[Congressional Record Volume 152, Number 135 (Friday, December 8, 2006)]
[Senate]
[Pages S11744-S11746]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mr. AKAKA (for himself and Mr. Sununu):
  S. 4117. A bill to repeal title II of the REAL ID Act of 2005, to 
reinstitute the section 7212 of the Intelligence Reform and Terrorism 
Prevention Act of 2004, which provides States additional regulatory 
flexibility and funding authorization to more rapidly produce tamper- 
and counterfeit-resistant driver's licenses and to protect privacy and 
civil liberties by providing interested stakeholders on a negotiated 
rulemaking with guidance to achieve improved 21st century licenses to 
improve national security; to the Committee on the Judiciary.
  Mr. AKAKA. Mr. President, I rise today to discuss the REAL ID Act of 
2005.
  The REAL ID Act became law over a year and a half ago, but opposition 
remains strong and vocal. I hold in my hand a list of hundreds of 
organizations--ranging from the National Governor's Association--NGA--
to the American Civil Liberties Union--ACLU--to the National Rifle 
Association--that believe the REAL ID Act was a grave mistake. None of 
these groups were heard by Congress before the bill was passed in May 
2005. There were no hearings to understand the repercussions of such 
sweeping legislation; and no debate on the floor of the Senate.
  Rather, the REAL ID Act was attached to a must-pass piece of 
legislation, the Emergency Supplemental Appropriations Act for Defense, 
the Global War on Terror, and Tsunami Relief Act--Public Law 109-13, in 
conference and therefore received virtually no scrutiny before passage. 
Every Member of Congress who supported providing much needed funding to 
our troops and relief to the Indonesia tsunami victims was forced to 
vote in favor of the REAL ID Act, an unrelated bill.
  That is why I come to the floor today to spark a real debate on REAL 
ID. I say to my colleagues there are serious problems with REAL ID and 
it's time Congress took a closer look.
  My two primary concerns with REAL ID are that the law: places an 
unrealistic and unfunded burden on state governments; and erodes 
Americans' civil liberties and privacy rights.
  There is nothing realistic about REAL ID. This law mandates that 
State-issued IDs, such as driver's licenses, comply with certain 
security standards and procedures, as determined by the Department of 
Homeland Security--DHS--in order to be accepted by the Federal 
Government for such purposes as boarding an airplane or entering a 
Federal building. These procedures include electronically verifying the 
authenticity of each identifying document, such as birth certificates, 
passports, and social security cards, presented to a local Department 
of Motor Vehicles--DMV--office. Such a requirement likely will involve 
developing an extremely costly and complex set of electronic systems 
that connect the thousands of DMVs to one another and to a host of 
Federal agencies. This would cost $1.42 billion according to a 
September 2006 report issued by the NGA, the National Conference of 
State Legislatures--NCSL--and the American Association of Motor Vehicle 
Administrators--AAMVA.
  In addition, every current driver's license holder must be reenrolled 
under the new screening process which will more than double the 
workload at local DMVs across the country and far exceed their current 
capacity. REAL ID will put an end, at least temporarily, to online and 
mail license renewals and will cause huge lines and back-up at the DMV. 
Although security should never be sacrificed for convenience, it is 
important that states have the time and flexibility to implement the 
additional security standards in an effective manner. Moreover, 
reenrollment

[[Page S11745]]

