Realities of REAL ID,'' is highly appropriate and timely. This
    is a very challenging program for both the States and the
    Federal Government to implement, with many complexities ranging
    from cost to technically integrating various data links while
    imposing strong data security and privacy protections.
        Let me be clear at the outset. Effectively implementing a
    REAL ID program is a top priority for DHS. REAL ID is
    fundamental to our security as a Nation. We can debate the
    costs. We can fret about the time to implement and time waiting
    in line to obtain a REAL ID. But the inextricable link to
    ensuring that people are who they say they are when someone
    gets on an airplane and sits next to you is of paramount
    importance to preventing another September 11.
        All but one of the September 11 hijackers acquired some
    form of U.S. identification document. Eighteen hijackers
    fraudulently obtained 17 drivers' licenses and 13 State-issued
    identifications and some even possessed duplicate licenses. The
    pilot who crashed American Airlines Flight 77 into the
    Pentagon, Hani Hanjour, had ID cards from three States. The
    drivers' licenses and State IDs enabled the hijackers to
    maneuver throughout the United States in order to plan and
    execute critical elements of their mission. Using these
    documents, they were able to rent cars, take flying lessons,
    and board airplanes. The hijackers believed that holding
    drivers' licenses and ID cards would allow them to operate
    freely in our country, and they were right.
        So again, as I will repeat over and over again today, our
    security as a people and collectively as a Nation relies on
    valid identification documents.
        Counsel to the 9/11 Commission, Janice Kephart, said the
    REAL ID recommendation was ``perhaps the single most effective
    measure the United States can accomplish to lay the necessary
    framework for sustainable national and economic security and
    public safety.'' Said another way, identity document security
    is a prerequisite for overall security in the United States. If
    we cannot verify that people are who they say they are and if
    we allow loopholes in obtaining drivers' licenses and IDs to
    exist, DHS's job and that of law enforcement becomes
    exponentially more difficult. Sadly, four of the hijackers had
    been stopped for traffic violations in various States while out
    of legal immigration status, a condition that should have
    resulted in their drivers' licenses expiring.
        Key features of the proposed rule include the following.
    Individuals seeking drivers' licenses or personal ID cards will
    need to establish their identity, U.S. nationality or lawful
    immigration status, date of birth, Social Security number, and
    principal residence. States would verify the issuance validity
    and completeness of the document presented. As you can see by
    the chart,\1\ which is also included in my testimony,
    electronic verification of these documents is a work in
    progress. But in some areas, we can quickly get the States
    online. For example, birth certificate information can be
    brought online for all States for about $4 million, and we hope
    to be able to use existing DHS grant money to facilitate that
    over the next year or so.
    ---------------------------------------------------------------------------
        \1\ The chart submitted by Mr. Barth appears in the Appendix on
    page 56.
    ---------------------------------------------------------------------------
        Standard information will be required to appear on the
    cards, including full legal name, date of birth, gender, a
    unique identification number, a full facial digital photograph,
    address of principal residence, issuance and expiration dates,
    and signature. The cards would also have physical security
    features and a common machine-readable technology.
        Each State must prepare a comprehensive security plan for
    all State DMV offices, storage and production facilities,
    databases, and systems. Employee background checks would be
    required to decrease the probability of criminal collusion with
    DMV employees.
        Further details on the floor that we are establishing for
    more secure IDs is in my written testimony, and it is important
    to note that the States are not precluded from requiring
    additional security features.
        The September 11 attacks cost 3,000 lives and $64 billion
    in immediate losses followed by longer-term financial losses of
    $375 billion. The potential for further loss of life and
    property far outweighs the financial burdens to States and
    territories in implementing REAL ID. As the Secretary noted
    when he held his press conference when we published the rule,
    these new cards will cost less than $20 additional each time
    you renew your license.
        I personally believe that any further delay in implementing
    REAL ID would significantly increase our vulnerabilities as a
    Nation, and as long as I have responsibility for this program,
    I intend to do everything possible to make sure that fake IDs
    are not part of the scenario in the next terrorist plot
    successfully carried out in this country.
        To echo the words of the 9/11 Commission, for terrorists,
    travel documents are as important as weapons. Our security, as
    a Nation, is at stake, and I hope you will support the full
    implementation of REAL ID. It is a national problem and demands
    a national solution.
        Thank you, Mr. Chairman, for the opportunity to testify
    today and I look forward to your questions.
        Senator Akaka. Thank you very much, Mr. Barth.
        Hawaii is an island State whose residents depend on air
    travel to travel within the State. If the State decides not to
    comply with the requirements of the REAL ID or if individuals
    in Hawaii cannot obtain a REAL ID-compliant driver's license,
    will DHS grant a waiver for inter-island travel so that our
    residents will be able to travel within the State to visit
    family and friends on other islands?
        Mr. Barth. That is a very good question, Mr. Chairman, and
    we are looking at various solutions for that question that
    would not prevent the residents of Hawaii from getting around
    the islands. One of the obvious solutions is that a passport,
    for those who hold a passport, is an easy alternative for
    getting on an airplane even if Hawaii decides to opt out of
    REAL ID.
        In addition, we are looking at alternative documentation
    like a Federal Government-issued ID out of the Department of
    Homeland Security to deal with citizens of States who want to
    be able to travel freely and easily on airplanes and provide an
    alternative to the REAL ID that would be equally validated and
    equally difficult to make fraudulent cards from.
        And finally, I would note that in virtually all cases where
    DHS has security, whether it is Customs coming into the country
    or TSA and airports for controlling security in airports, there
    is a secondary referral process that you can go to and present
    other kinds of documentation that will help inform the
    inspector to make a decision as to whether or not to let you
    onto the airplane without a REAL ID. So there are multiple
    scenarios that we think will effectively address your concern.
    Thank you.
        Senator Akaka. As you know, Mr. Barth, many people are
    worried about the REAL ID's impact on privacy and civil
    liberties. Because of this, did the White House Privacy and
    Civil Liberties Board review the regulations, and did DHS make
    any changes to the regulations based on their comments? If so,
    would you please describe those changes?
        Mr. Barth. Thank you, sir. I am not aware that the White
    House Privacy Board looked at the regulation before it went
    out. There is a White House circulation process and I am not
    aware of all the details of it. However, we were very concerned
    with the privacy issue. I think the regulation and the preamble
    to it goes into it at great length about our concerns to make
    sure the databases are secure. Certainly the background checks
    on DMV employees are a big part of protecting privacy.
        But we also issued at the time that the regulation came out
    or shortly thereafter a 25-page privacy impact analysis that
    our own Privacy Office did for DHS and it clearly addresses a
    lot of the different concerns, even beyond the regulation
    itself. We are looking forward to receiving comments from the
    privacy civil rights and civil liberties communities on the
    regulation during this 60-day comment period and we will do
    everything within our ability to try to make sure that their
    concerns are fully taken care of.
        No one wants to be a subject of identity theft, and so we
    want this document to be as secure as possible to become an
    added advantage in a world where identity theft is becoming a
    multi-billion-dollar problem for citizens across the country.
        Senator Akaka. As you know, Mr. Barth, REAL ID is going to
    cost State and local governments billions of dollars. Although
    DHS has approximately $40 million in grant funding to provide
    States and has authorized the use of State Homeland Security
    Grants, this is not enough. What are DHS's plans for helping
    States pay for REAL ID?
        Mr. Barth. Mr. Chairman, I think that the $40 million is
    something that we are looking at to become a keystone of doing
    one particular factor or technology link that needs to be
    accomplished to make REAL ID work and we are working with our
    grants and training folks in the Department and consulting with
    States on trying to find a way of funding the interconnectivity
    of all of those databases that you see up there while paying
    close attention to privacy and data security issues. So we are
    working to try to get the most significant impact out of that
    $40 million that has already been appropriated.
        Beyond that, I have expressed to our friends at the
    National Governors Association, National Council of State
    Legislatures, that they have significant lobbying powers and
    that we will not in any way, shape, or form try to object to
    them acquiring other money through appropriations and
    authorization by the Congress, but we just don't feel like that
    is necessarily our role at this time.
        The finalization of interoperable, interconnected networks
    of networks, which is what that chart represents, is something
    that we believe will cost probably more than $40 million and we
    are right now working with our various technology groups in the
    Department of Homeland Security, the CIO's Office, for example,
    to identify the way to link up these databases securely and
    with due process for identity theft and other problems, and
    when we conclude the preliminary work-up of that, we will be
    submitting to Congress, hopefully for the 2009 fiscal year
    budget, a proposal to have the Federal Government take on the
    responsibility of networking those networks effectively and
    securely.
        Senator Akaka. Mr. Barth, you have repeatedly said that the
    States will use a pointer system, which is based on the
    Commercial Driver's License Information System, to verify
    information from other States. However, the regulations do not
    state this and instead leave open how States are to share
    information with each other. This may be one reason why
    Americans fear this is becoming a national ID card. Why didn't
    DHS just require the use of CDLIS for REAL ID?
        Mr. Barth. Mr. Chairman, that is a very good question and
    there is a ready answer for it. The CDLIS system handles in the
    tens of millions of commercial drivers' licenses each year and
    it does so very effectively, and I might point out that to the
    Department of Transportation's knowledge, which has been
    managing the funding and the establishment of the Commercial
    Driver's License System since, I think, 1986 when they started
    the roll-out of that system, there have been no Privacy Act
    violations, so there is an additional reason, perhaps, to use
    that system, as you have suggested.
        At the time when we wanted to bring the regulation to
    closure and get it published, we were in intense dialogue with
    AAMVA, which manages the CDLIS system for the Transportation
    Department, as to their system and particularly whether it had
    the ability to scale up in time to handle the 240 million non-
    commercial drivers' licenses that need to be renewed over a 5-
    year period as part of this program.
        So we are getting closer and closer to having the kind of
    assurance for that exact pointer system, which has not had
    privacy problems since 1986, might be exactly the solution that
    we want. We are not ready to say that yet. It may be several
    more months. But to the extent we can possibly put that in the
    final regulation as our pathway forward, I will certainly take
    your comments on board, also, because we are inclined towards
    that.
        Senator Akaka. While the REAL ID Act requires States to
    verify information against certain databases, I understand that
    some databases do not exist and others are only in the pilot
    phase. Can you provide us specific data on the status of each
    database and their estimated time of availability on a national
    basis?
        Mr. Barth. Yes, sir. Mr. Chairman, again, I will refer to
    the chart that we provided up here. If you look at the far
    right, it is a column that shows absolutely no check-marks for
    States being able to access the Passport Office records for
    your individual passport to confirm that you are who you say
    you are. Interestingly, that database exists, it is highly
    accurate and very robust, and the only thing that is missing is
    the interconnectivity between the State DMV offices and the
    State Department Passport Office. We, for example, query that
    passport database all the time as part of the DHS's mission.
        So the chart, while it shows significant gaps, as you are
    suggesting, I think it also, when you dig deeper into
    explaining each of those links, it is not as bad as it looks.
        The next column over, which is the birth certificate
    confirmation, I am informed by the Department of Health and
    Human Services that 85 percent of all birth certificates dating
    back to 1935 have already been digitized. Those checks there
    show the pilot program that is effectively linking the birth
    records with DMV offices, and as I said in my oral testimony
    and the written testimony, for only $4 million, we can have
    that total column there have checks for that interconnectivity
    that we require.
        So each one is a different story and it would--perhaps in
    questions for the record we can give you all the details you
    wish.
        Senator Akaka. Thank you so much for your responses. Let me
    now call on Senator Voinovich for his questions.
        Senator Voinovich. Thank you.
        Dr. Barth, the proposed regulations state that DHS will
    require the use of several databases to electronically verify
    lawful status and Social Security numbers of individuals. They
    include Social Security Online Verification.
        The Department of State's Consolidated Consular Database,
    Electronic Verification and Vital Events System (EVVE), and the
    Systematic Alien Verification for Entitlement (SAVE), I
    understand, all 50 States have Memorandums of Understanding or
    access to SAVE. However, only 20 are currently using it to
    verify lawful status. States will also need to access U.S.
    Immigration and Customs Enforcement Student and Exchange
    Visitor Information (SEVIS).
        The question I have is how far in advance are you going to
    be able to have all these databases up and working?
        Mr. Barth. Thank you, Senator, for the question. If I could
    answer with the precise date, I would be thrilled to do so. I
    can tell you that we have teams working very hard to provide
    all that connectivity and all that verification capability that
    we share with you in wanting to provide to the States.
        If, for example, the State Department for funding reasons
    or manpower reasons or priority reasons is unable to provide 50
    States plus 7 territories linkage to their passport database,
    we will look very closely at finding some waiver authority
    within the Secretary's authority that would allow us to defer
    bringing the passports online until it is technologically
    feasible, funded, and has actually been accomplished by the
    State Department. In making sure that we don't create a
    loophole for further fraudulent activity, we could
    significantly increase the training for DMV officials on
    spotting fraudulent passports.
        So we think that there are tradeoffs there between
    fraudulent document review and actual exceptional digital
    verification that we can make in the early years of the roll-
    out of REAL ID.
        Senator Voinovich. I think you have answered the second
    question that I was going to ask, and that is if the databases
    are not up and working by the May 2008 deadline, do you have
    the authority through regulation to extend that period beyond
    that date?
        Mr. Barth. My understanding is that we will have the
    authority to extend beyond that date, yes, and we will be--our
    hard target, if you will, for filling in that entire chart with
    check-marks for all 50 States and all five databases would be
    the December 31, 2009 deadline for which the Secretary has
    indicated he will issue waivers. But for those states that have
    indicated to us they want to be early adopters, if you will, we
    believe we have the authority to give them alternatives to
    electronic verification of a passport.
        Senator Voinovich. Is there any effort being made to
    coordinate the technology that is going to be implemented by
    the various States?
        Mr. Barth. Yes. We have considered that issue and have
    actually raised it in the regulation, and at this point in
    time, the proposed rule would not require the 50 States to use
    the connectivity that we provide. However, in order to ensure
    that data passes back and forth through the network
    efficiently, that is one of the reasons why we believe it
    should be a Federal responsibility to pay for the build-out of
    that network of networks to remove the incentive for a State to
    perhaps go down a different path. If it is paid for, built out
    faster than anything else, etc., we think that will be a
    powerful incentive to the States coming online, a single system
    rather than creating a panoply of systems, as you suggest.
        Senator Voinovich. You are developing technology that you
    will share with the States?
        Mr. Barth. We would not develop technology. We would seek a
    technology solution funded by the Federal Government that the
    States would have a large stakehold in. We have not yet defined
    in a high level of granularity what that will look like, but I
    will draw an analogy to the Department of Transportation, which
    funds the development of this CDLIS system that the Chairman
    was referring to, but the States own the system and have funded
    AAMVA, the American Association of Motor Vehicle
    Administrators, to build out this CDLIS system.
        And if that system proves to be, as I certainly hope it
    does, the framework for a significantly scaled up civilian
    driver's license verification network, it will have the
    advantages that the Chairman mentioned of being a pointer
    system, not a lot of data flowing. It won't retain a lot of
    data in a central database, which poses its own risks. And it
    will give us a platform on which to build without having to
    invent new technology.
        Senator Voinovich. Are you going to be able to guarantee
    that information is going to remain private?
        Mr. Barth. To the extent that we can provide the
    safeguards, we believe that this system will be vastly an
    improvement over the current 50-plus-7 territories systems that
    are built out now. Whether it is the documented cases last week
    in North Dakota of fraudulent driver's license activity,
    whether it is the $4,000-per-license cost to collude with an
    internal DMV person in New Jersey, or some Connecticut similar
    fraud cases in the past, I think wherever you have human beings
    involved and the capability to bribe them to do things that are
    wrong, you can't say there is zero risk.
        Senator Voinovich. Could somebody break into the system and
    get the information?
        Mr. Barth. They are likely to be under the age of 20, not
    to be glib, sir. But I think that we are going to provide the
    safeguards to do everything possible to prevent that from
    happening.
        Senator Voinovich. One concern of the NGA is that 24 States
    have a driver's license renewal period that is longer than 5
    years, many have 10 years. I understand that in the regulations
    you have ruled out 10 years and have said States have to do it
    in 5 years. I would like you to explain why DNS has chosen the
    5-year renewal date?
        Mr. Barth. In the consultation we did with the States,
    which have a very wide ranging number of years before renewals
    are required, we certainly didn't arbitrarily choose, but in
    consultation with them chose about an 8-year period for
    renewals as the maximum that we would allow. States that
    currently have 4-year renewals, they can continue their 4-year
    renewals. states that have 8-year renewals would have to--the
    individual applying for the driver's license would have to
    reappear every 16 years, so every other cycle, in person to
    revalidate their data, their place of--their documentation----
        Senator Voinovich. It is not 5 years?
        Mr. Barth. It is not 5 years, sir.
        Senator Voinovich. I thought that was in the regulation.
        Mr. Barth. I don't believe so. Yes. You are referring to
    the 5-year implementation period for the very first cycle of
    everyone in America who has a driver's license who lives in a
    State that opts into REAL ID, they have to move through that
    first cycle in 5 years. The second cycle is 8 years, and every
    cycle after that is a maximum of 8 years, but States can choose
    a shorter cycle.
        Senator Voinovich. Ambassador Wilson came in to see me last
    week and we talked about the Western Hemisphere Travel
    Initiative. As I mentioned in my opening statement, I want to
    ensure that DNS is taking into consideration the
    interoperability between the various screening tools and ID
    documents?
        Mr. Barth. Yes, it is, sir. Governor Gregoire of Washington
    State approached us some months ago with a proposal that we
    partner with Washington State on a dual-use Western Hemisphere
    Travel Card, WHTC, we call it, and REAL ID, and we fairly
    quickly sent back from Secretary Chertoff to the governor a
    letter saying we would definitely like to explore this with
    you. The ``too many cards out there'' problem is something we
    would like to try to get under control.
        Senator Voinovich. I would suggest that you stay on top of
    it. DNS should work with what they are doing there and
    individuals so they don't have to get multiple sources of ID in
