[Federal Register Volume 73, Number 19 (Tuesday, January 29, 2008)]
[Rules and Regulations]
[Pages 5272-5340]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 08-140]



[[Page 5271]]

-----------------------------------------------------------------------

Part II





Department of Homeland Security





-----------------------------------------------------------------------



6 CFR Part 37



Minimum Standards for Driver's Licenses and Identification Cards 
Acceptable by Federal Agencies for Official Purposes; Final Rule

  Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / 
Rules and Regulations  

[[Page 5272]]


-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

Office of the Secretary

6 CFR Part 37

[Docket No. DHS-2006-0030]
RIN 1601-AA37


Minimum Standards for Driver's Licenses and Identification Cards 
Acceptable by Federal Agencies for Official Purposes

AGENCY: Office of the Secretary, DHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Homeland Security is establishing minimum 
standards for State-issued driver's licenses and identification cards 
that Federal agencies would accept for official purposes on or after 
May 11, 2008, in accordance with the REAL ID Act of 2005. This rule 
establishes standards to meet the minimum requirements of the REAL ID 
Act of 2005. These standards involve a number of aspects of the process 
used to issue identification documents, including: Information and 
security features that must be incorporated into each card; application 
information to establish the identity and immigration status of an 
applicant before a card can be issued; and physical security standards 
for facilities where driver's licenses and applicable identification 
cards are produced. This final rule also provides a process for States 
to seek an additional extension of the compliance deadline to May 11, 
2011, by demonstrating material compliance with the core requirements 
of the Act and this rule. Finally, taking into consideration the 
operational burdens on State Departments of Motor Vehicles, this rule 
extends the enrollment time period to allow States determined by DHS to 
be in compliance with the Act to replace all licenses intended for 
official purpose with REAL ID-compliant cards by December 1, 2014 for 
people born after December 1, 1964, and by December 1, 2017 for those 
born on or before December 1, 1964.

DATES: Effective Date: This rule is effective March 31, 2008. The 
incorporation by reference of certain publications listed in the rule 
is approved by the Director of the Federal Register as of March 31, 
2008.
    Compliance Dates: Extensions: As of May 11, 2008, Federal agencies 
cannot accept driver's licenses or identification cards for official 
purposes, as defined herein, from States that have not been determined 
by DHS to be in compliance with the REAL ID Act unless a State has 
requested and obtained an extension of the compliance date from DHS. 
States seeking extensions must submit a request for an extension to DHS 
no later than March 31, 2008. As of December 31, 2009, any initial 
extension will terminate unless a State, no later than October 11, 
2009, submits to DHS a request for an additional extension and 
certification that the State has achieved the benchmarks set forth in 
the Material Compliance Checklist. As of May 11, 2011, driver's 
licenses and identification cards will not be accepted from States that 
are not in full compliance with the provisions of REAL ID.
    Enrollment: As of December 1, 2014, Federal agencies cannot accept 
driver's licenses or identification cards for official purposes, as 
defined herein, from any individual born after December 1, 1964, unless 
DHS has determined that the issuing State is in compliance with 
Subparts A through D of this rule and the card presented by the 
individuals meet the standards of this rule. As of December 1, 2017, 
Federal agencies will not accept any State-issued driver's licenses and 
identification cards for official purposes unless such cards have been 
issued by States that have certified to DHS their compliance with 
Subparts A through D of this rule.

FOR FURTHER INFORMATION CONTACT: Darrell Williams, REAL ID Program 
Office, Department of Homeland Security, Washington, DC 20528 (202) 
282-9829.

SUPPLEMENTARY INFORMATION:

Abbreviations and Terms Used in This Document

AAMVA--American Association of Motor Vehicle Administrators
ACLU--American Civil Liberties Union
CAC--U.S. Department of Defense Common Access Card
CDLIS--Commercial Drivers License Information System
CHRC--Criminal History Records Check
CRBA--Consular Report of Birth Abroad
DHS--U.S. Department of Homeland Security
DMV--Department of Motor Vehicles
DOS--U.S. Department of State
DOT--U.S. Department of Transportation
EAD--Employment Authorization Document
EDL--Enhanced driver's license and identification card
EVVE--Electronic Verification of Vital Events
FOIA--Freedom of Information Act
IAFIS--Integrated Automated Fingerprint Identification
ICAO--International Civil Aviation Organization
ID--Identification Card
JPEG--Joint Photographic Experts Group
LPR--Lawful Permanent Resident
MRZ--Machine Readable Zone
NAPHSIS--National Association of Public Health Statistics and 
Information Systems
NASCIO--National Association of State Chief Information Officers
NCSL--National Conference of State Legislatures
NCIC--National Crime Information Center
NGA--National Governors Association
NPRM--Notice of Proposed Rulemaking
PII--Personally Identifiable Information
RFID--Radio Frequency Identification
SAVE--Systematic Alien Verification for Entitlements
SEVIS--Student and Exchange Visitor Information System
SSA--Social Security Administration
SSI--Sensitive Security Information
SSN--Social Security Number
SSOLV--Social Security On-Line Verification
TIF--Tagged Image Format
TSA--Transportation Security Administration
TWIC--Transportation Worker Identification Credential
USCIS--U.S. Citizenship and Immigration Services
WHTI--Western Hemisphere Travel Initiative