will be the mostly costly piece of REAL ID, estimated at approximately 
$8 billion over 5 years by NGA, NCSL, and AAMVA.
  There are a number of other requirements imposed on states by REAL 
ID, such as new design requirements for the ID cards and on-site 
security. In total, REAL ID will cost over $11 billion according to the 
NGA study. Congress has appropriated only $40 million for REAL ID 
implementation to date, and no funds were included for fiscal year 
2007. That leaves a hefty pricetag for the States, especially for 
legislation that was passed with no review.
  In addition to the cost imposed on States, REAL ID imposes an 
unrealistic timeframe. Under the law, states must have REAL ID 
compliant systems in place by May 2008. Yet implementing regulations 
have not been issued. DHS is expected to issue the regulations early 
next year. However, as of today, the Office of Management and Budget, 
OMB, has not received the draft regulations, and OMB is allowed 90 days 
by Executive order for review of all proposed regulations. That would 
give states a little over a year to develop electronic verification 
systems, redesign driver's license cards, establish protocols on how to 
handle and secure personal information, increase DMV personnel, and 
find a way to fund it all. It has taken DHS over a year and a half just 
to issue the regulations. Expecting the States to execute the new 
system in even less time is unrealistic.
  In addition to the unrealistic burden REAL ID places on States, REAL 
ID is a serious threat to our privacy rights and civil liberties.
  The REAL ID Act will require each State's driver's licensing agency 
to collect and store substantial numbers of records containing 
licensees' most sensitive personally identifiable information, 
including one's social security number, proof of residence, and 
biometric identifiers such as a digital photograph and signature. If 
the new State databases are compromised, they will provide one-stop 
access to virtually all information necessary to commit identity theft. 
Moreover, the sharing of the aggregated personally identifiable 
information of licensees between and amongst various government 
agencies and employees at the Federal, State, and local level, as 
contemplated by the REAL ID Act, potentially allows millions of 
individuals access to that information without protections or 
safeguards. The potential for the private sector to scan and share the 
information contained on a REAL ID compliant license exponentially 
increases the risk of identity theft as well. Despite these obvious 
threats to Americans' privacy, the REAL ID Act fails to mandate privacy 
protections for individuals' information nor does it provide States 
with the means to implement data security and antihacking protections 
that will be required to safeguard the new databases mandated by the 
act.
  REAL ID exacerbates the threat of identity theft which threatens our 
security. As the Honolulu Star Bulletin noted in a October 1, 2006, 
editorial, the REAL ID Act gives us ``a false sense of security.''
  I come to the floor today to inject some reality into REAL ID. 
Unfunded mandates, privacy, and security are real problems that deserve 
real consideration and real solutions. It is my hope that when DHS 
issues the REAL ID regulations, the following issues are addressed: (1) 
limiting access to the REAL ID networks; (2) securing data that is 
electronically stored on driver's licenses and ID cards; (3) allowing 
flexibility in the technological solutions employed by the States; (4) 
defining the role Federal agencies will play in developing and 
connecting with the electronic verification systems; (5) ensuring that 
individuals' privacy rights provided by the Federal Government and 
State governments are protected; (6) providing a means to correct 
inaccurate information held in the REAL ID networks; and (7) ensuring 
that the information contained in the license cannot be scanned or 
shared by private entities.
  I hope that the regulations will be well thought out and reflect the 
stakeholder input provided to DHS over the past year and a half which 
included the issues I just raised.
  However, given what I have heard from participants about the rule-
making process thus far, I am concerned that the regulations are being 
developed by too few people without enough stakeholder engagement.
  When DHS began this process, the State Working Group was developed to 
gather input from stakeholders. However, the engagement process was not 
as robust as it could have been. Participants in the working group 
never received feedback from DHS on their proposals and DHS never 
reconvened the group to evaluate a draft of the regulations.
  I also am concerned that given the shortsightedness of the law DHS 
was given by Congress, it may be the case that a complete replacement 
of the REAL ID Act is necessary. I am looking to DHS to issue workable 
regulations. However, if our personal privacy is not protected and the 
burden placed on states is too great, a legislative change to REAL ID 
may prove necessary.
  Congress established a negotiated rulemaking process to improve the 
security of drivers licenses and ID cards in the Intelligence Reform 
and Terrorism Prevention Act of 2004. According to participants, that 
process was making headway when the REAL ID Act passed repealing the 
negotiated rulemaking language and imposing much stricter guidelines.
  Today Senator Sununu and I introduce the Identification Security 
Enhancement Act, which will repeal the REAL ID Act and reinstitute the 
shared rulemaking and more reasonable guidelines established in the 
Intelligence Reform Act. It is my intention to review the forthcoming 
DHS regulations before pursuing any action on our bill. I am hopeful 
that new legislation will not be necessary, and I look forward to 
working with DHS to produce workable guidelines. However, I believe 
that introducing the Identification Security Enhancement Act now is 
important because it will send a message that the intent of the 
entirety of Congress is not reflected in the REAL ID Act.
  Congress has a responsibility to ensure that driver's licenses and ID 
cards issued in the United States are secure--both from would-be 
terrorists and identity thieves--affordable, and practical. I ask my 
colleagues to join us in injecting reality into the REAL ID Act.
  I ask unanimous consent that the text of the bill be printed in the 
Record.
  There being no objection, the bill was ordered to be printed in the 
Record, as follows:

                                S. 4117

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``Identification Security 
     Enhancement Act of 2006''.