    order to travel back and forth between Canada and the United
    States. There is real concern about moving people back and
    forth in the border States.
        I know in Ohio, we have many Canadian tourist visiting. We
    would like to make sure that they continue to visit our great
    State.
        Mr. Barth. We are piloting this in Washington State, and we
    expect to roll it out January 1, 2008, which I think is a very
    efficient way forward, and in many ways, that will show us the
    way forward for a lot of the border States, but any State, Ohio
    included, or Florida, if they want a dual-use card for, say, a
    snowbird from Ontario or somewhere, we would be very happy to
    try to accommodate that.
        Senator Voinovich. That would be wonderful. Stay on top of
    it and do what you can to make sure they get it done on the
    date that they say they are going to get it done.
        Mr. Barth. Thank you, sir. I will do that.
        Senator Akaka. Thank you very much, Senator Voinovich.
    Senator Collins.
        Senator Collins. Thank you, Mr. Chairman.
        Mr. Barth, in responding to a question from Senator
    Voinovich, you referred to states that choose to opt in to the
    REAL ID. But, in fact, States have very little choice but to
    participate in this new system. If they don't participate, then
    their citizens cannot board airplanes, they cannot gain access
    to certain Federal buildings. There are all sorts of practical
    ramifications. So do you really think that there is an
    alternative for any State but to opt in?
        Mr. Barth. Senator Collins, the 9/11 Commission was very
    clear as to the fundamental nature of clarifying this ID thing
    to prevent a future terrorist attack. I think that legislation
    reflects exactly what you just said, which was drafted by the
    Congress and we are trying to implement it.
        I think that with the alternative documentation, as I have
    already explained, a federally-issued other ID, for example,
    military ID, the military residents of Maine will be able to
    travel around without a REAL ID, we expect. Passport holders,
    which is some 30, and growing, percent of the American
    population, will be able to use that document. And if we, and I
    am expecting we will come up with a Federal alternative, a
    Maine farmer who never wants to leave the State or get on an
    airplane will be happy without his REAL ID and a Maine citizen
    who wants to travel will have multiple alternative documents to
    acquire to travel freely like anyone who has opted into the
    system.
        So I believe that there are strong incentives to come into
    the REAL ID program and opt in, but I believe that the
    disincentives are relatively low given the potential risk and
    vulnerability that it presents to the whole country. For states
    that continue to issue documents that are not as secure as
    other States--if you are a terrorist, you will very quickly
    find online that State X is where you go to get your fraudulent
    document to get on an airplane and drive it into a building.
        Senator Collins. I guess my point is that we need to face
    the practical reality that States almost certainly are going to
    have to participate in this program because of the practical
    consequences of not doing so for their citizens, which brings
    me back to the cost issue. The Department, when it issued its
    draft regulations, estimated that the cost to States of
    compliance with the REAL ID Act would be $14.6 billion over 10
    years. The NGA has estimated $11 billion over 5 years. Really,
    those are very similar estimates because a lot of the costs
    would be in the first 5 years, so I think it is fair to say
    that there is substantial agreement that we are talking about
    billions of dollars over a 5- and 10-year period for
    compliance.
        If the Federal Government is imposing this mandate,
    shouldn't we go beyond the $40 million that you have mentioned
    that could be used to set up a very useful interstate database
    that would allow for States to check each other's databases? I
    mean, isn't that just a drop in the bucket when you are talking
    about costs of this magnitude?
        Mr. Barth. Yes, that is a drop in the bucket, and even if
    it costs a couple hundred million--and we don't know the number
    yet--to fully integrate the databases securely and with data
    privacy protections installed, it is still a small portion of
    the cost compared to hiring people, in some cases, building
    additional lanes, bricks and mortar kinds of facilities,
    obtaining the equipment necessary.
        We are doing everything we can to mitigate those costs. For
    example, one of the things that we are going to do is work with
    GSA to have a single contract procurement activity for the
    cardstock and the card issuance equipment and allow GSA to put
    up on their procurement site enablement for all States to come
    in and buy, I presume, at lowest possible cost all the
    equipment and all the cardstock they need. This would save not
    only costs on the direct acquisition of those items with just a
    direct procurement from that list, but it would also save 50
    different State procurements. We are seriously looking at the
    cost issue and doing everything we possibly can to reduce it.
        But I think you have to look at it in a way of also
    evaluating which ones have already made a substantial
    investment to become, if not REAL ID compliant, but to improve
    their security. The State of Virginia has put an enormous
    amount of money into getting there already. The State of
    Michigan told us that they have spent roughly $30 million and
    they are a few million dollars from becoming REAL ID compliant.
    That is a fairly sizeable State with a fairly large population.
    So the numbers, frankly, are all over the map and we have
    instructed the economists in DHS to very closely pick apart the
    numbers that were in our proposed rule economic analysis and
    see if those costs are really that high. Even with that,
    though, I agree with you the costs are substantial and I
    believe, unfortunately, it would be very difficult for us to
    determine on a State-by-State basis how much they really need
    for this purpose.
        So I would finally note that Alabama, maybe, has provided
    the ultimate solution. I was talking to their DMV a few weeks
    ago. They have a zero-cost to the State implementation of REAL
    ID, or very close to that, depending on a final regulation.
    They entered into a contract with a service, an equipment
    provider, whereby that service and equipment provider is
    tacking on a fee to the issuance of the driver's license, and
    for no capital investment and I believe no operating investment
    by the State, they can and will be, when they rewrite the
    contract in light of REAL ID, compliant.
        So there are great models out there for mitigating the
    costs, for lowering the costs, and we are working with the
    States to----
        Senator Collins. I would say to you that paying perhaps
    double for your driver's license, most people would not
    consider to be no cost. But we will put that issue aside.
        I want to raise just one other issue in the brief time that
    I have remaining. State officials have repeatedly made the
    point to me that this system is only as good as the source
    documents and they are very concerned about training DMV
    personnel to evaluate the validity of a birth certificate, a
    baptismal certificate, a visa, or a passport. People working in
    the DMV offices are excellent public servants. They are very
    committed to the security of our country. But they are not
    trained to distinguish whether or not these source documents
    are valid and should be accepted.
        Are you going to assist States with training their
    personnel to different standards? There must be a huge degree
    of difference among the various States on birth certificates,
    for example. Someone coming into Maine who has moved from
    Virginia or Ohio or Hawaii, I am sure they have a birth
    certificate that looks different from Maine's. How are you
    going to deal with this? How are you going to train, to help
    the States train DMV personnel so that they can accurately
    assess source documents, because if they can't do that, the
    whole system on which REAL ID is based falls apart?
        Mr. Barth. Senator, there are several answers to your
    question, actually, so if you will bear with me, I will try to
    identify them.
        First off, in your passport files, once that data link is
    connected, and depending on how it is connected, you might be
    able to pull up the digital photograph of the person and
    literally match it to the person sitting in front of you. That
    biometric confirmation of who you are and that you got a
    passport, maybe all using fraudulent documents, but I hope not,
    is a very powerful confirmation of who you are.
        But more to your point specifically of training for the DMV
    officials, we have taken that into account. We have forensic
    document labs in the Department of Homeland Security. We have
    already been working with them on various aspects of this rule
    and we expect, I would say, to develop a package, a training
    package that the States could build on. The rule itself and the
    $14 billion that we highlight as the cost factors in a $300
    training cost for each and every DMV employee across the land.
    So that cost is factored in. It is not funded by the Federal
    Government, but it is factored in as one very important item,
    as you suggest.
        Senator Collins. Thank you, Mr. Chairman.
        Senator Akaka. Thank you very much, Senator Collins.
    Senator Warner.
        Senator Warner. Thank you, Mr. Chairman.
        This has been a good hearing and I am impressed with the
    amount of work that you individually and members of your
    Department have done to try and resolve this. I just hope
    Congress adopts an attitude that we have got to be a working
    partner and not get into an adversarial process and also that
    the States can be working partners.
        In the preparation of your regulations, to what extent did
    the several States participate and come forward with ideas and
    concepts to improve the regulations?
        Mr. Barth. That is a very good question and the answer, I
    think, should be very comforting to you, which is that we ran
    an open phone call with at least four States every Thursday
    since, I believe, last August to consult with the States on
    various aspects of this regulation and the economic analysis.
    That, in part, is why, as Senator Collins suggested, our costs
    and their costs line up fairly well. We have been talking
    extensively.
        Four States in particular I want to commend for being on
    virtually every one of those calls. California, Iowa, New York,
    and Massachusetts sort of formed a core group that were
    extremely interested, had the capability within their DMV
    organizations, and participated weekly, came to Washington for
    a face-to-face meeting with Deputy Secretary Jackson, really
    doing everything possible to make exactly what you said, a
    partnership with the States for this important program.
        And I am very pleased to say that my project manager for
    this, Darrell Williams, just spent the entire last week on a 5-
    day, four-city tour with the American Association of Motor
    Vehicle Administrators, pulling in regionally DMV
    administration people from many different States around the
    country. So not only has our consultation process been rigorous
    leading up to the issuance of the NPRM, it is going to continue
    to be rigorous as we move towards the final rule, and as we
    build out that network of networks, it is going to continue,
    sir.
        Senator Warner. Was part of that dialogue to discuss costs
    to the individual States?
        Mr. Barth. Yes. The States came in towards the end of
    developing their cost analysis, their $11 billion cost
    analysis. They came in jointly as the National Governors
    Association, the National Council of State Legislatures, and
    AAMVA, and they presented their document and they asked us to
    help them sort through the funding issue.
        Senator Warner. Is there any standardization of the
    criteria by which several States did make their estimates?
        Mr. Barth. No, sir, there was not. AAMVA, actually, I
    believe it was, developed the data from the States on which
    their figure and much of our figure is based. So each State had
    a different approach towards the funding and there is no
    standardization of that.
        Senator Warner. Was the thought given to trying to
    standardize it, because these estimates which were thrown out
    here, $23 billion by OMB, that, I understand, even involved the
    transportation of an individual to and from their home or
    workplace to the DMV, which strikes me as an odd way to compute
    things, but anyway DHS was at $14 billion, and $11 billion from
    the NGA. There is quite a disparity here. And then I also,
    based on the fragments that I have been able to collect, see
    where some States came in with a cost estimate, but almost
    uniformly all of them are coming down in the estimates. Would
    that be a correct assumption?
        Mr. Barth. Yes, sir, that is a correct assumption, I think
    in part because while we have been negotiating the regulation
    and getting it out, States have continued to make good, solid
    investments in many cases in their existing networks, and we
    hope that continues as we move toward a final rule, which we
    hope to announce in August. So I think that as we scrub the
    costs going forward, which as I have already said our
    economists are doing, I think that figure could be ultimately
    viewed as being very high.
        Senator Warner. What figure? I threw three out here. I
    don't know what figure you are talking about.
        Mr. Barth. The three key ones are the $23 billion includes
    if you are a disorganized person and it takes you an hour and a
    half to find your birth certificate, driver's license,
    passport, to go to the DMV. It even includes the cost of
    spending time at home finding your documents. That is the
    highest cost estimate----
        Senator Warner. I don't know which government clerk figured
    that one out.
        Mr. Barth. Well, required by OMB rules, sir.
        Senator Warner. Oh, is that it? All right. That is
    extraordinary to me. I can't believe that. Anyway, it took 2
    years to put this set of regulations together?
        Mr. Barth. It did, and I think in large part it was due to
    the extensive consultation, including, as I said, the Deputy
    Secretary, before he would sign off on the regulation, convened
    a meeting with AAMVA and the four states that I mentioned
    before that were our close partners in developing the
    regulation. So it is regrettable that it took so long, but the
    consultation process was at least as intense as it would have
    been under a negotiated rulemaking process.
        Senator Warner. Well, Congress is faced with this and we
    are getting a lot of understandable pressure. I have always
    identified myself here in my years as being one who fought
    against the compulsory mandating of legislation--I mean that
    then in turn made the States required to come up with the
    funds. I have always sort of been on the side of protecting the
    States from being subjected to this by the Congress and I am
    more than likely to continue in that vein. On the other hand, I
    am really concerned about the security elements of this.
        Where are we, do you think, in this process? Suppose
    somebody goes out here on an appropriations bill or elsewhere
    and attaches an amendment to further modify the existing law on
    this issue? Now, we have got the extension period in there.
    That is safely ensconced, would that not be correct, Mr.
    Chairman?
        Senator Akaka. Yes, the initial enrollment period has been
    extended but not the reenrollment deadline.
        Senator Warner. But I am concerned that others may have
    reason for further attack, which I want to have a convergence
    of all the information that should be brought to bear and any
    further action by the Congress to impede the progress of this
    program. Where is another time when there is going to be a
    considerable amount of data out there to try and begin to show
    the States as to how to alleviate their cost projections today?
        Mr. Barth. Yes. I think that the time frame of August-
    September is when we are targeting issuing the final
    regulation, and to the extent we can, renewing our evaluation
    of the costs. So that is when I think you will find all the
    stakeholders will have something hard to shoot at rather than
    something soft, which is a proposed rule.
        Senator Warner. So it would be wise for the Congress now to
    withhold any further action until that time period?
        Mr. Barth. Except for the funding issue, which the Congress
    will consider separately----
        Senator Warner. As to whether we are going to step up and
    fund----
        Mr. Barth. Correct. There is the $40 million that has been
    appropriated for the grants to the States, but there has been
    no funding for the DHS or any department of the government for
    this program, nor, of course, for all the other costs of the
    State. So to that extent, I think that the cost issue is just a
    significant one. But until then, we won't be able to tell you
    even how much it is going to cost to build out that network of
    networks up there. So there is not a hard target to even fund,
    in my view, at this point in time.
        Senator Warner. Well, that is, I guess, my point. You
    really can't begin to ask Congress to give us so much money to
    try and defer some of the percentages of the State costs when
    each State is putting together their cost formula by different
    methods----
        Mr. Barth. And until, sir, they see the final regulation,
    they are not even----
        Senator Warner. That is correct.
        Mr. Barth [continuing]. Going to be able to put a final-
    final cost figure per State on it, which I regret that is after
    some States even go out of legislative session.
        Senator Warner. So it is in the best interest of Congress
    to ride through this thing until early fall?
        Mr. Barth. With the amount of time and effort I and my team
    are putting into this, I would greatly appreciate that, sir.
        Senator Warner. Well, I am only one. There are many here,
    but I certainly would hope that we would proceed on this on a
    partnership concept of States and the Federal Government
    working together and the Congress to try and achieve some type
    of identification that will help America feel a little more
    secure in our daily requirements to identify ourselves and to
    otherwise conduct our life here at home. I thank you.
        Mr. Barth. Thank you for your support, Senator.
        Senator Akaka. Thank you very much, Senator Warner.
        Just to follow up on Senator Warner's questioning, Mr.
    Barth, you testified that we shouldn't act to change REAL ID.
    The proposed regulations state that DHS sought to provide for
    privacy and security to ``the extent of its authority.''
    However, the regulations ask for comments as to whether the
    privacy protections are adequate. Given that DHS has acted to
    the extent of its authority, what statutory changes to the REAL
    ID Act do you believe are necessary to protect privacy?
        Mr. Barth. At some point, Mr. Chairman, I think that the
    Congress should take seriously a concern that I believe we
    share with the privacy community, and that is that probably the
    biggest significant risk for identity theft, for issuing
    fraudulent cards, for collusion with bad actors in the DMVs,
    the biggest risk is those bad actors in the DMVs. There is
    currently law on the books that identifies penalties at the
    Federal level, penalties for collusion of DMV workers with
    someone outside the DMV in acquiring a fraudulent document. I
    would invite the Congress to look carefully as to whether or
    not those penalties are high enough.
        If it only costs $4,000 to get a fake ID and lifetime
    employment in New Jersey, for example, not even committing bad
    acts, the penalty must not be stiff enough. If the cost goes up
    to about $50,000 or $100,000 per fake ID, then you might be
    getting close. So I make that sort of in jest, but I think that
    the penalties there should be looked at closely.
        I also think that one of the threats to privacy that has
    been identified is the lack of encryption of the machine-
    readable technology that is used on the back of many cards
    issued today. I think that the technology issues and the
    encryption issues will be well vetted in the regulation, but
    the Congress could also consider coming up with substantially
    higher penalties for fraudulent use of information obtained
    from drivers' licenses, REAL ID drivers' licenses. That should
    be a real linchpin of the cost of making an error here, or
    intentionally stealing data and using it fraudulently from a
    license is so high that I don't think I am going to do it.
        Those are two very specific things that won't slow down our
    implementation of the rule, but will significantly enhance the
    effectiveness of whatever privacy protections we put into the
    rule.
        Senator Akaka. If Congress holds off on legislation, Mr.
    Barth, until the end of 2007, States will commit more and more
    funding towards REAL ID only to have the requirements modified
    if Congress acts on it later. Well, I want to thank you very
    much, Mr. Barth, for your responses to this Subcommittee and I
    want to tell you that we may have further questions for you
    that we will place into the record. Again, I want to thank you
    so much for being here with us.
        Mr. Barth. Thank you, Mr. Chairman.
        Senator Akaka. Now, I would like to call the second panel
    forward and welcome you to this Subcommittee.
         Testifying on the second panel are: State Senator Leticia
    Van de Putte, who represents the 26th District of Texas in the
    State Legislature and is the President of the National
    Conference of State Legislatures. Welcome.
        The Hon. Mufi Hannemann, Mayor of the City and County of
    Honolulu, who is accompanied by Dennis Kamimura, the Licensing
    Administrator for the City and County of Honolulu. Aloha and
    welcome, Mufi.
        David Quam is the Director of Federal Relations for the
    National Governors Association. Welcome, Mr. Quam.
        As you know, the custom of this Subcommittee is to swear in
    all witnesses, so will you please stand and raise your right
    hand.
        Do you swear that the testimony you are about to give this
    Subcommittee is the truth, the whole truth, and nothing but the
    truth, so help you, God?
        Ms. Van de Putte. I do.
        Mr. Hannemann. I do.
        Mr. Kamimura. I do.
        Mr. Quam. I do.
        Senator Akaka. Thank you. Let the record note that all
    witnesses answered in the affirmative.
        I want to thank you again for your presence and we are
    looking forward to hearing from you. Senator Van de Putte
    please proceed with your statement.