Table of Contents

I. Background
II. Discussion of the Final Rule
    A. Extension of Deadlines
    B. Implementation Dates
    C. Verification and Data Exchange Systems Architecture
    D. Marking of Compliant REAL ID Documents
    E. Prohibition on States Issuing Real ID Cards to Persons Who 
Hold a Driver's License in Another State
    F. Western Hemisphere Travel Initiative
III. Section-by-Section Analysis of the Final Rule
IV. Discussion of Comments
    A. General Comments on the Proposed Regulation
    B. Scope, Applicability, and Definitions
    C. Compliance Period
    D. Privacy Considerations
    E. State to State Database Queries
    F. Document Standards for Issuing REAL ID Driver's Licenses and 
Identification Cards
    G. Exceptions Processing for Extraordinary Circumstances
    H. Temporary or Limited-Term Driver's Licenses and 
Identification Cards
    I. Minimum Driver's License or Identification Card Data Element 
Requirements
    J. Validity Period and Renewals of REAL ID Driver's Licenses and 
Identification Cards
    K. Source Document Retention
    L. Database Connectivity
    M. Security of DMV Facilities Where Driver's Licenses and 
Identification Cards are Manufactured and Produced
    N. State Certification Process; Compliance Determinations

[[Page 5273]]

    O. Driver's Licenses and Identification Cards that Do Not Meet 
the Standards of the REAL ID Act.
    P. Section 7209 of the Intelligence Reform and Terrorism 
Prevention Act of 2004
    Q. Responses to Specific Solicitation of Comments
V. Regulatory Analyses
    A. Paperwork Reduction Act
    B. Economic Impact Analyses
    C. Executive Order 13132, Federalism
    D. Environmental Impact Analysis
    E. Energy Impact Analysis
    F. Executive Order 13175, Tribal Consultation

I. Background

A. Statutory Authority and Regulatory History

    This final rule establishes minimum standards for State-issued 
driver's licenses and identification cards that Federal agencies can 
accept for official purposes on or after May 11, 2008, as required 
under the REAL ID Act of 2005. See, Public Law 109-13, 119 Stat. 231, 
302 (May 11, 2005) (codified at 49 U.S.C. 30301 note) (the Act).
    During the terrorist attacks on the United States on September 11, 
2001, all but one of the terrorist hijackers acquired some form of 
identification document, some by fraud, and used these forms of 
identification to assist them in boarding commercial flights, renting 
cars, and other necessary activities leading up to the attacks. See, 
The 9/11 Commission Report, Final Report of the National Commission on 
Terrorist Attacks upon the United States (July 2004) (9/11 Commission 
Report), p. 390. The 9/11 Commission recommended implementing more 
secure sources of identification for use in, among other activities, 
boarding aircraft and accessing vulnerable facilities. In its report, 
the Commission stated:

    Secure identification should begin in the United States. The 
federal government should set standards for the issuance of birth 
certificates and sources of identification, such as driver's 
licenses. Fraud in identification documents is no longer just a 
problem of theft. At many entry points to vulnerable facilities, 
including gates for boarding aircraft, sources of identification are 
the last opportunity to ensure that people are who they say they are 
and to check whether they are terrorists.

Id. at 390.