     SEC. 2. REPEAL.

       Title II of the REAL ID Act of 2005 (Division B of Public 
     Law 109-13; 49 U.S.C. 30301 note) is repealed.

     SEC. 3. DRIVER'S LICENSES AND PERSONAL IDENTIFICATION CARDS.

       (a) Definitions.--In this section:
       (1) Driver's license.--The term ``driver's license'' means 
     a motor vehicle operator's license (as defined in section 
     30301(5) of title 49, United States Code).
       (2) Personal identification card.--The term ``personal 
     identification card'' means an identification document (as 
     defined in section 1028(d)(3) of title 18, United States 
     Code) issued by a State.
       (b) Standards for Acceptance by Federal Agencies.--
       (1) In general.--
       (A) Limitation on acceptance.--No Federal agency may 
     accept, for any official purpose, a driver's license or 
     personal identification card newly issued by a State more 
     than 2 years after the promulgation of the minimum standards 
     under paragraph (2) unless the driver's license or personal 
     identification card conforms to such minimum standards.
       (B) Date for full conformance.--
       (i) In general.--Except as provided under clause (ii), 
     beginning on the date that is 5 years after the promulgation 
     of minimum standards under paragraph (2), no Federal agency 
     may accept, for any official purpose, a driver's license or 
     personal identification card issued by a State unless such 
     driver's license or personal identification card conforms to 
     such minimum standards.
       (ii) Alternative date for full conformance.--If the 
     Secretary of Homeland Security determines that it is 
     impracticable for States to replace all State-issued driver's 
     licenses and personal identification cards before the 
     deadline set forth in clause (i), the Secretary of Homeland 
     Security, in consultation with the Secretary of 
     Transportation, may set a later, alternative deadline to the 
     extent necessary for States to complete such replacement with 
     reasonable efforts.

[[Page S11746]]