    TESTIMONY OF HON. LETICIA VAN DE PUTTE,\1\ TEXAS STATE SENATOR,
        AND PRESIDENT, NATIONAL CONFERENCE OF STATE LEGISLATURES

        Ms. Van de Putte. Thank you, Chairman Akaka, Ranking Member
    Voinovich. I am Leticia Van de Putte, President of the National
    Conference of State Legislatures and a member of the Texas
    State Senate. I appear before you today on behalf of the
    National Conference of State Legislatures (NCSL), a bipartisan
    organization representing the legislatures of our Nation's 50
    States, its Commonwealths, territories, possessions, and the
    District of Columbia.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Ms. Van de Putte with an attachment
    appears in the Appendix on page 57.
    ---------------------------------------------------------------------------
        Mr. Chairman, thank you very much for your leadership on
    this important issue, not just today with this hearing, but
    with your introduction of legislation in both the 109th and
    110th Congresses to fix the REAL ID Act. It is imperative that
    this hearing be the first step toward a successful, cost-
    effective implementation of the Act.
        Legislators across the country share the goal of improving
    the integrity and the security of drivers' licenses and
    identification cards, but we want to make sure that it is done
    right. Mr. Chairman, as you know, NCSL will call for the repeal
    of the Act if the recommendations made in the September 2006
    report,\2\ ``The Real ID Act: National Impact Analysis,''
    issued by NCSL, the National Governors Association, and the
    American Association of Motor Vehicle Administrators, are not
    implemented and the mandate fully funded by December 31, 2007.
    ---------------------------------------------------------------------------
        \2\ The Real ID Act: National Impact Analysis,'' report submitted
    by Ms. Van de Putte appears in the Appendix on page 119.
    ---------------------------------------------------------------------------
        Mr. Chairman, I respectfully request that a copy of this
    report and the NCSL policy,\3\ ``Funds in the Fiscal Year 2008
    Budget Resolution for Implementation of the REAL ID,'' be
    submitted for the record with my full testimony.
    ---------------------------------------------------------------------------
        \3\ ``Funds in the Fiscal Year 2008 Budget Resoulution for
    Implementation of the REAL ID,'' submitted by Ms. Van de Putte appears
    in the Appendix on page 63.
    ---------------------------------------------------------------------------
        Senator Akaka. It will be included in the record.
        Ms. Van de Putte. Thank you, Mr. Chairman. NCSL
    acknowledges that the draft regulations incorporate a number of
    our recommendations made in the September 2006 report. However,
    they do not address several major recommendations, or more
    accurately stated, solutions needed for the successful cost-
    effective implementation of the Act. These solutions would
    ensure that the verification systems are available nationally,
    allow States to adopt up to a 10-year progressive re-enrollment
    process, exempt certain populations from the REAL ID process,
    and provide the necessary Federal funds.
        Successful implementation of the Act with such a limited
    time frame largely depends on the availability of certain
    electronic systems to verify the validity of the identification
    documents. It appears that a number of these systems are not
    likely to be available on May 11, 2008, and given this fact, it
    is critical that the May 11 deadline be moved to a future date
    when the verification systems are available on a national
    level. Without this change, the States will spend billions of
    dollars to have a real pretty new card, but will have done
    nothing to actually improve security.
        States need to be able to adopt up to a 10-year progressive
    re-enrollment process. This solution would provide States the
    ability to manage enrollment over a greater length of time,
    would meet the objectives of the Act, reduce the fiscal effect
    on States and, on the Federal Government, and minimize service
    disruptions for customers. Mr. Chairman, in my State alone,
    without the 10-year progressive, reenrollment even hiring 900
    new FTEs, which we would be required to do, and running our 27
    new offices and our offices that are in effect right now 24
    hours a day, we could not re-enroll 11.8 million drivers and ID
    holders. It is impossible to do.
        Certain populations should be exempt from the REAL ID
    process. This exemption could be based on characteristics
    related to applicable risk, such as the year of birth or
    duration of the continuous relationship with the State. For
    example, under our draft regulations, an 82-year-old person who
    has lived in Texas his or her entire life would still have to
    make a visit to his or her local DMV. Is this really necessary?
    The verification requirements should be waived for applicants
    who have completed an identity verification process conducted
    by the Federal Government.
        Finally, I would like to talk about funding. Whether one
    uses the NCSL, NGA, and AAMVA estimate for State implementation
    costs, of at least $11 billion over 5 years or the DHS figure
    of $10 billion to $14 billion over 10 years, the REAL ID is an
    enormous unfunded mandate. For Texas, our start-up costs will
    be $142.6 million for the first year with an ongoing
    operational expense of $67 million. It is critical that new
    Federal funds, and I emphasize new, be provided for State
    implementation of the REAL ID. States should not be required to
    use their diminishing State Homeland Security grants and should
    not be required to pay for access to the verification systems.
        NCSL also recommends instituting a legislative trigger that
    would automatically release States from complying in any fiscal
    year that Congress fails to appropriate these funds.
        Mr. Chairman, in closing, NCSL remains steadfast in its
    resolve to work with Federal policy makers to fix, fund, and
    implement the REAL ID Act before December 31, 2007, as stated
    in our policy, and I encourage you to consider legislative
    action to adopt the solutions I have proposed today. This will
    provide the States with the necessary certainty to move
    forward.
        Thank you very much for this opportunity to testify.
        Senator Akaka. Thank you for your testimony. Mayor
    Hannemann.

    TESTIMONY OF HON. MUFI HANNEMANN,\1\ MAYOR, CITY AND COUNTY OF
      HONOLULU, HAWAII, ACCOMPANIED BY DENNIS KAMIMURA, LICENSING
           ADMINISTRATOR, CITY AND COUNTY OF HONOLULU, HAWAII

        Mr. Hannemann. Good afternoon, Chairman Akaka and Ranking
    Member Senator Voinovich. Thank you very much for this
    opportunity to testify on the impact of REAL ID on the City and
    County of Honolulu, the capital city of the State of Hawaii,
    where three-fourths of our population resides.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Mr. Hannemann appears in the Appendix
    on page 65.
    ---------------------------------------------------------------------------
        I am here, as you indicated earlier, with Dennis Kamimura,
    who has over 30 years' experience of running our licensing
    program, and the City and County of Honolulu licenses 70
    percent of the 867,000 drivers in the State of Hawaii.
    Moreover, all of the State's drivers' computer records are
    stored in Honolulu's computer system.
        We, wholeheartedly, agree that the tragic events of
    September 11 require the strengthening of our security
    standards, procedures, and requirements for the issuance of
    drivers' licenses and identification cards, but we have several
    major concerns with the implementation of this law and they
    basically fall in four areas, Mr. Chairman, with respect to
    funding, the verification process, re-enrollment, and waivers.
        It will cost us $25.55 million over a 5-year period if this
    law were implemented. About 90 percent of this $25.55 million
    will be incurred by the City and County of Honolulu, and
    although the Department of Homeland Security announced that 20
    percent of the States' Homeland Security Grant Program funds
    could be made available during the 2007 grant cycle, most of
    these funds have already been dedicated.
        I would also add that we have recently upgraded the status
    of our Civil Defense Agency now to a full-fledged cabinet-level
    department called the Department of Emergency Management. That
    Department will be charged with securing other types of
    Homeland Security grants into areas that Senator Voinovich had
    already indicated, like interoperability, the pandemic flu, and
    other areas there that we would like that department to focus
    in. So therefore, we would be hard-pressed to tap into this 20
    percent for this particular program.
        With respect to the verification process, the Act requires
    that we refuse to issue a driver's license or identification
    card to a person holding a license or card issued by another
    jurisdiction. This is similar to a provision of the Commercial
    Motor Vehicle Safety Act, which requires commercial drivers to
    have one and only one license at any given time. This
    requirement is supported by CDLIS.
        CDLIS consists of a central site and nodes in each
    jurisdiction. Access to CDLIS is provided through a secure
    private network operated by the American Association of Motor
    Vehicle Administrators and cannot be accessed through the
    public Internet. Each site connected to the private network has
    its access controlled by several security mechanisms. Neither
    the State of Hawaii or AAMVA is aware of any privacy breaches
    of CDLIS since it went into development in 1989.
        In 2005, Congress passed the transportation reauthorization
    bill, SAFETEA-LU, which authorized $28 million to modernize
    CDLIS. Our recommendation is that we leverage this project and
    its Federal funding to expand the scope of the CDLIS
    modernization effort to support an all-driver pointer system
    for non-commercial drivers' licenses and identification cards,
    inasmuch as all jurisdictions are familiar with the CDLIS
    program, and the all-driver pointer system would use the same
    principles as CDLIS. Use of this technology would be more
    efficient than expending public money to create a new system.
        The Act would also require us to have access to five
    additional national databases, SSOLV for Social Security cards,
    Department of State for passport and consular report of birth
    abroads, EVVE for birth and marriage certificates, and SAVE for
    permanent resident status, employment authorization, or U.S.
    certificate of citizenship or naturalization, and SEVIS to
    verify the duration of lawful status for student aliens.
    Obviously, we have challenges with all the aforementioned.
        At present, almost all jurisdictions are using the SSOLV,
    which requires enhancements due to its unreliability. Several
    States are also using SAVE, but that system requires major
    improvements to ensure appropriate functionality to operate in
    real time with accessibility and reliability. Several States
    are testing EVVE. However, the system will not be fully
    operational until December 2009. There is no electronic
    accessibility to SEVIS and/or the Department of State database.
        We should not be required to use systems that are
    unreliable or under development. These systems should be
    developed and tested before placing the burden on local
    jurisdictions and the public that we serve. Additionally, we
    believe that Federal agencies operating these systems should be
    prohibited from charging jurisdictions transaction fees that
    only increase our operating cost.
        With respect to re-enrollment, the majority of our licensed
    drivers in the State of Hawaii are issued State identification
    cards over a 6-year expiration period, so therefore the 5-year
    re-enrollment as called for in the REAL ID Act will present
    some challenges there. We recommend that the period be at least
    7 years.
        Finally, with respect to the waivers, to facilitate the
    processing of all applicants, we recommend that applicants who
    are 72 years old or older be granted waivers from the
    verification requirements of the Act. Similarly, individuals
    who are required to undergo the same or more stringent
    verification process for Federal identification be granted
    waivers. Last, if an applicant has undergone the verification
    process in one jurisdiction and has been issued a REAL ID-
    compliant driver's license or identification card, the
    verification process by the gaining jurisdiction should be
    waived.
        In conclusion, we support the intent of the REAL ID Act,
    but practical considerations aside, Mr. Chairman, the City and
    County of Honolulu cannot afford to implement the requirements
    of the Act without initial and continuing Federal funding. If
    funding is provided, the time limits for implementation of the
    program without the required electronic verification systems
    will place an enormous burden on the driver's licensing staff
    and be a tremendous inconvenience to the public. To ensure
    long-term success, a more realistic implementation plan should
    be developed with input from the jurisdictions who bear the
    burden of issuing drivers' licenses and identification cards.
        Thank you for granting me the opportunity to provide our
    perspective on this issue, Mr. Chairman.
        Senator Akaka. Thank you very much, Mr. Mayor. Mr. Quam.