    Congress enacted the Act in May 2005, in response to the 9/11 
Commission's recommendations.
    Under the Act, Federal agencies are prohibited, effective May 11, 
2008, from accepting a driver's license or a State-issued personal 
identification card for an official purpose unless the issuing State is 
meeting the requirements of the Act. ``Official purpose'' is defined 
under Sec.  201 of the Act to include access to Federal facilities, 
boarding Federally-regulated commercial aircraft, entry into nuclear 
power plants, and such other purposes as established by the Secretary 
of Homeland Security. Undoubtedly, the most significant impact on the 
public of this statutory mandate is that, effective May 11, 2008, 
citizens of States that have not been determined by DHS to be in 
compliance with the mandatory minimum requirements set forth in the 
REAL ID Act may not use their State-issued driver's licenses or 
identification cards to pass through security at airports. Citizens in 
this category will likely encounter significant travel delays.
    The Act authorizes the Secretary of Homeland Security, in 
consultation with the States and the Secretary of Transportation, to 
promulgate regulations to implement the requirements under this Act. 
Section 205(b) of the Act further authorizes the Secretary of Homeland 
Security to grant extensions of time to meet the minimum standards of 
the Act when States provide adequate justification for noncompliance. 
The Act does not, however, give DHS the authority to waive any of the 
mandatory minimum standards set forth in the Act. Those mandatory 
provisions are set forth below.
    Section 202(b) of the Act directs that REAL ID-compliant licenses 
and identification cards must include the following information:
    (1) The person's full legal name, date of birth, and gender;
    (2) The person's driver's license or identification card number;
    (3) A digital photograph of the person;
    (4) The person's address of principal residence;
    (5) The person's signature;
    (6) Physical security features designed to prevent tampering, 
counterfeiting, or duplication of the driver's licenses and 
identification cards for fraudulent purposes; and
    (7) A common machine-readable technology, with defined minimum 
elements.
    Section 202(c) of the Act also mandates certain minimum standards 
that States must adopt when issuing driver's licenses and 
identification cards intended for use for official purposes (referred 
to as REAL ID-compliant cards). Those standards include, but are not 
limited to, the following:
     The State shall require, at a minimum, presentation and 
verification of (1) A photo identity document (except that a non-photo 
identity document is acceptable if it includes both the applicant's 
full legal name and date of birth); (2) documentation showing the 
applicant's date of birth; (3) proof of the person's Social Security 
Number (SSN) or verification that the applicant is not eligible for a 
SSN; and (4) documentation showing the applicant's name and address of 
principal residence. Sec.  202(c).
     The State shall require valid documentary evidence that 
the applicant is lawfully present in the United States. Such evidence 
shall include documentary evidence that the applicant: (1) Is a citizen 
or national of the United States; (2) is an alien lawfully admitted for 
permanent residence or temporary residence in the United States or 
pending application for same; (3) has conditional permanent resident 
status in the United States or pending application for such status; (4) 
has an approved application for asylum in the United States, a pending 
application for asylum, or has been admitted to the United States in 
refugee status; (5) was lawfully admitted to the United States using a 
valid, unexpired nonimmigrant visa; (6) has a pending or approved 
application for temporary protected status in the United States; or (7) 
has approved deferred action status. Sec.  202(c)(2)(B).
     States must establish procedures to verify each document 
required to be presented by the applicant. The State also shall have 
entered into a memorandum of understanding (MOU) with DHS to use the 
Systematic Alien Verification for Entitlements (SAVE system) to verify 
the lawful status of an applicant, other than a U.S. citizen. Sec.  
202(c)(3)(C).
     States also must confirm with the Social Security 
Administration (SSA) that the SSN presented by an applicant (as 
required under Sec.  202(c)(1)(C)) is registered to that person. Sec.  
202(d)(5).
     States must ensure the physical security of facilities 
where driver's licenses and identification cards are produced; and the 
security of document materials and papers from which driver's licenses 
and identification cards are produced. Sec.  202(d)(7).
     All persons authorized to manufacture or produce cards to 
appropriate security clearance requirements. Sec.  202(d)(8).
     Physical security features on the driver's licenses and 
identification cards designed to prevent tampering, counterfeiting, and 
duplication of the documents for a fraudulent purpose. Sec.  202(b)(8).
    The Act also permits a State otherwise in compliance with the Act 
to issue driver's licenses and identification cards that do not conform 
to the Act's

[[Page 5274]]

requirements. See Sec.  202(d)(11). Federal agencies, however, cannot 
accept such driver's licenses and identification cards for an official 
purpose and States must ensure that such cards or licenses must state 
on their faces that a Federal agency may not accept it for an official 
purpose. See Sec.  202(d)(11)(A). States also must use a unique design 
or color indicator so that it is readily apparent to Federal agency 
personnel that the card is not to be accepted for an official purpose. 
See Sec.  202(d)(11)(B).
    The Act requires DHS to determine whether a State is meeting the 
Act's requirements based upon certifications submitted by each State in 
a manner prescribed by DHS.

II. Discussion of Final Rule

    DHS published an NPRM on March 3, 2007, proposing requirements to 
meet the minimum standards required under the Act. The proposed 
requirements included information and security features that must be 
incorporated into each card; application information to establish the 
identity and immigration status of an applicant before a card can be 
issued; and physical security standards for facilities where driver's 
licenses and identification cards are produced. For additional 
information, please see the NPRM at 72 FR 10820.
    DHS received over 21,000 comments on the NPRM and supporting 
regulatory evaluation during the sixty-day public comment period for 
this rulemaking action. Responses to those comments are set forth in 
Section IV of this final rule. This final rule implements the 
requirements of the Act, but with significant changes from the NPRM as 
a result of public comment, as discussed below.
    As discussed above, effective May 11, 2008, Federal agencies are 
prohibited from accepting for official purposes state-issued driver's 
licenses or identification cards unless an issuing State certifies, and 
DHS determines, that it has met the mandatory minimum requirements of 
Sec.  202 of the REAL ID Act. Several States have implemented--or are 
working to implement--legislation prohibiting their Departments of 
Motor Vehicles (DMVs) from complying with the requirements of the Act 
or any related implementing regulations issued by DHS. DHS wants to 
make clear that effective May 11, 2008, individuals from States who 
have not obtained an extension of the compliance date from DHS, or who 
have not submitted a Compliance Package to DHS under the deadlines 
provided in this final rule, will not be able to use their State-issued 
license for federal official purposes, including for identification to 
board a commercial airplane. Residents of States that do choose to 
comply, however, through submission of their Compliance Plan or a 
timely-filed request for an extension, will be able to continue to use 
their current license to board commercial aircraft (and for other 
official purposes) through December 1, 2014. Effective December 1, 
2014, Federal agencies will refuse to accept non-REAL ID-compliant 
driver's licenses from all persons born before December 1, 1964 (i.e. 
under the age of fifty). Effective December 1, 2017, anyone seeking to 
use a State-issued driver's license or identification card for official 
purpose, including boarding of commercial aircraft, must have a REAL 
ID-compliant card.