       (C) State certification.--
       (i) In general.--Each State shall certify to the Secretary 
     of Homeland Security that the State is in compliance with the 
     requirements of this section.
       (ii) Frequency.--Certifications under clause (i) shall be 
     made at such intervals and in such a manner as the Secretary 
     of Homeland Security, with the concurrence of the Secretary 
     of Transportation, may prescribe by regulation.
       (iii) Audits.--The Secretary of Homeland Security may 
     conduct periodic audits of each State's compliance with the 
     requirements of this section.
       (2) Minimum standards.--Not later than 12 months after the 
     date of enactment of this Act, the Secretary of Homeland 
     Security, in consultation with the Secretary of 
     Transportation, shall by regulation, establish by minimum 
     standards for driver's licenses or personal identification 
     cards issued by a State for use by Federal agencies for 
     identification purposes that shall include--
       (A) standards for documentation required as proof of 
     identity of an applicant for a driver's license or personal 
     identification card;
       (B) standards for the verifiability of documents used to 
     obtain a driver's license or personal identification card;
       (C) standards for the processing of applications for 
     driver's licenses and personal identification cards to 
     prevent fraud;
       (D) standards for information to be included on each 
     driver's license or personal identification card, including--
       (i) the person's full legal name;
       (ii) the person's date of birth;
       (iii) the person's gender;
       (iv) the person's driver's license or personal 
     identification card number;
       (v) a photograph of the person;
       (vi) the person's address of principal residence; and
       (vii) the person's signature;
       (E) standards for common machine-readable identity 
     information to be included on each driver's license or 
     personal identification card, including defined minimum data 
     elements;
       (F) security standards to ensure that driver's licenses and 
     personal identification cards are--
       (i) resistant to tampering, alteration, or counterfeiting; 
     and
       (ii) capable of accommodating and ensuring the security of 
     a photograph or other unique identifier; and
       (G) a requirement that a State confiscate a driver's 
     license or personal identification card if any component or 
     security feature of the license or identification card is 
     compromised.
       (c) Negotiated Rulemaking.--
       (1) In general.--Before publishing the proposed regulations 
     required by subsection (b)(2) to carry out this title, the 
     Secretary of Homeland Security shall establish a negotiated 
     rulemaking process pursuant to subchapter IV of chapter 5 of 
     title 5, United States Code (5 U.S.C. 561 et seq.).
       (2) Time requirement.--The process described in paragraph 
     (1) shall be conducted in a timely manner to ensure that--
       (A) any recommendation for a proposed rule or report--
       (i) is provided to the Secretary of Homeland Security not 
     later than 9 months after the date of enactment of this Act; 
     and
       (ii) includes an assessment of the benefits and costs of 
     the recommendation; and
       (B) a final rule is promulgated not later than 12 months 
     after the date of enactment of this Act.
       (3) Representation on negotiated rulemaking committee.--Any 
     negotiated rulemaking committee established by the Secretary 
     of Homeland Security pursuant to paragraph (1) shall include 
     equal numbers of representatives from--
       (A) among State offices that issue driver's licenses or 
     personal identification cards;
       (B) among State elected officials;
       (C) the Department of Transportation; and
       (D) among interested parties, including experts in privacy 
     protection, experts in civil liberties and protection of 
     constitutional rights, and experts in immigration law.
       (4) Content of regulations.--The regulations required by 
     subsection (b)(2)--
       (A) shall facilitate communication between the chief driver 
     licensing official of a State, an appropriate official of a 
     Federal agency and other relevant officials, to verify the 
     authenticity of documents, as appropriate, issued by such 
     Federal agency or entity and presented to prove the identity 
     of an individual;
       (B) may not infringe on a State's power to set criteria 
     concerning what categories of individuals are eligible to 
     obtain a driver's license or personal identification card 
     from that State;
       (C) may not require a State to comply with any such 
     regulation that conflicts with or otherwise interferes with 
     the full enforcement of State criteria concerning the 
     categories of individuals that are eligible to obtain a 
     driver's license or personal identification card from that 
     State;
       (D) may not require a single design to which driver's 
     licenses or personal identification cards issued by all 
     States must conform; and
       (E) shall include procedures and requirements to protect 
     the privacy rights of individuals who apply for and hold 
     driver's licenses and personal identification cards.
       (F) shall include procedures and requirements to protect 
     the federal and state constitutional rights and civil 
     liberties of individuals who apply for and hold driver's 
     licenses and personal identification cards;
       (G) shall not permit the transmission of any personally 
     identifiable information except for in encrypted format;
       (H) shall provide individuals with procedural and 
     substantive due process, including promulgating rules and 
     rights of appeal, to challenge errors in data records 
     contained within the databases created to implement this Act;
       (I) shall not permit private entities to scan the 
     information contained on the face of a license, or in the 
     machine readable component of the license, and resell, share 
     or trade that information with any other third parties, nor 
     shall private entities be permitted to store the information 
     collected for any other than fraud prevention purposes;
       (J) shall not preempt state privacy laws that are more 
     protective of personal privacy than the standards, or 
     regulations promulgated to implement this Act; and
       (K) shall neither permit nor require verification of birth 
     certificates until a nation wide system is designed to 
     facilitate such verification.
       (d) Grants to States.--
       (1) Assistance in meeting federal standards.--Beginning on 
     the date a final regulation is promulgated under subsection 
     (b)(2), the Secretary of Homeland Security shall award grants 
     to States to assist them in conforming to the minimum 
     standards for driver's licenses and personal identification 
     cards set forth in the regulation.
       (2) Allocation of grants.--The Secretary of Homeland 
     Security shall award grants to States under this subsection 
     based on the proportion that the estimated average annual 
     number of driver's licenses and personal identification cards 
     issued by a State applying for a grant bears to the average 
     annual number of such documents issued by all States.
       (3) Minimum allocation.--Notwithstanding paragraph (2), 
     each State shall receive not less than 0.5 percent of the 
     grant funds made available under this subsection.
       (4) Separate funding.--Funds appropriated for grants under 
     this section may not be commingled with other grant funds 
     administered by the Department of Homeland Security and may 
     not be used for any purpose other than the purpose set forth 
     in paragraph (1).
       (e) Extension of Effective Date.--The Secretary of Homeland 
     Security may extend the date specified under subsection 
     (b)(1)(A) for up to 2 years for driver's licenses issued by a 
     State if the Secretary determines that the State made 
     reasonable efforts to comply with the date under such 
     subsection but was unable to do so.

     SEC. 4. AUTHORIZATION OF APPROPRIATIONS.

       There are authorized to be appropriated to the Secretary of 
     Homeland Security $300,000,000 for each of the fiscal years 
     2007 through 2013 to carry out this Act.
                                 ______