       TESTIMONY OF DAVID QUAM,\1\ DIRECTOR, FEDERAL RELATIONS,
                     NATIONAL GOVERNORS ASSOCIATION

        Mr. Quam. Chairman Akaka, Senator Voinovich, thank you very
    much for holding this hearing. I note as you did in your
    opening statement this is one of the first real hearings on
    REAL ID and that may be the most important thing that is
    happening today: Congress is taking an honest look at what this
    law means both to the States and the Federal Government, and
    probably more importantly, to our citizens.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Mr. Quam appears in the Appendix on
    page 69.
    ---------------------------------------------------------------------------
        I do not know of a single governor who is not a homeland
    security governor. Every one is very concerned about the
    security and integrity of their driver's license systems. Most
    States after 9/11 were already in the process of improving
    their systems when REAL ID came about. NGA supported the
    negotiated rulemaking process that was put together by this
    Subcommittee in the Intelligence Reform Act. It is both
    unfortunate and ironic to note that if that process had been
    allowed to continue, we probably would be done today.
        While several other folks here have noted some of the
    problems with REAL ID, I am going to focus really on solutions.
    I will note that NGA and governors have not called for the
    repeal of REAL ID. What we have done is try to work--governors
    have tried to work with their States, with motor vehicle
    association administrators, and also with legislators to find a
    fix, and that is going to require three things: More time, more
    flexibility, and additional funds.
        The most important message I can give to this Subcommittee
    and to Congress today is that REAL ID cannot be fixed without
    Congressional action. It cannot be fixed without legislative
    action by Congress.
        First and foremost, provide adequate time. Certainly,
    everyone recognized, including DHS, that May of next year was
    not enough time for States to prepare. NGA recommends that this
    Subcommittee adopt specific statutory deadlines. Alter the
    deadlines of REAL ID and set them to the later of December 31,
    2009, which is the extension granted under the proposed
    regulations, or a date that is 2 years after the publication of
    final regulations, whichever is later. That deadline should be
    set to when States actually know the rules.
        Grant all States a 10-year window in which to re-enroll all
    of their citizens. Moving the deadline on the front end but not
    giving a corresponding extension on the back end only means
    that States have to enroll more people in a shorter amount of
    time. That maximizes cost, minimizes efficiencies, and hinders
    States' ability to implement this Act.
        And finally, what several other witnesses here have cited,
    allow us to manage the line. Certain populations can be pushed
    to the end of the line while we give REAL ID to other folks up
    front. That allows States to keep some of the efficiencies that
    are so important to customer service.
        Second, the verification systems. I thought Secretary Barth
    did an excellent job of stating how critical electronic
    verification is. Without it, REAL ID doesn't work. Until it is
    online, States should not have to comply. It is that simple.
    Congress should amend REAL ID to specifically allow States to
    use existing verification practices until all necessary Federal
    and State systems are fully operational and deployed. The
    States won't hesitate to put them in place, but they can't be
    expected to use them until they are in place.
        Next, encourage State innovation. I was happy to hear that
    the Secretary may be willing to use his waiver authority and
    extension authority if States are making progress towards
    implementing REAL ID. These are extraordinarily complex
    systems. It will take time to build these systems and to
    prepare them and fund them, especially considering some State
    legislatures are going out of session. Budgeting time and
    planning time needs to accommodate State schedules.
        I will note, however, that even with the extensions of
    time, the proposed regulations are going to require all States
    to submit a complete certification package by February 10,
    2008. That is ahead of the original statutory deadline. That
    plan must include milestones, schedules, and estimated
    resources needed to meet all the requirements of the rule. If
    we don't finish this rule until August, September, or October
    of this year, that is a very short turnaround for States to do
    complete planning and go to DHS and say, this is how we are
    going to implement. That deadline should be pushed at least 1
    year by statute past the time of Federal regulations. That is
    adequate time for the States to plan. States aren't asking to
    put it off indefinitely, just give them time to plan.
        Finally, sufficient funding, which it has been discussed
    here repeatedly. It cannot be underscored enough. Congress must
    provide specific authorization of funds to cover the cost of
    REAL ID over the next 10 years. Specifically, it should also
    appropriate at least $1 billion in fiscal year 2008 to fund the
    initial cost.
        One thing I would like to point out, the cost estimates
    that were done by States were very carefully done. Phone calls
    were made to make sure that all States were comparing apples to
    apples, oranges to oranges. Not to contradict the Secretary,
    but I am going to contradict him. That was a very careful study
    and the $11 billion that States came up with is a minimum and a
    hard minimum that it is going to cost States to implement.
        Governors are very concerned with REAL ID. Governors want
    to make it work. If DHS wants to give States the flexibility to
    run with it, then they should give it to us completely. States
    can get the job done, but we are going to need time. Thank you.
        Senator Akaka. Thank you very much.
        I know Senator Voinovich, being a former governor and
    mayor, is very anxious to ask some questions here, so I will
    try to be brief.
        My first question is for the entire panel. If the final
    regulations for the REAL ID Act are issued this fall and remain
    substantially similar to the proposed regulations, when would
    your States or a majority of States and localities
    realistically be able to comply with the Act?
        Ms. Van de Putte. Thank you, Mr. Chairman. Our problem is
    not the wanting to comply, it is that we are going to have
    difficulty complying if the verification systems aren't ready.
    We can't set a date on which we can comply until the Federal
    Government itself has those verification systems operational.
    What we will have is a pretty card with no way to verify a
    person's identity. So I think that we really need to look at
    the budget process and the Federal Government and how much it
    is willing to put into the verification systems because we
    can't comply unless those systems are in place.
        Senator Akaka. Mayor Hannemann.
        Mr. Hannemann. Mr. Chairman, as indicated earlier, counties
    and cities are at the mercy of many of these mandates that come
    from the Congress or the Federal Government or the State. Right
    now, our legislative session is due to end in May. There is no
    vehicle for any type of funding. They recently, as you pointed
    out in your opening statement, issued a resolution basically
    expressing their concerns. We will not be able to comply at all
    for the following reasons that I indicated in my testimony. So
    not only is the funding not there, but even if we had the
    funding, there still are some concerns with respect to the
    verification process, the re-enrollment, and obviously the
    waivers. So it is very unrealistic for us to even figure out a
    way in which to comply given the concerns we continue to have.
        Senator Akaka. Mr. Quam.
        Mr. Quam. Just to echo that, REAL ID cannot be solved by
    any single issue. Money alone will not do it. An extension will
    not do it. It has got to be a comprehensive solution using both
    Congressional power and regulatory power at DHS to give States
    what they need. Until we know that picture, we are basically
    being handed a Monopoly board without instructions and saying,
    go play. You have no idea what the objective of the game is or
    how to play. We need the final rules and then we need the time
    to implement them and understand them to move forward. So
    unfortunately, at this time, it is one of the reasons we say
    REAL ID is unrealistic as planned.
        My other concern, Senator, is that the regulations may not
    look as they currently do. I will give DHS its due. The first
    time we really understood how much DHS had listened to States
    was when the draft regulations came out. I was very pleased to
    hear they had been talking to four States, but there are 50
    States and five territories that are going to be involved in
    this process and it is going to take time for us to move
    forward and understand exactly what is going to be required of
    States.
        Senator Akaka. Thank you. As you know, the regulations do
    not address what someone can do if another State loses or
    mishandles their personal information. Could each of you
    address how different States would handle this situation?
        Mr. Hannemann. Let me defer to Dennis Kamimura, who, as I
    said, he has 30 years of running this operation for our State.
    He is also a very active member of AAMVA. And I just wanted to,
    if I may before I turn it to him, Mr. Chairman, just echo what
    was said earlier. We want to participate. We want to be able to
    give our input, and so far, we have been doing it through
    AAMVA, but we would like to see more of a reaching out process
    on the part of the Department of Homeland Security as opposed
    to cities or counties or States petitioning them for input and
    the like. We think it should be a two-way street. As I said, we
    have been able to do most of our input through AAMVA, but we
    really believe that this is part of our petition here today, is
    to get a little more of a reaching out process from them.
        Senator Akaka. Mr. Kamimura.
        Mr. Kamimura. Mr. Chairman, essentially, the REAL ID Act
    does, in fact, provide for Federal penalties involved in
    misinformation or handling of information or release of data,
    personal data, that is not supposed to go out. Speaking for
    Hawaii, Hawaii does have penalties involved with release of
    personal information and I think what happens is that under the
    REAL ID, we would have to comply with whatever the Federal
    requirements are. But I don't believe that Hawaii would, in
    fact, loosen its requirements on any penalties for stolen
    identity, for example.
        Senator Akaka. Mr. Quam.
        Mr. Quam. What we have heard on the privacy front is a
    great concern for how these databases will be managed, and now
    that we have a better sense with regard to the regulations,
    there is some additional comfort in the States. However, I
    would note that there are several States who have privacy laws
    that are probably stronger than anything that the Federal
    Government would actually impose. One of my fears is that the
    privacy regulations will come out and actually loosen State
    standards with regard to privacy.
        I think addressing privacy may be one of the real critical
    missing links in moving forward. The negotiated rulemaking
    would have addressed that. It would have brought a lot of
    different players to the table. It is unfortunate that was not
    allowed to finish, but I think addressing the different
    standards States have and not lessening those standards will be
    critical moving forward.
        Senator Akaka. Senator Voinovich.
        Senator Voinovich. Thank you, Mr. Chairman.
        This is typical of the Federal Government, REAL ID was put
    into the emergency supplemental bill in 2005, with no hearings
    and no consideration about how it is to be implemented.
    Senator, you are from Texas, as you know first hand, we have a
    problem with the border, an immigration problem. If the
    Congress had given money to Customs and Border Patrol to do the
    job, we wouldn't have the problem today, but we didn't.
    Finally, Congress has recognized the problem and is funding
    CBP. This is typical of what we do here in the Congress.
        I would like your respective organizations, the National
    Council of State Legislatures, the NGA, to get back to this
    Subcommittee on what you are being asked to do with the State
    Homeland Security Grant Programs. I think it is ridiculous that
    they are saying to you, take the money and use up to 20 percent
    of it to offset the costs REAL ID. This money has already been
    spent or allocated by the States to pay for other programs like
    interoperability.
        I would like to get into some specifics about timing. Now,
    how much time after the final rule comes out, assuming that you
    feel that they are decent and proper, would you need to
    implement REAL ID?
        How much time would you think would be reasonable to give
    people in each State the ability to sign up? Much of the cost
    is going to happen during the intial phases of REAL ID as
    States bring people into the program. States are going to have
    to hire many more people to handle the registration. Ms. Van de
    Putte, how many new people did you say Texas would need to
    hire.
        Ms. Van de Putte. Minimally, our statistics say that we
    have to hire 741 new FTEs, but we are reshifting close to 200
    that are already in the department. So we have achieved some
    cost savings in other areas, but new hires will be 741 FTES.
    Senator, that was a very conservative estimate.
        Senator Voinovich. So you are working harder and smarter
    and you shifted 200 people over that were doing something else,
    but you need 700 to get the job done?
        Ms. Van de Putte. Yes, sir.
        Senator Voinovich. Could I get your opinion on these
    milestones and how you would set the deadlines?
        Mr. Quam. Senator, I would be happy to, if I may, and
    starting with final regulations as the key date, and why any of
    the deadlines were not set from there, I am not sure because
    that is the time when States know what is expected of them.
    That is when final regulations actually come out. So let us say
    that is August.
        Senator Voinovich. Why don't we just say that it is
    December 31.
        Mr. Quam. December 31, excellent. DHS has said from a
    regulatory standpoint that it wants--it is going to use a
    certification process, which States are familiar with and
    States actually recommend it. That certification is to present
    the State plan. We would recommend that should be 1 year from
    the date of final regulations, that the State submits a plan.
    That will allow us time to start putting all the different
    pieces in place.
        Senator Voinovich. One year to submit a plan of how you are
    going to comply?
        Mr. Quam. To DHS, correct. We would recommend 2 years from
    the date of final regulations before the first REAL ID has to
    be issued, the shorter of that date or the extension that was
    given under the regulations, which is to the end of 2009,
    whichever is later, and part of that is to defend against this
    regulation dragging on. I will note that we only got it this
    year. We needed this regulation the day the law passed, not 2
    weeks ago.
        Senator Voinovich. So you are talking 3 years actually
    from, say, December 31 of this year? That is 1 year to submit
    it and then 2 years thereafter to----
        Mr. Quam. I am actually talking 2 years from final
    regulations to begin.
        Senator Voinovich. OK.
        Mr. Quam. I think the States could do that and should
    recognize the flexibility DHS has given.
        Senator Voinovich. What about if the verification isn't
    there?
        Mr. Quam. That goes to a different issue, which is what
    does it mean to be compliant, and I think a core question is,
    States can meet that in 2 years if they have the flexibility to
    use whatever is at their means to verify identities. If the
    systems are up, running, deployed, working, and populated--that
    means they have the data in them--then States might be in a
    position to use them. If they don't exist, States have been
    verifying this information for several years using best
    practices. They should be allowed to continue to do that and
    use those verification processes as we transition. That way, 2
    years from now, States could begin issuing REAL IDs. So you