A. Extension of Deadlines

    Under section 205(b) of the Act, the Secretary of Homeland Security 
is authorized to grant extensions of the May 11, 2008 compliance date 
to those States who provide adequate justification for their inability 
to comply by the statutory deadline. On March 1, 2007, the Secretary of 
Homeland Security announced, in conjunction with the release of the 
NPRM, that the Department would grant extensions to all States 
requesting extensions, not to exceed December 31, 2009. In the NPRM, 
DHS proposed that States that would not be able to comply by May 11, 
2008, should request an extension of the compliance date no later than 
February 10, 2008, and the proposal encouraged States to submit 
requests for extension as early as October 1, 2007. Under this final 
rule, States must file requests for an initial extension no later than 
March 31, 2008. That initial extension would expire on December 31, 
2009. Pursuant to Sec.  37.55 of this rule, States must submit requests 
for extensions to the REAL ID Program Office. Contact information is 
provided in the ``For Further Information'' section of this rule. 
Requests for extension must be submitted from the highest level 
executive official in the State overseeing the DMV to the REAL ID 
Program Office.
    DHS received numerous comments from States arguing that the lack of 
a centralized verification system would make it impossible for most, if 
not all, States to comply with the minimum statutory requirements by 
December 31, 2009. DHS recognizes the difficulty that many States may 
have in meeting the statutory requirements under the Act, but 
emphasizes that the Department has a critical responsibility to ensure 
that identification documents used to board commercial air carriers or 
access Federal buildings are secure documents and adequately prevent 
persons from circumventing Federal security and screening requirements 
by use of false or fraudulent identification.
    In balancing the operational needs of the States against the 
security responsibilities of DHS and the Federal Government, DHS has 
decided to allow States to obtain an extension beyond December 31, 
2009. DHS, however, will only grant a second extension to States that 
demonstrate that they have achieved certain milestones towards 
compliance with the Act and the final rule. States unable to 
demonstrate this progress will not be able to receive an additional 
extension. DHS has identified eighteen milestones, captured in the 
``Material Compliance Checklist,'' that States must certify they have 
met in order to obtain an extension of the compliance deadline beyond 
December 31, 2009. The Material Compliance Checklist is available at 
DHS' Web site at www.dhs.gov. The eighteen milestones are all mandatory 
requirements under the Act; one of the most important ones, however, is 
the State's ability to verify that the applicant is lawfully present in 
the United States. Any second extension will terminate effective May 
11, 2011, at which time, as discussed above, the State must begin 
issuing fully compliant REAL ID cards.

B. Phased Enrollment Periods

    DHS initially proposed that States determined by DHS to be in 
compliance with the Act and the final rule would have until May 11, 
2013 to replace all driver's licenses and identification cards with 
REAL ID-compliant cards. Under the NPRM, licenses intended for Federal 
official purposes issued by States on or after May 11, 2008 and 
determined by DHS to be in compliance with the Act and this final rule 
would be REAL ID-compliant, and the State would have worked to replace 
existing licenses, through standard renewal or replacement processes no 
later than May 11, 2013. Until that phased-in enrollment period 
concluded on May 11, 2013, Federal agencies would accept from residents 
of compliant States both REAL ID-compliant licenses dated on or after 
May 11, 2008 or standard licenses issued before May 11, 2013. The NPRM 
also proposed the same phase-in period for States requesting initial 
extensions of the compliance date until December 31, 2009, i.e., States 
receiving an extension would still have until May 11, 2013 to enroll 
their current drivers.
    During the public comment period, a number of States and State 
associations noted that States obtaining an initial extension of the 
compliance date until

[[Page 5275]]