    have to change the definition of what it means to comply, and I
    focus on the verification systems. If they are there, we will
    use them. If they are not, best practices.
        Finally, the end game. When will we finish this process? We
    have called for a 10-year window from that date, from beginning
    to end, to bring everybody in. Allowing the States to manage
    the line so that people can come in, you can use certain
    efficiencies--there are populations, say, born before 1935, or
    folks who have been in the State for 20 years----
        Senator Voinovich. In other words, what you would do as
    part of your application is you would do some kind of a risk
    assessment about how States are going to phase-in people based
    on your experience, like I think you mentioned somebody who is
    83 years old. Give me a break.
        Ms. Van de Putte. If a resident had a driver's license for
    more than 60 years, exempt some sort of population--sorry for
    the interruption, Mr. Quam.
        Mr. Quam. No, please.
        Ms. Van de Putte. But those are the sort of things, Mr.
    Chairman, that we are looking at. But the timing issue--this
    couldn't happen at a worse time because most States will be out
    of legislative session, and several States are biennial
    legislatures, like Texas. And so we will hopefully have left to
    go back to our home cities after Memorial Day, and so there is
    this time lag. So the quicker that we can get these types of
    rules and regulations, we want to do it, we want it done right,
    but our fear is that we are going to have a really pretty card
    that gives people a false sense of security, but if you don't
    have the verification systems, if we are not able to have the
    flexibility, then it is really meaningless.
        And everyone wants to adhere to the goals. I think what you
    have heard from us today is no one doubts the goals and we are
    all in agreement with that. It is the ``how to,'' and we have
    had real problems with the ``how to'' and it is ironic, in
    fact, that had we continued with the negotiated rulemaking, we
    would have probably had this solved by now.
        Senator Voinovich. Thank you.
        Mr. Hannemann. Mr. Chairman, if I just might, just to add a
    few comments there. Normally, I would defer to our governor to
    make a statement on behalf of our State, but in this particular
    case there, as you know, Senator Akaka, in Hawaii, the counties
    issue the State drivers' licenses, not only for the County of
    Honolulu, but for Maui, Kawaii, and the big island. We would
    like as much time as possible. I have heard what our
    representative of NGA said, and even at that, we would really
    be pushing it. So we need as much flexibility and time.
        I heard Senator Voinovich speak about some of the unique
    issues he faces with Canadian visitors that come to his State.
    Well, we are also particularly concerned with many of the
    foreign visitors. As you know, we are a State that is dominated
    by tourism. We depend on foreign visitors. Many of them invest
    in our economy. That would be another major concern, to get as
    much information out that this is all part of national
    security, but at the same time, we want to continue to maintain
    good relations with our international visitors and the like.
        Senator Akaka. Thank you. We will have a second round.
        Senator Van de Putte and Mayor Hannemann, we have all heard
    of the enormous unfunded mandate and the impact this will have
    on the States. Could you both describe exactly how the costs
    will break down in your States or counties to describe what the
    average American will have to do to get a REAL ID driver's
    license under the proposed regulations?
        Ms. Van de Putte. Thank you, Mr. Chairman. Our cost
    estimates were done very conservatively and we were using the
    same methodologies as all the States and the counties in
    Hawaii. Very conservatively, for my State, we have a population
    of about 24 million, about 18.5 million drivers' and
    identification card holders. We would have to, under the
    timeline set by this guideline, fit about 13.8 million in that
    shortened time frame. We just physically can't do it. Our
    implementation total for first-year costs is $142.6 million and
    an annual cost of $67 million.
        But the real problem in our State, as in a lot of other
    jurisdictions, is that we wanted to utilize technology and to
    make it easier for our citizens, particularly those who have
    had drivers' licenses and identification cards for a long time,
    and so we allowed the mechanisms of the Internet for Internet
    renewal and mail renewal, and so, in fact, for efficient
    government, we closed down lots of offices. We utilize
    technology. And we know now that because of these regulations,
    we will have to have about 741 new FTEs, and then we have
    shifted within the department some that would be able to do
    this. But we are going to have to open up 18 new offices and
    retrofit about 28 other new offices.
        Part of our cost that we don't know will be what the
    security requirements are going to be for the physical
    locations. Under the draft rules and regulations, all of those
    physical requirements of security are for States and
    jurisdictions that issue over-the-counter. So, in other words,
    the application is made, all the verification is made, and then
    they receive the identification there. Some jurisdictions and
    States have a central location where they disperse, but
    Department of Homeland Security rules are going to require all
    of us to have every single office, and even in our rural areas,
    you might co-locate in a county clerk's office or in a rural
    community in the township's city offices. And so we have a lot
    of this sharing. We will not be able to service our rural
    citizens because of the security costs that have been mandated
    by the Department of Homeland Security for the integrity of the
    building itself.
        So our costs break out to the majority of FTE. The other
    ones are the software and the verification. But many States
    were going along that pathway anyway. We were putting in
    millions of dollars for enhancing our security. But I think
    that what we see is the cost, and with all due respect to our
    folks at Homeland Security, when we know it is going to be $11
    billion, to offer $40 million was almost an insult. And then
    their action to us when we asked them about the funds is that,
    oh, it is not our job. Our job is to put out the rules and
    regulations and that is Congress's job. So in other words, what
    they are telling you is that they are telling us to come talk
    to you about the funds. It doesn't make sense that they are
    asking us, the Department is asking States and jurisdictions to
    try to put the heat on Congress to fund it. Their answer is, it
    is not our job.
        Senator Akaka. Thank you. Mayor Hannemann.
        Mr. Hannemann. Yes. We give out about 867,000 drivers'
    licenses, of which 70 percent of that is issued out of the City
    and County of Honolulu. We estimated that of the $25.55
    million, and once again, it is just a very rough estimate given
    what we know at this time, to implement the program in the
    first year will be $7.67 million. Over a 5-year period, it
    would be $17.88 million.
        Mr. Kamimura runs his department with about 85 employees
    just to do drivers' licenses. Obviously, we are going to have
    to ramp that up. Our satellite city halls and various
    distribution points throughout the City and County of Honolulu
    will be challenged enormously. I think we will be facing
    everything from challenges to over-the-counter type of
    application processes to the long lines that everyone will
    experience. But I would expect that this number could increase
    as we know more about the challenges that we face and the
    opportunity that we have to leverage what the other programs
    are.
        In fact, I talked about some of the databases that we need
    to access, the systems that need to be set up, and I know that
    my Director of the Department of Information Technology, Gordon
    Bruce, who works very closely with Mr. Kamimura's department on
    this whole aspect of making sure that we are spending more time
    online than waiting in line, he has expressed several major
    concerns about the REAL ID.
        So these are just initial costs. It is obviously going to
    be very complicated, and therefore, if we are going to go
    forward, again, I hate to sound like a Johnny one-note, but we
    are going to need enormous Federal help, especially in the area
    of funding, to be able to even get to first base on this issue.
        Senator Akaka. Thank you very much. Senator Voinovich.
        Senator Voinovich. Let us talk about Texas again so that
    everyone understands how difficult this is and how expensive it
    will be. First of all, you are going to have to get 700 more
    FTEs.
        Ms. Van de Putte. That is correct.
        Senator Voinovich. Then you are going to have to open up 18
    new offices. Finally you will have to comply with new databases
    in order to verify the individuals.
        So the real issue is how do we help you get the job done? I
    would be interested in your response to some kind of
    partnership. What if we paid for the initial, cost all of the
    software and other things that you would need to do to
    implement this?
        Ms. Van de Putte. Yes, sir. The cost estimates that I have
    are based on the verification of documents using those five
    different systems that were talked about. It is an
    implementation cost of $3.4 million and an annual cost of $1.5
    million. And so I would imagine that is probably about $5
    million when our overall costs to implement are $210 million.
    So I guess if you take a percentage of that, that is just the
    verification of documents.
        I think that what is a bigger cost for us is the minimum
    document requirements itself. The implementation cost of that,
    again, $15 million for my State with an annual cost of almost
    $17 million, and that is requirements for the document itself.
    So those two put together might be something that would be
    workable for us.
        But I think that each State is going to be different. There
    are some states that did not utilize technology in the 1990s,
    and particularly the late 1990s, and so they may have lots of
    physical spaces and offices out there and may not have done as
    some of our states that tried to be more efficient.
        Senator Voinovich. Could you do me a favor? I would like,
    and Mr. Chairman, I think that the Subcommittee would agree, I
    would like the NCSL and NGA to give me the details of the
    costs. I can tell you that there is no way that the Federal
    Government is going to pay for all of this. But I think if you
    came back with a proposal with some kind of partnership it
    would be easier for this Subcommittee to develop some kind of
    funding program for REAL ID.
        Senator Akaka. Mayor Hannemann.
        Mr. Hannemann. Mr. Chairman and Senator Voinovich, I think
    that is an excellent idea, this idea of a partnership that you
    are talking about. We would wholeheartedly also recommend the
    American Association of Motor Vehicles Association that we work
    very closely with to tweak some of the numbers and so forth.
        My concern is always not only the implementation, but the
    ongoing maintenance costs, so we obviously would be very
    willing to participate in that, so we could----
        Senator Voinovich. Mr. Chairman, one other thing, and I am
    sure this is how OMB works, they figure like even sewer and the
    water and the rest of it. Let them raise their rates locally
    and pay for it.
        Mr. Hannemann. Absolutely. I have risen my sewer rates
    twice. [Laughter.]
        Senator Voinovich. You are talking about annual cost. How
    much more will you have to charge for the new ID? I would like
    to get some idea of what those annual costs would be.
        Mr. Quam. Senator, if I may, a couple of things that are in
    the cost impact study that was done by NGA, AAMVA, and NCSL. I
    am very happy to report when the negotiated rulemaking ended,
    the three groups came together as the key stakeholders and
    basically said, we have to continue this good work. We have to
    make sure that our voice is heard in this context. And so we
    have worked very cooperatively together and it has been an
    excellent partnership and we would love to extend it to the
    Federal Government and Congress.
        I will note in that report that $1 billion, the $1 billion
    I mentioned for an appropriation up front, is one-time cost.
    That was actually estimated by the States, one time, get the
    systems, buy them, man them, get the software, get everything
    up and running, one-time cost was $1 billion. The ongoing cost,
    then, over 5 years, you get to $11 billion over five years.
        You made a very excellent point and one that is often
    missed. It is not stated in the regulations, but it should be
    plain to everybody. The Department of Homeland Security sees
    this as a fee-based system. In other words, we are going to
    pass the cost along to folks getting a driver's license or
    identification card.
        Senator Voinovich. And by the way, they will raise thunder
    with you----
        Mr. Quam. Absolutely.
        Senator Voinovich [continuing]. And the Members of Congress
    will walk away and say, we didn't do it. [Laughter.]
        Mr. Quam. That is exactly right. The number we use is the
    $11 billion over 5 years divided by 245 million driver's
    license holders, because we have to bring everybody back in in
    5 years. That is pretty easy math. That is about $45 additional
    per card.
        Now, I am a Maryland resident. It costs me $30 to renew. An
    additional $45 on top of that for my REAL ID. I need to get a
    new certified copy of my birth certificate. I went online today
    to see what that would cost me. That is another $43 that it is
    going to cost me to get Colorado to send me a certified birth
    certificate. And just to be safe, so I can get on the airplane
    in the meantime, if I want a passport, well, the passport fee
    is $96 and you have got to wait 10 weeks to get it. If you want
    to expedite that, tack on another $60. You add that list up and
    you are at $274.
        Now, our citizens personally want to be secure and will
    stand in long lines to be secure, but if we don't really add
    value to this card as we move forward and do it in a
    responsible way, their resolve is going to end at some point,
    and you are absolutely right--their patience will run out and
    it will run out with local officials first and then with
    Congress.
        Senator Voinovich. One last point and then I will finish
    up. I get weekly reports from my constituency office. The
    passport offices are being overwhelmed today because of WHTI.
    It is unbelievable, the demand for passports. The passport
    offices don't have the people to take care of their customers.
        Senator Akaka. I want to thank this panel very much. You
    have been very helpful and I want to thank you for being here
    and for your responses. I also want to extend my appreciation
    to those of you who traveled from out of town to be here today
    and I hope you have a safe trip back home.
        Ms. Van de Putte. Thank you, Mr. Chairman, and thank you
    very much for having us here. I did want to note with Senator
    Voinovich's comments that part of our cost estimate is for new
    signage. In the Texas statute, we will have signage at each of
    the new offices that say that this is a Federal law that the
    State did not pass nor did the State fund and it will have the
    addresses and phone numbers of our two Senators and the local
    Member of Congress. [Laughter.]
        Senator Akaka. Thank you very much.
        Ms. Van de Putte. Thank you, Mr. Chairman.
        Senator Akaka. I now call the third panel to come forward.
        On our third panel we have Timothy Sparapani, Legislative
    Counsel for Privacy Rights at the American Civil Liberties
    Union, and Jim Harper, Director of Information Policy Studies
    at the Cato Institute.
        As you know, it is the custom of this Subcommittee to swear
    in all witnesses. I would ask for you to stand and raise your
    right hand.
        Do you solemnly swear that the testimony you are about to
    give this Subcommittee is the truth, the whole truth, and
    nothing but the truth, so help you, God?
        Mr. Sparapani. I do.
        Mr. Harper. I do.
        Senator Akaka. Thank you very much. Let the record note
    that the witnesses answered in the affirmative.
        Mr. Sparapani please proceed with your statement.

      TESTIMONY OF TIMOTHY D. SPARAPANI,\1\ LEGISLATIVE COUNSEL,
                     AMERICAN CIVIL LIBERTIES UNION

        Mr. Sparapani. Thank you, Mr. Chairman. On behalf of the
    ACLU and its half-million members, we recommend that this
    Subcommittee mark up your legislation, S. 717, the
    Identification Security Enhancement Act, to replace Title II of
    the unworkable REAL ID Act. Because Senators never considered
    REAL ID on its merits, they should be free to vote to replace
    it with a licensing scheme that is both achievable and free of
    privacy and civil liberties concerns.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Mr. Sparapani appears in the Appendix
    on page 74.
    ---------------------------------------------------------------------------
        As you can see from the map, the REAL ID rebellion is
    sweeping the country. As of today, 30 States are moving to
    reject REAL ID and calling for Congress to replace it. Maine
    and Idaho have enacted legislation to completely opt out.
    Driven equally by the extraordinary threat the Act poses to
    privacy and civil liberties and its prohibitively expensive
    cost, States are telling Congress that no matter the
    consequences, they will not participate. Drivers and DMV
    officials are telling Senators to expect lines at every DMV,
    not just out the door, but around the block, every day.
    Congress must respond to this outcry, and I believe your
    legislation does that.
        Therefore, the ACLU recommends three things. One, Congress
    should replace Title II of the REAL ID Act by enacting S. 717,
    which reestablishes a more workable process for improving
    drivers' licenses.
        Two, members should submit comments calling on DHS to
    withdraw its Notice of Proposed Rulemaking.
        Three, Congress should refrain from appropriating any funds
    to implement the REAL ID Act. Quite simply, there is no point
    in throwing good money after bad.
        Because time is short, I will just mention that REAL ID
    raises intractable constitutional problems. It threatens First
    Amendment rights and arguably violates the constitutional
    principles of federalism by usurping State authority.
        Make no mistake, REAL ID will be the national ID card.
    Since the Act's passage, legislators have proposed requiring
    everyone present a REAL ID to vote, get a job, obtain Medicaid,
    open a bank account, and travel on interstate busses, trains,
    and planes. In short, no person would be able to function in
    our society without providing a REAL ID.
        Additionally, REAL ID and DHS regulations pose
    unprecedented threats to privacy in four areas. Those four are
    data on the face of the ID card, data in the machine-readable
    zone on the card's back, data in the interlinked national ID
    database supporting the cards.
        And four, regarding transmissions of data between users. I
    will just mention a few of these privacy problems.
        First, data on the face of the ID card. REAL ID wipes out
    in States what are called address confidentiality laws by
    requiring that an individual's principal address be stated on
    the face of the license versus having a post office box.
    Consequently, police officers, elected officials, judges, and
    others will have their home address readily available to anyone
    who would want to see it. More importantly, an actual address
    endangers people like victims of domestic violence and sexual
    assault who are trying to flee their abusers.
        Unencrypted data in the machine-readable zone creates an
    enormous threat, a new threat, Senator, of private sector
    third-party skimming of data and resale of data contained in
    that machine-readable zone. DHS's proposed regulations failed
    to close the loophole because they do not require encryption.
        Contrary to DHS's assertions, it will become increasingly
    profitable for private sector retailers to skim each customer's
    data because the format of data collected will be standardized
    nationwide. This creates a huge new threat. Retailers will
    demand that customers provide these licenses for anti-fraud or
    customer loyalty purposes and then they are going to retain all
    the data. And then, of course, these companies can then resell
    it in two different ways. One, they can sell it for highly
    targeted and highly invasive direct marketing back to the
    people, or two, they can sell it to what we call data brokers,
    companies like ChoicePoint or Axciom or Lexis-Nexis, who in
    turn can sell it to other companies and to the Federal, State,
    and local governments. In short, Senator, everyone is going to
    know in the future what we bought and when we bought it,
    including books, magazines, medications, contraception,
    anything you can imagine. So, essentially, we have got some
    significant problems there.
        There are also problems with data in the National ID
    Database. And again, contrary to DHS's assertions, this
    unprecedented data aggregation imposed by REAL ID will actually
    make America, I believe, more vulnerable to terrorism and
    crime, not less vulnerable, and that is because we are going to
    have, I think, massive identity theft and fraud. That is
    because the Act is going to require that, at a minimum, a huge
    new set of data along with biometric information and these
    documents, the source documents you have heard about, be
    aggregated in one place. And then, of course, we are going to
    make this data set available to hundreds of thousands if not
    millions of Federal, State, and local employees.
        In addition, the identity theft and document fraud are
    going to be far more serious. Instead of obtaining just one
    password, an ID thief is going to have a treasure trove of
    data, and that is because DHS failed to build in basic computer
    security and safeguards.
        I will mention one final data privacy problem, and that is
    that the REAL ID database, I believe, is going to lead to
    significant new data mining, and that is because, again, DHS
    refuses to prohibit data mining of this data set, not only by
    itself, but by any other Federal, State, or local agency. And
    prior to REAL ID, it was impractical to do this data mining.
    But when you aggregate and link the data sets, sir, you are
    going to end up with the easy kind of data mining that I think
    many of us would want to avoid.
        So in closing, I just want to say, Senator, for this
    Subcommittee, it is your first opportunity to stop these
    abusive intrusions into America's privacy by DHS, and again, we
    would like to call on Congress to replace Title II of the REAL
    ID Act with an achievable licensing plan that does not threaten
    personal privacy or civil liberties.
        Thank you, Senator.
        Senator Akaka. Thank you very much. Mr. Harper.

       TESTIMONY OF JIM HARPER,\1\ DIRECTOR, INFORMATION POLICY
                      STUDIES, THE CATO INSTITUTE

        Mr. Harper. Thank you, Chairman Akaka. Thank you for
    inviting me to be here today, and congratulations to you on
    your leadership on this issue, along with Senator Sununu,
    introducing legislation to repeal REAL ID and restore the
    identity provisions in the Intelligence Reform Act that
    preceded it.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Mr. Harper with attachments appears
    in the Appendix on page 89.
    ---------------------------------------------------------------------------
        I am Director of Information Policy Studies at the Cato
    Institute, which is a research foundation dedicated to
    preserving limited government, individual liberty, free
    markets, and peace. I also serve as an advisor to the
    Department of Homeland Security through the Data Privacy and
    Integrity Advisory Committee, which advises the Privacy Office
    and the Secretary of Homeland Security on privacy issues.
    Today, I speak only for myself, not for the committee or for my
    Institute.
        I have written a book on identification and identity issues
    that includes REAL ID. It is called, ``Identity Crisis: How
    Identification is Overused and Misunderstood,'' so I think I am
    well-studied on this issue and hope to share some of my
    knowledge with you today.
        I am going to be a little bit plainspoken at the outset
    here. We have done a lot of green-eyeshade stuff on previous
    panels about where the dollars come from and where they go. But
    I think the best conclusion is that the REAL ID Act is a dead
    letter and all that remains is for Congress to declare it so.
        Let me make three points and then offer one recommendation,
    if I can, regarding your legislation.
        First, on privacy, I think Tim Sparapani and the ACLU have
    done a great job of articulating the privacy concerns and I
    join them in their concerns. The Department of Homeland
    Security's regulation punted on some of REAL ID's most
    important technology, security, and privacy problems.
        I want to emphasize briefly why concerns with the card are
    so substantial. Economists know that standards create
    efficiencies and economies of scale. When railroads in the
    United States moved to a single track width, much more
    transportation occurred on the railroads because there was a
    single standard.
        I realize that is not a good example to use with a Senator
    from Hawaii, but understand that standards, a national standard
    in an ID card, means that ID cards will be used a lot more. You
    will have economies of scale in building the card readers, in
    the software and the databases to capture and use the
    information from the cards. Americans will inevitably be asked
    more and more often to produce their REAL ID and share the data
    from it when they engage in every kind of governmental and
    business transaction.
        Others will use the information collected in State
    databases and harvested from REAL ID cards. Ann Collins, who is
    the Registrar of Motor Vehicles in the State of Massachusetts,
    spoke to the DHS Privacy Committee last week and she said, ``if
    you build it, they will come.'' What she meant is that masses
    of personal information will be an irresistible attraction to
    the Department of Homeland Security and to others to dip into
    for an endless array of different purposes.
        For good or bad, an ID card system is a sort of
    surveillance system and it is becoming increasingly clear that
    REAL ID is a surveillance system focused on the law-abiding as
    much as the wrong-doer.
        I want to briefly talk about national security issues,
    because the privacy and dollar costs of REAL ID would be worth
    it if REAL ID got us any measure of security. If it improved
    the protections we have now, I think we would all be in favor
    of REAL ID, but it doesn't. You have heard the cost figures, so
    I won't belabor them.
        I was very concerned about the lack of risk management-
    oriented discussion I heard even today from Assistant Secretary
    Barth. Creating a national identification scheme does not just
    attach a known accurate identity to everyone in the country. It
    causes the wrongdoers to change their behavior. Sometimes this
    will control risk. Sometimes this shifts the risk from one
    place to another. And other times it can create even greater
    risks.
        I want to give you an illustration about how a system like
    this works from a report that was released just last week in
    the United Kingdom. The U.K. home secretary's office released a
    report saying that about .5 percent of all U.K. passports are
    based on fraud. That means about 10,000 per year are issued
    based on fraud. Now, what kind of security do you get from that
    system, if you have a .5 percent fraudulent error rate? That is
    not a security system for purposes of national security. That
    is not a security system against committed terrorists. Perhaps
    the U.K. should have a national ID so we in America don't have
    to.
        In my written testimony, I have submitted a better cost-
    benefit estimate than DHS did, and I am disappointed that they
    did not--they have not done better risk analysis up to this
    point. But all the money that goes into REAL ID is, as Senator
    Voinovich emphasized, coming away from other programs that are
    just as important.
        Finally and briefly, I want to emphasize an issue that I
    think is very important that has not been considered yet, one
    that I realized was quite prominent when I went through the
    regulations and the specifications in the regulations. The
    specifications called for by DHS to go on REAL ID-compliant
    cards has race and ethnicity as one of its key data elements.
    DHS does not specifically require inclusion of this
    information, but States are likely to adopt the entire standard
    when they do get in compliance. Thus, in May 2008, many
    Americans may start carrying nationally uniform cards that
    include race or ethnicity in machine-readable formats. This
    will be available for scanning and collection by anyone with a
    bar code reader. Government agencies and corporations alike may
    affiliate racial and ethnic data more closely than ever before
    with information about our travels through the economy and
    society.
        On this poster, I have reproduced the design
    specifications, which indicate race and ethnicity, and here is
    how they would be indicated on a card. This is an example of
    what a card may look like, the two-D bar code. And I have
    included here, because this is such an important issue, an ID
    card from Rwanda.\1\ In Rwanda, a national identification
    system that included ethnicity was very useful in the
    unfortunate, horrible genocide that occurred there. I do not
    believe that this was intentional on the part of DHS or anyone
    in Congress to have this kind of system. It is a product of
    error and it is a product of this system and REAL ID not being
    carefully considered in Congress before the law was passed.
    ---------------------------------------------------------------------------
        \1\ The ID card from Rwanda appears in the Appendix on page 107.
    ---------------------------------------------------------------------------
        With that, I have taken up quite a bit of your time. I have
    recommendations in my written testimony that I would refer you
    to. Thank you very much for hearing me out and taking my
    testimony.
        Senator Akaka. Thank you very much for your testimony.
        Both of you have discussed how the REAL ID Act infringes on
    Americans' privacy rights and civil liberties and have spoken
    in support of my legislation which would repeal REAL ID and
    replace it with the negotiated rulemaking process in the
    Intelligence Reform Act. Other than a straight repeal and
    replace, are there any changes that can be made to the REAL ID
    Act that would specifically address the concerns you both
    raised today? Mr. Sparapani.
        Mr. Sparapani. Yes, Senator, I think there are a couple
    that could be made. I mentioned one, or at least alluded to it
    in my testimony. I am really quite concerned, and the whole
    privacy world is concerned about this new threat about third-
    party skimming of data off the back of the card. Congress
    really needs to do what it did in part back in 1994 when it
    passed the Drivers' Privacy Protection Act in closing down
    privacy loopholes involving this important data. Congress
    should specifically prohibit the resale of that data, or the
    sharing of data with an additional third party beyond the party
    that is collecting it.
        Additionally, I would just like to say on the
    constitutional standpoint, there are some intractable
    constitutional problems and I think you would have to rewrite
    large portions of the Act to get to that point and I think your
    legislation understands that. But clearly, we have got some
    First Amendment concerns here that won't be addressed unless
    there is a specific statutory exception created for some of
    those well-respected Supreme Court-protected rights.
        Senator Akaka. Mr. Harper.
        Mr. Harper. I don't believe that REAL ID can be fixed. I
    don't believe it can be improved and made to work. The Chairman
    of the full Committee, Senator Lieberman, said when REAL ID
    passed that the law was unworkable. It remains unworkable today
    and the proof of it is borne out on the earlier panels.
        I don't think that a national ID system of any stripe or
    character can provide the security that a lot of people assume
    it does. So it is important to have a conversation about this,
    to learn how ID actually works, how it breaks, what it is
    useful for, and what it is not useful for.
        In my written testimony, I have suggested considering some
    of the emerging digital identity management systems that are
    coming online. There are systems that exist today that can
    prove, for example, to the TSA that you are a member of the
    Registered Traveler Program but that don't tell the TSA who you
    are, and that is an important, narrow anti-surveillance
    feature. Prove to the TSA that you have been secured by their
    processes, but don't give them the opportunity to record where
    you have been and where you have gone and that kind of thing.
        These systems are coming online now. They are a little bit
    future-oriented. We should look down the horizon to these
    systems. But the last thing we want to do is build a government
    system, spend these millions and even maybe billions of dollars
    to build these government systems that ultimately are dead
    ends, very expensive dead ends. We need to integrate with the
    systems of the future, and so I think the whole thing needs to
    be reconsidered and this hearing is a good start.
        Senator Akaka. Mr. Harper, in your testimony, you mentioned
    how by creating REAL ID the Federal Government and the private
    sector will find creative uses for the data outside of the
    reason for which REAL ID was intended. Can you discuss some of
    these other ways the information on a REAL ID card or in a REAL
    ID database can be used?
        Mr. Harper. Well, it is interesting to travel in homeland
    security circles sometimes because you hear lots of talk about
    different plans that people have for REAL ID once it is in
    place. Let us do this with it. Let us do that with it. Frankly,
    the Department of Homeland Security itself has retreated
    somewhat from the idea that this provides security benefits.
    Secretary Stuart Baker came and spoke to the DHS Privacy
    Committee and suggested how strongly it would prevent against
    identity fraud. I proceeded to go to the regulatory docket and
    found that the estimate there is that it would prevent $1.6
    billion worth of fraud. That is a $17 billion cost to save $1.6
    billion. It doesn't quite balance out.
        But other proposals, we would use this to prevent underage
    drinking. We would use it to prevent underage smoking and that
    kind of thing. A terrific regulatory system, a terrific police
    state system for controlling all of our personal behavior. But
    that is inconsistent with the way we are supposed to live in
    the United States. It is inconsistent with having a free
    country. We do indulge a little unlawfulness along the margins,
    and many people who went to college understand that in terms of
    ID. When you are 20 years old, you really want to hang around
    with your 21-year-old friends. Do we want to make a $50,000 or
    $100,000 penalty come down on that kind of person? I think that
    is going the wrong direction.
        So there are lots of different ways to regulate and control
    the generally law-abiding populace and REAL ID would help with
    that, but I don't think that is what we want to do.
        Senator Akaka. Mr. Sparapani and Mr. Harper, as you know,
    the proposed regulations leave open the question of how States
    are to share drivers' information with each other. However, DHS
    repeatedly claims that the system will resemble the Commercial
    Drivers' License Information System. What is your opinion of
    CDLIS and the privacy protection that is in place? Mr.
    Sparapani.
        Mr. Sparapani. It is a good question, Senator. If you
    listen to Mr. Barth's statement earlier today, and in your
    question and answer period with him afterwards, I think he went
    at great length to talk to you about interconnectivity between
    systems of systems and networks. I think we are talking about a
    maximal sharing of data, not a minimal sharing of data. And so,
    in fact, I am really quite concerned about the volume. I mean,
    he showed the chart with all of the systems that would come
    online and that they would all need to talk to each other.
        This isn't going to look like CDLIS. This is going to look
    like CDLIS on steroids, if you will. So we are really talking
    about a plussed-up maximum sharing of all of our most sensitive
    personally identifiable information, and that is exactly the
    information that we don't want to have get in the hands of
    terrorists, immigrant smugglers, sophisticated criminals, and
    it will be easy and ripe for the taking and we will put it all
    in one place and then we will transmit it widely for anyone to
    intercept. I think it is the worst choice we could have made.
        Mr. Harper. Allow me to speak about CDLIS in terms of data
    security. Security turns out to be not a function of what you
    do to protect a thing, it turns out to be a function of how
    motivated your attacker is. I have got a shoebox at home that
    has never been breached. It has never been the subject of a
    breach. If I put information in there, a business card, no one
    would ever look at it. If I started to store bars of gold in
    that shoebox, it would be much more likely that that system
    would be breached.
        So if you take the CDLIS model and expand it out to records
    about politicians, law enforcement officials, Paris Hilton, if
    you make that system the security that terrorists want to
    break, well, that is a much more attractive system and it is
    much more likely to fail than the CDLIS of the past, which has
    information about 13 million truck drivers.
        Senator Akaka. I have another question for both of you.
    Although the REAL ID Act replaced the negotiated rulemaking
    under the Intelligence Reform and Terrorism Prevention Act of
    2004, I understand that DHS has been working with the privacy
    community to protect personal information. Can you tell me how
    you have been working with DHS and what recommendations you
    made to the Department that you see reflected in the proposed
    regulations?
        Mr. Harper. Well, Tim Sparapani was good enough to convene
    a couple of meetings with the regulators, and they were good to
    hear from us. It was welcome to have that input. So there is no
    fault in terms of the process or the people at DHS.
        I recommended that these databases, which are created
    subject to Federal law for Federal purposes, basically using a
    Federal mandate, should also be subjected to Federal laws like
    the Privacy Act. Condition compliance with REAL ID for States.
    Condition their certification of compliance on the fact that
    they have met Privacy Act standards. Condition that compliance
    on the fact that they have met FISMA, the information security
    law.
        DHS chose not to do that, citing federalism concerns that I
    think are a little stretched. Given the fact that the REAL ID
    Act was designed to eviscerate the distinction between the
    State and Federal Governments, and I think that is
    inappropriate, being especially carefully and following
    Marquise of Queensbury Rules when it comes to privacy and data
    security is a little bit off.
        Senator Akaka. Thank you.
        Mr. Sparapani. Senator, if I could respond very briefly,
    indeed, we were invited in to come and meet with DHS, but what
    I have heard over and over again over the last 2 years, and it
    is a remarkably long period of time, is something that is
    baffling to me. Here is the justification DHS is using for
    having a minimal approach to privacy in these regulations. They
    say that because the word ``privacy'' does not appear in the
    statute, they don't feel that they have sufficient authority to
    grant maximal protection to this information that we know,
    frankly, is more valuable than the gold in your bank account
    because it can be used for all sorts of other purposes besides
    just financial fraud.
        So with respect to the DHS Office, they have been good
    about meeting with us, but they have turned a deaf ear to the
    fact that in the information age, personal information is more
    valuable than gold and has to be protected at a much higher
    standard. We have to treat this like a bank vault.
        Senator Akaka. Thank you for that. Mr. Sparapani, you
    mentioned several constitutional concerns with the REAL ID Act
    in your testimony. Would you please elaborate on those issues?
        Mr. Sparapani. Senator, they are really unprecedented, as I
    said, and as my written statement elaborates on. I see at least
    four different First Amendment concerns, a Second Amendment
    concern, a derivative Sixth Amendment concern, and probably a
    Tenth Amendment concern, as well as significant due process
    concerns. Let me just touch on one of the due process concerns
    very briefly.
        If the government begins to demand that people produce a
    REAL ID-compliant driver's license to get all sorts of
    benefits, to enter a Social Security office, etc., many people
    in our society, lawful, law-abiding Americans, won't be able to
    produce the documents they need to get a REAL ID. And then when
    they need to get certain benefits, whether they be Medicaid or
    Social Security disability, etc., they won't even be able to
    get into the room to meet with the government officials to
    obtain those benefits.
        Similarly, if we begin to say that people who don't have a
    REAL ID license can't enter certain Federal buildings, they
    will not be able to exercise, I think, their First Amendment-
    protected right to petition their government for redress. Now,
    in Washington, everybody knows nothing is more important than
    having a face-to-face meeting with your elected official so you
    can actually ask to have your concerns addressed. Again, when
    ID becomes a barrier to people exercising their
    constitutionally-protected rights, we have extraordinary
    problems.
        I think it is these kind of constitutional weaknesses in
    the law which are going to require a complete rewriting of
    certain sections of the Act. I think that is why S. 717, the
    bill that you have introduced, is really the appropriate
    direction to head.
        Senator Akaka. I want to thank you both so much for your
    responses. This has been a very interesting hearing and your
    testimony will help the Subcommittee with our work.
        Several of the problems with the regulations that have been
    identified are the direct result of the strict statutory
    language of the REAL ID Act. Based on our discussion today, it
    is evident that, at a minimum, Federal funding is needed to
    help State Governments enhance the security of drivers'
    licenses and legislative action is required to ensure that
    Americans' privacy and civil liberties are protected. I look
    forward to working with my colleagues and stakeholders to
    address these vital issues and look forward to working with
    you, also.
        The hearing record will be open for 1 week for additional
    statements or questions from other Members.
        Again, this has been an excellent hearing. This hearing is
    adjourned.
        [Whereupon, at 5:05 p.m., the Subcommittee was adjourned.]
                                A P P E N D I X