December 31, 2009, would still be required to enroll their existing 
driver population (estimated to be approximately 240 million) by May 
11, 2013. This would essentially halve the phase-in period and create 
an untenable burden and increased costs on States who were committed to 
complying with the REAL ID requirements. Several commenters suggested 
that DHS consider a risk-based approach that would permit States and 
DMVs to defer enrollment of a proportion of the population that 
statistically may present a lower risk of obtaining false or fraudulent 
identification to, among other potential purposes, circumvent 
Transportation Security Administration (TSA) passenger screening 
procedures and requirements or to access Federal buildings with a false 
identification.
    DHS recognizes the significant operational impact on State DMVs if 
all licenses issued by a State were required to be REAL ID-compliant by 
May 11, 2008, or May 11, 2013; and believes that an age-based approach 
is the best way to balance operational concerns against security 
concerns. DHS has considered the best methodology to target preventive 
efforts against an individual attempting to fraudulently obtain an 
identification document to gain access to a Federal facility, nuclear 
facility, or commercial aircraft. In the absence of threat reporting 
about particular individuals, to which the DMVs will not have access, 
DHS has determined that the most appropriate substitute criteria to 
apply is age.
    DHS has determined that the most logical option to reduce the 
significant operational burden on States is to allow States to divide 
their license-bearing population and re-issue REAL ID-compliant 
licenses through a two-phased enrollment. This approach would reduce 
the operational burdens on States, which otherwise would have to 
reissue licenses to the majority of their license-bearing populations 
within two years for States requiring and obtaining extensions until 
May 11, 2011. DHS also has determined that a phased enrollment based on 
age is consistent with the intent of the REAL ID Act by focusing the 
first phase of enrollment on the population of persons that may have a 
higher propensity to obtain and use fraudulent identification.
    To determine a logical age to use as a cut-off point for a two-
phased enrollment, DHS determined, based on comments received and 
statistical analysis of incident reports obtained from the TSA, that 
solely for purposes of establishing an age-based enrollment for 
compliance with the REAL ID Act, the logical point of division would be 
to allow States to defer enrollment for persons over the age of fifty. 
The statistical analysis supporting this determination was conducted by 
DHS utilizing TSA incident reports identifying persons arrested or 
detained for use of fraudulent identification at TSA screening areas 
during the period from October 1, 2004 through July 25, 2007. This 
analysis roughly indicates that persons over the age of fifty were less 
likely to be involved in TSA-related law enforcement incidents 
involving false or fraudulent identification. More specific information 
on the methodology underlying this assessment is provided in Section 
IV.C. below.
    Accordingly, DHS, under this final rule, has developed a phased 
enrollment approach for States who have certified compliance with the 
requirements of the Act and this final rule, and have been determined 
by DHS to be in compliance with the Act and this rule. Under this final 
rule, once a State certifies compliance with the REAL ID Act and this 
final rule, the State may focus enrollment first on issuing REAL ID-
compliant cards to individuals born after December 1, 1964 (those who 
will be less than fifty years of age as of December 1, 2014, the date 
of full compliance). States may delay the full enrollment of persons 
born on or before December 1, 1964, for three additional years, until 
December 1, 2017.
    DHS believes that this approach balances the security objective of 
improving the reliability of identification documents presented for 
official purposes, including the boarding of commercial aircraft, with 
the needs of the States to spread out their compliance costs over a 
greater period of time and to obtain the necessary legal and budgetary 
approval from within their States to comply with the regulations. DHS 
also notes that States will be able to reduce their overall compliance 
costs based on phased enrollment approach. The economic analysis is 
presented in section V. of this rule.

C. Verification and Data Exchange Systems Architecture

    The REAL ID Act requires States to verify supporting documents with 
the issuing agency. Because our population moves freely among the 
States, each State will need the capability to verify documents from 
issuing agencies in all other States. Although the Act places this 
burden on the States, DHS has worked to consider several technical 
solutions that would provide States with this capability. DHS has 
initiated a verification systems design project to define the 
requirements for the optimal system for REAL ID. DHS is working with 
the American Association of Motor Vehicle Administrators (AAMVA), the 
Department of Transportation (DOT), the Social Security Administration, 
the Department of State (DOS), the National Association of Public 
Health Statistics and Information Systems (NAPHSIS), and State 
representatives to define requirements for a ``hub'' based network and 
messaging systems to support the requirements of REAL ID. DHS is 
assessing the extent to which the current AAMVA network, 
communications, and systems architecture can serve as a platform for 
deployment of REAL ID data verification and State-to-State data 
exchanges.
    The backbone of this hub would be AAMVAnet, the network system that 
AAMVA operates to facilitate data verification for State DMVs. DOT is 
currently funding an ongoing project to upgrade the capability of 
AAMVAnet by building in such security features as end-to-end data 
encryption and Federal Information Security Management Act-based 
security standards. The DOT-funded project will potentially expand 
AAMVAnet's capability to provide the capacity to handle the increased 
transaction volume for the required State-to-State transactions. 
Finally, the AAMVAnet backbone resides on a private network with no 
connectivity to the Internet. It has been, and will continue to be, a 
highly secure transportation layer for all communications between 
States and agency databases.
    With respect to data verification, AAMVAnet already supports 
verification of both social security numbers (SSNs) and birth 
certificates. These application systems enable States to query the 
Social Security On-Line Verification (SSOLV) database managed by the 
Social Security Administration (SSA) and the Electronic Verification of 
Vital Events (EVVE) system owned and operated by NAPHSIS. While 47 
States currently verify SSNs through AAMVAnet, verification of birth 
certificates is limited to those States whose vital events records are 
available online. In both cases only State DMVs can initiate queries; 
personal data are verified and not exchanged; and no personal 
information is created, modified, or stored as a result of the 
transaction. Working with both SSA and NAPHSIS, DHS is identifying 
requirements for enhancements to both application systems.
    U.S. Citizenship and Immigration Services (USCIS) is working to 
modify the SAVE system to allow States to

[[Page 5276]]

facilitate their ability to meet the verification requirements under 
the Sec.  202(c)(3) of REAL ID Act, a requirement that States routinely 
utilize the SAVE system to verify the lawful status of REAL ID card 
applicants. Currently, a majority of States have already entered into 
Memoranda of Understanding with USCIS to access and use SAVE, as 
required under section 202(c)(3) of the Act. USCIS is developing a 
standard user interface to meet all State DMV business process needs 
for immigration-related transactions and to draft requirements for a 
common messaging system that takes advantage of the same AAMVAnet 
standards and infrastructure that support State DMV queries against 
SSOLV, EVVE, and other Federal and State databases.
    DHS also is exploring the alternative of using the Commercial 
Drivers Licensing Information System (CDLIS) as the baseline platform 
for supporting the State-to-State data exchange requirements of the 
REAL ID Act and regulation. CDLIS currently supports queries to every 
State DMV every time an individual applies for a driver's license in 
any State or the District of Columbia. CDLIS already meets the data 
exchange requirements of REAL ID for those drivers holding commercial 
driver's licenses. Moreover, CDLIS is a secure, State-governed system 
that stores the minimum amount of personal information possible to 
facilitate the routing of queries and responses between States. DHS is 
considering an effort to define system requirements for REAL ID State-
to-State data exchanges based upon the CDLIS model or platform. This 
project would define a systems architecture for REAL ID State-to-State 
data exchanges that would leverage the ongoing CDLIS modernization 
project led by the DOT. DHS will work closely with DOT to build upon 
current and planned systems designs to meet the requirements of REAL 
ID.

D. Marking of Compliant REAL ID Documents

    Section 202(d)(11) of the Act allows States to issue, in addition 
to REAL ID-compliant licenses, identification cards not intended to be 
accepted by Federal agencies for official purposes. Under the Act, 
however, any such card must clearly state on its face that it may not 
be accepted by any Federal agency for federal identification or any 
other official purpose; and States must use a unique design or color 
indicator to alert Federal agencies and other law enforcement that it 
may not be accepted for any such purpose. DHS will leave the types of 
marking and unique coloring to the discretion of the individual States, 
subject to DHS approval as part of the Compliance Package to ensure 
that DHS officials, such as TSA screeners, can adequately distinguish 
between REAL ID-compliant cards and those not intended for official 
purposes.
    Based on an analysis of feedback from several commenters, DHS, 
however, has determined it would be in the best interest of the 
nation's security for States to place a security marking on licenses 
and identification cards to allow Federal agencies to more readily 
determine which States are issuing licenses or identification cards 
that are REAL ID-compliant or have been determined to be ``materially 
compliant'' (including verifying that REAL ID applicants are lawfully 
present in the United States). DHS will work with States concerning 
marking compliant licenses and identification cards that indicate 
whether the document was issued in material compliance of the Act's 
requirements, or in full compliance of the Act's requirements as set 
forth in Subpart E of this rule.

E. Prohibition on States Issuing REAL ID Cards to Persons Who Hold a 
Driver's License in Another State

    Section 202(d)(6) of the Act requires that States ``refuse to issue 
a driver's license or identification card to a person holding a 
driver's license issued by another State without confirmation that the 
person is terminating or has terminated the driver's license.'' In the 
NPRM, DHS maintained that we are not regulating the issuance of 
driver's licenses beyond that required under the REAL ID Act, but 
encourage the policy of ``one driver, one license.'' Following comments 
on the rule, however, DHS believes it is necessary to clarify that the 
REAL ID Act mandates that a State cannot issue a REAL ID license to a 
person who is holding a license issued by another State or to an 
individual who already holds a REAL ID card. (A person can, however, 
hold a REAL ID card and another non-REAL ID, non-driver's license 
identification card). DHS, therefore, revised Sec.  37.33, moving that 
provision to a separate section (Sec.  37.29), to clarify and emphasize 
that a State cannot issue a REAL ID card without verifying that an 
applicant does not hold another REAL ID card or a driver's license from 
another State, or if the applicant holds another driver's license, that 
he or she is taking steps to terminate that license. See Sec.  
202(d)(6) of the Act.