                                  ----------

                    PREPARED STATEMENT OF SENATOR LIEBERMAN
        I want to thank Chairman Akaka for convening this hearing today
    which will provide the Committee an opportunity to finally shine much
    needed light on the REAL ID Act of 2005 by reviewing the rules that
    have been proposed for this program in an open forum.
        Earlier this month, the Department of Homeland Security (DHS)
    issued a Notice of Proposed Rulemaking (NPRM) implementing the REAL ID
    Act. The NPRM, which took the Department almost 2 years to issue, does
    little to alleviate the concerns that I, and many of my colleagues,
    expressed 2 years ago when the REAL ID Act was attached to an emergency
    spending bill and forced through Congress without debate or substantive
    consideration.
        The proposed regulations will cost approximately $23 billion
    according to the Office of Management and Budget, will bring Department
    of Motor Vehicle offices across the United States to a stand still, and
    may actually jeopardize security. We should not cause undue burden to
    the American public if security can be achieved in a more sensible way.
        I remain fully committed to increasing the security of drivers'
    licenses and identification cards, which should be a top priority for
    this country. However, I am concerned, as I was 2 years ago, that the
    REAL ID Act impedes rather than facilitates the achievement of that
    goal.
        In 2004, Congress passed the Intelligence Reform and Terrorism
    Prevention Act to implement the recommendations of the 9/11 Commission.
    Senators McCain, Collins and I worked together closely to produce
    reasonable, bi-partisan solutions based on the Commissioners'
    recommendations. One recommendation required the Federal Government to
    set national standards for the issuance of drivers' licenses and
    identification cards. This was based on the Commission's finding that
    many of the 9/11 hijackers obtained U.S. identification documents, some
    by fraud. We took this recommendation seriously and carefully crafted
    provisions--with input from both sides of the aisle and all interested
    constituencies--to increase the security and reliability of drivers'
    licenses and identification cards. Our provisions were endorsed by
    state and local governments, the Administration, and a range of
    immigration, privacy, and civil liberties advocacy groups.
        Regrettably, the REAL ID Act repealed those balanced provisions and
    replaced them with an unworkable, burdensome mandate. I opposed the
    REAL ID Act because I believed it imposed such unrealistic requirements
    that without substantial time and resources, it would not be
    implemented, making the Nation less safe as a result. If the original
    Intelligence Reform Act provisions had not been repealed, States would
    be well on their way to securing drivers' licenses today. Instead, DHS
    was saddled with implementing such a controversial and complex law that
    the Department took 2 years to issue regulations.
        After reviewing the NPRM, I remain concerned about REAL ID
    implementation because it does not appear that DHS has addressed many
    of the problems and concerns identified 2 years ago.
        First, the REAL ID Act requires States to verify all documents used
    to obtain a REAL ID, such as a birth certificate. To do so, States must
    rely on a series of electronic systems and federal databases. Yet some
    of these databases don't exist or are incomplete. Others are known to
    contain inaccurate data. One of the most egregious examples is the
    Electronic Verification of Vital Events (EVVE) system, which was
    developed by the National Association for Public Health Statistics and
    Information Systems (NAPHSIS) to provide a single interface for
    verification of birth and death records. EVVE is currently in pilot
    form, and only seven States have access. Even if all fifty States had
    access to the EVVE system, it would not allow for credible electronic
    verification of birth and death records because the database will not
    contain records from all the States. NAPHSIS issued a report in January
    2006 stating that the EVVE system could take as long as 7 years to be
    fully operational. The report specifically noted that the system must
    be implemented nationwide before it will be beneficial for REAL ID. A
    valid, verified birth certificate is at the heart of REAL ID, yet the
    timelines for these two programs are completely incompatible.
        In addition to the EVVE system, REAL ID relies upon a non-existent
    State Department system to verify U.S. passports and the DHS Systemic
    Alienation Verification for Entitlements (SAVE) system, which is
    notorious for containing erroneous, incomplete, or outdated
    information. Moreover, even though the success of REAL ID depends on
    these systems, there is no requirement in the REAL ID Act or in the
    NPRM that the federal agencies provide these systems in a timely or
    accurate manner. The States will be left holding the bag if the Federal
    Government fails to deliver.
        I am also troubled by the incomplete nature of the proposed
    regulations. There is virtually no guidance in the NPRM regarding what
    type of electronic system will be used to share information between
    States. This detail is critical to understanding the security and
    privacy vulnerabilities that may be created by REAL ID. Assistant
    Secretary Barth has said that the Department of Transportation's
    Commercial Driver's License Information System (CDLIS) will likely be
    the model used for REAL ID. CDLIS allows information on licensed
    commercial drivers to be shared between States on a limited basis--
    commonly referred to as a ``pointer system.'' However, the NPRM does
    not specify a pointer system will be used for REAL ID, leaving the
    realization of a de facto national database as a distinct possibility
    under the regulations.
        Given the inevitable incompleteness and inaccuracies of the REAL ID
    databases, it is shocking to me that the NPRM does not call for a
    redress system. This is not a function that can be left to the States
    because REAL ID and the information it relies upon are bigger than the
    individual States. What happens if one state passes erroneous
    information about an individual to another state? Chances are there
    will be cases where both States claim it's the responsibility of the
    other state to adjudicate the complaint. Where does an individual turn
    if a state DMV and a federal agency cannot agree on who should correct
    an incomplete record? DHS needs to mandate a redress process and make
    it clear where that responsibility lies to ensure errors and oversights
    are resolved promptly.
        Also notably absent from the NPRM is a requirement to encrypt the
    data held electronically on the actual ID card. Without encryption it
    will be substantially easier to steal critical personal information,
    making all Americans more vulnerable to identity theft. Equipment
    capable of reading the Machine Readable Zone on the back of most
    drivers' licenses is readily available. If we're going to spend
    billions of dollars enhancing the security of the rest of the
    identification system, why leave this gaping hole?
        DHS has chosen to pass the responsibility for privacy protection to
    the States. This is inherently problematic because REAL ID requires
    States, and more importantly the individual citizen, to provide and
    share additional personal information in the name of security. Because
    REAL ID is a federal mandate, the Federal Government has an obligation
    to ensure the law is implemented appropriately and that information
    shared under REAL ID is secure. States deserve some flexibility in
    implementing REAL ID as they are the ones who understand the drivers'
    licensing process. However, given the security implications of
    widespread identity theft, the Federal Government cannot remain silent
    on this issue.
        Most troubling is that DHS has elected to hide behind what is not
    said in the REAL ID Act as a means to avoid addressing privacy. The
    NPRM States, ``DHS has sought to address these privacy concerns within
    the limits of its authority under the Act. The Act does not include
    language authorizing DHS to prescribe privacy requirements for state-
    controlled databases or data exchange necessary to implement the Act.''
    The concept that federal agencies need explicit Congressional
    authorization to protect Americans' privacy is just plain wrong. In
    fact, our government is obligated to ensure that programs and
    regulations do not unduly jeopardize an individual's right to privacy.
        Privacy is inherently tied to security. Secretary Chertoff made
    this argument earlier this month when he told the Northern Virginia
    Technology Council that ``Security and privacy are very much the same
    type of value. I don't think they're mutually exclusive, they're
    mutually reinforced.'' As Secretary Chertoff argued, executed
    correctly, better standards for drivers' license issuance will
    strengthen privacy safeguards and help prevent identity theft. However,
    we must remember that if this process is executed poorly, it will have
    the opposite effect.
        Finally, it should be noted that States across the country are
    moving to opt out of REAL ID. Because of the program's structure, it is
    only as strong as its weakest member. If we create a system so onerous
    that it precludes full participation, any security benefit is lost.
        While I regret the repeal of the common sense provisions in the
    Intelligence Reform Act, which I believe has made identification
    security much more difficult, I am committed to ensuring this job is
    done right. We must find a way to make the driver's license a trusted
    document, and the road the Department is now on is not the way. Secure
    identification is at the very heart of our homeland security. I
    strongly encourage the Department to consider the concerns expressed by
    Congress and others in formulation of the regulations. And I look
    forward to working with Chairman Akaka, Senator Collins, the Department
    of Homeland Security, and others to solve this critical and complex
    problem.

                                   __________
                      PREPARED STATEMENT OF SENATOR SUNUNU
        Nearly 2 years ago, the REAL ID Act was inserted into an emergency
    spending bill without holding a single hearing or a substantive debate
    on the Senate floor. At that time, a number of my Senate colleagues and
    I sent a letter to then Senate Majority Leader Bill Frist voicing
    strong opposition to its inclusion. It was and still is my position
    this legislation was too significant to be included as an extraneous
    ``rider'' on a spending bill and it needed to be debated before the
    Senate over a period of several weeks. For that reason, I commend
    Senator Akaka for convening this Subcommittee hearing--albeit 2 years
    too late--to review the REAL ID Act and to carefully consider ways to
    improve the security and eligibility standards for drivers' licenses in
    a manner that does not require a National ID or federal data base to
    track all drivers.
        This Committee appropriately and completely addressed the concerns
    first outlined by the 9/11 Commission's report to Congress regarding
    terrorists use of falsely obtained forms of identification to access
    sensitive security areas. The Commission recommended, ``The Federal
    Government should set standards for the issuance of sources of
    identification, such as drivers' licenses.'' (pg. 390) During the
    summer and fall of 2004, I worked with many of the current members of
    this committee to craft and pass legislation that included a
    collaborative process for developing minimum standards for drivers'
    licenses, such as name, address, phone and signature. This bipartisan
    legislation--The Intelligence Reform and Terrorist Prevention Act of
    2004 (IRTPA)--subsequently passed both Houses of Congress and was
    signed into law by President Bush in December of 2004.
        The IRTPA was mindful of States' rights through the inclusion of
    governors, State legislators and motor vehicle administrators in the
    negotiated rulemaking process. Equally important, it avoided the
    creation of a national ID, massive databases and billions of dollars in
    unfunded mandates. As we all know, this common-sense solution to a
    legitimate problem was eliminated and replaced by an unnecessary,
    unfunded, and unlikely to make you safer federal mandate: REAL ID.
        States understand this and have started to take action. Across the
    country, State Legislatures are introducing, debating and, in some
    cases, passing legislation outlawing the Federal Government
    implementing REAL ID. In this instance, the Senate needs to follow the
    example being set by the States.
        Most recently, the Department of Homeland Security (DHS) released a
    notice of proposed rulemaking. Included in these regulations is an
    agreement to give States a 2 year extension to implement new standards,
    as well as, the understanding that DHS will bring States, technology
    experts, and privacy advocates back to the table to ensure these
    standards are crafted in a way that respects States' rights and
    minimizes costs. It is important to note this would not have been
    possible without the efforts of Senator Collins and others who
    recognize the unreasonable burden REAL ID places on the States.
    Although this agreement is far superior to immediate implementation of
    REAL ID, more must be done to protect taxpayers, States' rights, and
    the privacy of all Americans.
        That is why Senator Akaka and I have reintroduced the
    ``Identification Security Enhancement Act.'' Our legislation would
    repeal Title II of the REAL ID Act and replace it with the negotiated
    rulemaking process originally passed as part of the Intelligence Reform
    and Terrorist Prevention Act of 2004. These provisions would enhance
    privacy protections by ensuring procedures and requirements are in
    place to protect civil liberties, as well as, privacy and
    constitutional rights. I look forward to continuing my efforts to
    combat this unnecessary, unfunded mandate with Senator Akaka and my
    fellow colleagues on the Homeland Security and Government Affairs
    Committee.
    [GRAPHIC] [TIFF OMITTED] 34415.001