F. Western Hemisphere Travel Initiative

    Section 7209 of the Intelligence Reform and Terrorism Prevention 
Act of 2004, as amended,\1\ requires the Secretary of Homeland 
Security, in consultation with the Secretary of State, to develop and 
implement a plan to require travelers entering the United States to 
present a passport, other document, or combination of documents, that 
are ``deemed by the Secretary of Homeland Security to be sufficient to 
denote identity and citizenship.'' This DHS and Department of State 
(DOS) initiative is referred to as the Western Hemisphere Travel 
Initiative (WHTI). DHS and DOS have issued several regulations 
implementing WHTI travel document requirements at air ports of entry, 
and proposing documents acceptable for cross border travel at land and 
sea ports-of-entry. For additional information on the WHTI rulemaking 
actions, please see 71 FR 68411 (Nov. 24, 2006) (final air rule) and 72 
FR 35087 (proposed land and sea rule).
---------------------------------------------------------------------------

    \1\ Pub. L. 108-458, as amended, 118 Stat. 3638 (Dec. 17, 2004).
---------------------------------------------------------------------------

    As part of WHTI, the Secretary of Homeland Security has the 
authority to designate alternative documents that denote identity and 
citizenship that can be used for cross border purposes at land and sea 
ports-of-entry. In determining which documents should provide a 
convenient, low-cost alternative for U.S. citizens, particularly those 
residing in border states, DHS notes that State DMVs are well 
positioned to provide an enhanced driver's license (EDL) to meet this 
need. DHS is coordinating efforts to ensure that an EDL, developed to 
meet the requirements of WHTI, will adopt standards that REAL ID 
requires, as they are defined through the REAL ID rulemaking process. 
For an EDL to be an acceptable WHTI document for land and sea cross-
border travel, it can only be issued to U.S. citizens, denote such 
citizenship on the face of the card, and must include technologies that 
facilitate electronic verification and travel at ports-of-entry. DHS 
will continue to work closely with interested states to develop 
driver's licenses that can meet both REAL ID and WHTI requirements.
    The requirements outlined above constitute substantive changes 
between the March 2007 proposed rule and this final rule. A more robust 
discussion of this final rule and DHS's responses to comments are set 
forth below.

[[Page 5277]]

III. Section-By-Section Analysis of the Final Rule

Section 37.1 Applicability

    DHS added a reference to Sec.  202(d)(11) of the REAL ID Act to 
make it clear that the provisions of this rule apply to States who 
intend to issue driver's licenses or identification cards that can be 
accepted by Federal agencies for official purposes and that intend to 
be determined by DHS to be in compliance with section 202 of the REAL 
ID Act.

Section 37.3 Definitions

    DHS added a definition of ``full compliance'' to clarify the 
relationships between full compliance with the requirements of Subparts 
A through D, and ``material compliance'' with the procedures in Subpart 
E that allow a State to file for and receive an extension.
    DHS refined the definition of ``covered employees'' in this final 
rule to clarify that employees refers to DMV employees.
    DHS added a definition of ``duplicate'' for driver's licenses and 
identification cards issued subsequent to the original license or card 
bearing the same information and expiration date as the original.
    DHS has modified the definition of ``full legal name'' to bring it 
closer to existing name conventions used by the Social Security 
Administration, the Department of State, and other issuers of source 
documents.
    DHS has added the definition of ``material change'' to provide 
clarity for States as to when an individual may be required to make an 
in-person visit to a DMV office to obtain an updated REAL ID driver's 
license or identification card when certain information changes from 
the time they obtained their previous REAL ID document. For the purpose 
of this final rule, a change of address of principal residence does not 
constitute a material change.
    DHS has added a definition of ``material compliance'' as a basis 
for establishing the benchmarks that DHS will use to evaluate State 
progress toward meeting the requirements of this rule. States in 
material compliance with Subparts A through D of this rule will be 
granted a second extension until no later than May 10, 2011 to meet all 
the requirements of this rule.
    DHS maintained the same definition of ``official purpose'' as that 
proposed in the NPRM and set forth in the REAL ID Act; to mean 
``accessing Federal facilities, boarding Federally-regulated commercial 
aircraft, and entering nuclear power plants.''
    DHS also added a definition for ``personally identifiable 
information'' as it pertains to these rules and the REAL ID Act.
    DHS changed the definition of ``principal residence'' from the 
location where a person has his or her true, fixed, and permanent home 
and intends to return, to the location where a person currently resides 
even if this location is temporary, in conformance with the residency 
requirements of the State issuing the driver's license or 
identification card, if such requirements exist. DHS made this change 
in response to comments that the prior definition would unfairly 
prevent persons such as military personnel or students residing 
temporarily in a State from obtaining a driver's license or 
identification card from that State.
    DHS revised the definition of ``sexual assault and stalking'' to 
incorporate the meaning of these terms given by State laws.
    DHS broadened the scope of the term ``State address 
confidentiality'' to allow States to cover not only victims of violence 
or assault, but also ``other categories of persons'' that may need to 
have their addresses kept confidential.
    DHS added a comprehensive definition of the term ``verify'' to 
clarify the scope of application in the rule. The definition makes it 
clear that verification includes two interrelated procedures: (1) 
inspection to see if the document is genuine and has not been altered, 
and (2) checking to see that the identity data on the document is 
valid.