    [GRAPHIC] [TIFF OMITTED] 34415.002

    [GRAPHIC] [TIFF OMITTED] 34415.003

    [GRAPHIC] [TIFF OMITTED] 34415.004

    [GRAPHIC] [TIFF OMITTED] 34415.005

    [GRAPHIC] [TIFF OMITTED] 34415.006

    [GRAPHIC] [TIFF OMITTED] 34415.007

    [GRAPHIC] [TIFF OMITTED] 34415.008

    [GRAPHIC] [TIFF OMITTED] 34415.200

    [GRAPHIC] [TIFF OMITTED] 34415.009

    [GRAPHIC] [TIFF OMITTED] 34415.010

    [GRAPHIC] [TIFF OMITTED] 34415.011

    [GRAPHIC] [TIFF OMITTED] 34415.012

    [GRAPHIC] [TIFF OMITTED] 34415.013

    [GRAPHIC] [TIFF OMITTED] 34415.014

    [GRAPHIC] [TIFF OMITTED] 34415.198

    [GRAPHIC] [TIFF OMITTED] 34415.199

    [GRAPHIC] [TIFF OMITTED] 34415.015

    [GRAPHIC] [TIFF OMITTED] 34415.016

    [GRAPHIC] [TIFF OMITTED] 34415.017

    [GRAPHIC] [TIFF OMITTED] 34415.018

    [GRAPHIC] [TIFF OMITTED] 34415.019

    [GRAPHIC] [TIFF OMITTED] 34415.020

    [GRAPHIC] [TIFF OMITTED] 34415.021

    [GRAPHIC] [TIFF OMITTED] 34415.022

    [GRAPHIC] [TIFF OMITTED] 34415.023

    [GRAPHIC] [TIFF OMITTED] 34415.024

    [GRAPHIC] [TIFF OMITTED] 34415.025

    [GRAPHIC] [TIFF OMITTED] 34415.026

    [GRAPHIC] [TIFF OMITTED] 34415.027

    [GRAPHIC] [TIFF OMITTED] 34415.028

    [GRAPHIC] [TIFF OMITTED] 34415.029

    [GRAPHIC] [TIFF OMITTED] 34415.030

    [GRAPHIC] [TIFF OMITTED] 34415.031

    [GRAPHIC] [TIFF OMITTED] 34415.032

    [GRAPHIC] [TIFF OMITTED] 34415.033

    [GRAPHIC] [TIFF OMITTED] 34415.034

    [GRAPHIC] [TIFF OMITTED] 34415.035

    [GRAPHIC] [TIFF OMITTED] 34415.036

    [GRAPHIC] [TIFF OMITTED] 34415.037

    [GRAPHIC] [TIFF OMITTED] 34415.038

    [GRAPHIC] [TIFF OMITTED] 34415.039

    [GRAPHIC] [TIFF OMITTED] 34415.040

    [GRAPHIC] [TIFF OMITTED] 34415.041

    [GRAPHIC] [TIFF OMITTED] 34415.042

    [GRAPHIC] [TIFF OMITTED] 34415.043

    [GRAPHIC] [TIFF OMITTED] 34415.044

    [GRAPHIC] [TIFF OMITTED] 34415.045

    [GRAPHIC] [TIFF OMITTED] 34415.046

    [GRAPHIC] [TIFF OMITTED] 34415.047

    [GRAPHIC] [TIFF OMITTED] 34415.048

    [GRAPHIC] [TIFF OMITTED] 34415.049

    [GRAPHIC] [TIFF OMITTED] 34415.050

    [GRAPHIC] [TIFF OMITTED] 34415.051

    [GRAPHIC] [TIFF OMITTED] 34415.052

    [GRAPHIC] [TIFF OMITTED] 34415.053

    [GRAPHIC] [TIFF OMITTED] 34415.054

    [GRAPHIC] [TIFF OMITTED] 34415.055

    [GRAPHIC] [TIFF OMITTED] 34415.056

    [GRAPHIC] [TIFF OMITTED] 34415.201

    [GRAPHIC] [TIFF OMITTED] 34415.057

    [GRAPHIC] [TIFF OMITTED] 34415.058

    [GRAPHIC] [TIFF OMITTED] 34415.059

    [GRAPHIC] [TIFF OMITTED] 34415.060

    [GRAPHIC] [TIFF OMITTED] 34415.061

    [GRAPHIC] [TIFF OMITTED] 34415.062

    [GRAPHIC] [TIFF OMITTED] 34415.063

    [GRAPHIC] [TIFF OMITTED] 34415.064

    [GRAPHIC] [TIFF OMITTED] 34415.065

    [GRAPHIC] [TIFF OMITTED] 34415.066

    [GRAPHIC] [TIFF OMITTED] 34415.067

    [GRAPHIC] [TIFF OMITTED] 34415.068

    [GRAPHIC] [TIFF OMITTED] 34415.069

    [GRAPHIC] [TIFF OMITTED] 34415.070

    [GRAPHIC] [TIFF OMITTED] 34415.071

    [GRAPHIC] [TIFF OMITTED] 34415.072

    [GRAPHIC] [TIFF OMITTED] 34415.073

    [GRAPHIC] [TIFF OMITTED] 34415.074

    [GRAPHIC] [TIFF OMITTED] 34415.075

    [GRAPHIC] [TIFF OMITTED] 34415.076

    [GRAPHIC] [TIFF OMITTED] 34415.077

    [GRAPHIC] [TIFF OMITTED] 34415.078

    [GRAPHIC] [TIFF OMITTED] 34415.079

    [GRAPHIC] [TIFF OMITTED] 34415.080

    [GRAPHIC] [TIFF OMITTED] 34415.081

    [GRAPHIC] [TIFF OMITTED] 34415.082

    [GRAPHIC] [TIFF OMITTED] 34415.083

    [GRAPHIC] [TIFF OMITTED] 34415.084

    [GRAPHIC] [TIFF OMITTED] 34415.085

    [GRAPHIC] [TIFF OMITTED] 34415.086

    [GRAPHIC] [TIFF OMITTED] 34415.087

    [GRAPHIC] [TIFF OMITTED] 34415.088

    [GRAPHIC] [TIFF OMITTED] 34415.089

    [GRAPHIC] [TIFF OMITTED] 34415.090

    [GRAPHIC] [TIFF OMITTED] 34415.091

    [GRAPHIC] [TIFF OMITTED] 34415.092

    [GRAPHIC] [TIFF OMITTED] 34415.093

    [GRAPHIC] [TIFF OMITTED] 34415.094

    [GRAPHIC] [TIFF OMITTED] 34415.095

    [GRAPHIC] [TIFF OMITTED] 34415.096

    [GRAPHIC] [TIFF OMITTED] 34415.097

    [GRAPHIC] [TIFF OMITTED] 34415.098

    [GRAPHIC] [TIFF OMITTED] 34415.099

    [GRAPHIC] [TIFF OMITTED] 34415.100

    [GRAPHIC] [TIFF OMITTED] 34415.101

    [GRAPHIC] [TIFF OMITTED] 34415.102

    [GRAPHIC] [TIFF OMITTED] 34415.103

    [GRAPHIC] [TIFF OMITTED] 34415.104

    [GRAPHIC] [TIFF OMITTED] 34415.105

    [GRAPHIC] [TIFF OMITTED] 34415.106

    [GRAPHIC] [TIFF OMITTED] 34415.107

    [GRAPHIC] [TIFF OMITTED] 34415.108

    [GRAPHIC] [TIFF OMITTED] 34415.109

    [GRAPHIC] [TIFF OMITTED] 34415.110

    [GRAPHIC] [TIFF OMITTED] 34415.111

    [GRAPHIC] [TIFF OMITTED] 34415.112

    [GRAPHIC] [TIFF OMITTED] 34415.113

    [GRAPHIC] [TIFF OMITTED] 34415.114

    [GRAPHIC] [TIFF OMITTED] 34415.115

    [GRAPHIC] [TIFF OMITTED] 34415.116

    [GRAPHIC] [TIFF OMITTED] 34415.117

    [GRAPHIC] [TIFF OMITTED] 34415.118

    [GRAPHIC] [TIFF OMITTED] 34415.119

    [GRAPHIC] [TIFF OMITTED] 34415.120

    [GRAPHIC] [TIFF OMITTED] 34415.121

    [GRAPHIC] [TIFF OMITTED] 34415.122

    [GRAPHIC] [TIFF OMITTED] 34415.123

    [GRAPHIC] [TIFF OMITTED] 34415.124

    [GRAPHIC] [TIFF OMITTED] 34415.125

    [GRAPHIC] [TIFF OMITTED] 34415.126

    [GRAPHIC] [TIFF OMITTED] 34415.127

    [GRAPHIC] [TIFF OMITTED] 34415.202

    [GRAPHIC] [TIFF OMITTED] 34415.203

    [GRAPHIC] [TIFF OMITTED] 34415.204

    [GRAPHIC] [TIFF OMITTED] 34415.205

    [GRAPHIC] [TIFF OMITTED] 34415.206

    [GRAPHIC] [TIFF OMITTED] 34415.207

    [GRAPHIC] [TIFF OMITTED] 34415.208

    [GRAPHIC] [TIFF OMITTED] 34415.209

    [GRAPHIC] [TIFF OMITTED] 34415.210

    [GRAPHIC] [TIFF OMITTED] 34415.211

    [GRAPHIC] [TIFF OMITTED] 34415.212

    [GRAPHIC] [TIFF OMITTED] 34415.213

    [GRAPHIC] [TIFF OMITTED] 34415.214

    [GRAPHIC] [TIFF OMITTED] 34415.215

    [GRAPHIC] [TIFF OMITTED] 34415.216

    [GRAPHIC] [TIFF OMITTED] 34415.217

    [GRAPHIC] [TIFF OMITTED] 34415.218

    [GRAPHIC] [TIFF OMITTED] 34415.219

    [GRAPHIC] [TIFF OMITTED] 34415.220

    [GRAPHIC] [TIFF OMITTED] 34415.128

    [GRAPHIC] [TIFF OMITTED] 34415.129

    [GRAPHIC] [TIFF OMITTED] 34415.130

    [GRAPHIC] [TIFF OMITTED] 34415.131

    [GRAPHIC] [TIFF OMITTED] 34415.132

    [GRAPHIC] [TIFF OMITTED] 34415.133

    [GRAPHIC] [TIFF OMITTED] 34415.134

    [GRAPHIC] [TIFF OMITTED] 34415.135

    [GRAPHIC] [TIFF OMITTED] 34415.136

    [GRAPHIC] [TIFF OMITTED] 34415.137

    [GRAPHIC] [TIFF OMITTED] 34415.138

    [GRAPHIC] [TIFF OMITTED] 34415.139

    [GRAPHIC] [TIFF OMITTED] 34415.140

    [GRAPHIC] [TIFF OMITTED] 34415.141

    [GRAPHIC] [TIFF OMITTED] 34415.142

    [GRAPHIC] [TIFF OMITTED] 34415.143

    [GRAPHIC] [TIFF OMITTED] 34415.144

    [GRAPHIC] [TIFF OMITTED] 34415.145

    [GRAPHIC] [TIFF OMITTED] 34415.146

    [GRAPHIC] [TIFF OMITTED] 34415.147

    [GRAPHIC] [TIFF OMITTED] 34415.148

    [GRAPHIC] [TIFF OMITTED] 34415.149

    [GRAPHIC] [TIFF OMITTED] 34415.150

    [GRAPHIC] [TIFF OMITTED] 34415.151

    [GRAPHIC] [TIFF OMITTED] 34415.152

    [GRAPHIC] [TIFF OMITTED] 34415.153

    [GRAPHIC] [TIFF OMITTED] 34415.154

    [GRAPHIC] [TIFF OMITTED] 34415.155

    [GRAPHIC] [TIFF OMITTED] 34415.156

    [GRAPHIC] [TIFF OMITTED] 34415.157

    [GRAPHIC] [TIFF OMITTED] 34415.158

    [GRAPHIC] [TIFF OMITTED] 34415.159

    [GRAPHIC] [TIFF OMITTED] 34415.160

    [GRAPHIC] [TIFF OMITTED] 34415.161

    [GRAPHIC] [TIFF OMITTED] 34415.162

    [GRAPHIC] [TIFF OMITTED] 34415.163

    [GRAPHIC] [TIFF OMITTED] 34415.164

    [GRAPHIC] [TIFF OMITTED] 34415.165

    [GRAPHIC] [TIFF OMITTED] 34415.166

    [GRAPHIC] [TIFF OMITTED] 34415.167

    [GRAPHIC] [TIFF OMITTED] 34415.168

    [GRAPHIC] [TIFF OMITTED] 34415.169

    [GRAPHIC] [TIFF OMITTED] 34415.170

    [GRAPHIC] [TIFF OMITTED] 34415.171

    [GRAPHIC] [TIFF OMITTED] 34415.172

    [GRAPHIC] [TIFF OMITTED] 34415.173

    [GRAPHIC] [TIFF OMITTED] 34415.174

    [GRAPHIC] [TIFF OMITTED] 34415.175

    [GRAPHIC] [TIFF OMITTED] 34415.176

    [GRAPHIC] [TIFF OMITTED] 34415.177

    [GRAPHIC] [TIFF OMITTED] 34415.178

    [GRAPHIC] [TIFF OMITTED] 34415.179

    [GRAPHIC] [TIFF OMITTED] 34415.180

    [GRAPHIC] [TIFF OMITTED] 34415.181

    [GRAPHIC] [TIFF OMITTED] 34415.182

    [GRAPHIC] [TIFF OMITTED] 34415.183

    [GRAPHIC] [TIFF OMITTED] 34415.184

    [GRAPHIC] [TIFF OMITTED] 34415.185

    [GRAPHIC] [TIFF OMITTED] 34415.186

    [GRAPHIC] [TIFF OMITTED] 34415.187

    [GRAPHIC] [TIFF OMITTED] 34415.188

    [GRAPHIC] [TIFF OMITTED] 34415.189

    [GRAPHIC] [TIFF OMITTED] 34415.190

    [GRAPHIC] [TIFF OMITTED] 34415.191

    [GRAPHIC] [TIFF OMITTED] 34415.192

    [GRAPHIC] [TIFF OMITTED] 34415.193

    [GRAPHIC] [TIFF OMITTED] 34415.194

    [GRAPHIC] [TIFF OMITTED] 34415.195

    [GRAPHIC] [TIFF OMITTED] 34415.196

    [GRAPHIC] [TIFF OMITTED] 34415.197