Section 37.5 Validity Periods and Deadlines for REAL ID Driver's 
Licenses and Identification Cards

    The proposed language in Sec.  37.5 required that all cards issued, 
reissued, or renewed after May 11, 2008 had to be REAL ID-compliant by 
May 11, 2013 in order to be acceptable by Federal agencies for official 
purposes. As discussed in Section II above and the responses to 
comments in Section IV below, DHS has determined that the following 
enrollment schedule will apply under this final rule: (1) Effective 
December 1, 2014, Federal agencies will be prohibited from accepting 
State-issued driver's licenses or identification cards for official 
purpose from individuals born after December 1, 1964, unless the 
individual presents a REAL ID-compliant card from a State that has 
certified and that DHS has determined compliance with the REAL ID Act 
and this final rule; and (2) effective December 1, 2017, Federal 
agencies will be prohibited from accepting for official purposes from 
any individual (regardless of age) State-issued driver's licenses or 
identification cards that are not REAL ID-compliant.

Section 37.11 Application and Documents the Applicant Must Provide

    DHS proposed, in the March NPRM, that States must maintain 
photographs of individuals who applied for, but ultimately were denied 
a REAL ID card by the State, for up to one year. However, DHS also 
proposed that States must maintain photographs of persons denied REAL 
ID cards based on suspected fraud for ten years and reflect in the 
State's records that a driver's license or identification card was not 
issued by the State because of suspicions of fraud. In response to 
comments, this final rule was amended to provide a uniform photograph 
retention provision of five years for persons who are denied a REAL ID 
card, regardless of the reason that the State denies issuance of a REAL 
ID card. DHS has also added a provision requiring States to retain the 
photo for two years after expiration of the card to allow individuals 
to renew licenses after they have expired.
    The NPRM also proposed to require, under Sec.  37.11(b), that 
States retain with applicant source documents the required signed 
declaration that the information presented by the applicant is true and 
accurate. This final rule no longer requires States to retain the 
required declaration with the applicant's source documents, the 
retention of which is mandated under Sec.  202(d)(2) of the Act. 
Instead, recognizing the operational burdens on the States, DHS is 
exercising its discretion on this matter to require only that the 
declaration must be retained by States consistent with applicable State 
document retention requirements or policies.
    Under Sec.  37.11(c), DHS has added a provision that would allow 
DHS to change the list of documents acceptable to establish identity 
following publication of a notice in the Federal Register.
    DHS also has provided States a broader latitude to accept documents 
other than documents issued by a Federal or State-level Court or 
government agency to establish a name change. Moreover, where State law 
or regulation permits, the State may record a name other than that 
contained in the identity document on the face of the license or card 
as long as the State maintains copies of the documentation presented 
pursuant to Sec.  37.31, and maintains a record of both the recorded 
name and the name on the source documents in a manner to be determined 
by the State.

[[Page 5278]]

    The NPRM proposed, under Sec.  37.11(e), that an applicant for a 
REAL ID card must provide documentation establishing a Social Security 
Number (SSN) or the applicant's ineligibility for an SSN. This final 
rule amends that proposed requirement to allow an applicant, if a 
Social Security Administration account card is not available, to 
present any of the following documents bearing the applicant's SSN: (i) 
A W-2 form, (ii) a SSA-1099 form, (iii) a non-SSA-1099 form, or (iv) a 
pay stub bearing the applicant's name and SSN. A State, however, must 
verify the SSN pursuant to Sec.  37.13(b)(2) of this final rule.
    DHS has amended proposed Sec.  37.11(f) to give States more 
discretion in the acceptance of documents required to demonstrate the 
applicant's principal address by removing specific requirements that 
documents used to demonstrate address of principal residence be issued 
``monthly'' and ``annually.''
    In response to comments regarding demonstrating the applicant's 
lawful status in the United States, DHS has amended Sec.  37.11(g) with 
regard to which identity documents may serve as satisfactory evidence 
of the applicant's lawful status. While all identity documents listed 
in Sec.  37.11(c) must be verified by the State in the manner 
prescribed in Sec.  37.13, State verification of some of the identity 
documents also provides satisfactory evidence of lawful status. 
Therefore, if the applicant presents one of the documents listed under 
Sec.  37.11 (c)(1)(i)-(viii)(except for (v)), the issuing State's 
verification of the applicant's identity in the manner prescribed in 
Sec.  37.13 will also provide satisfactory evidence of lawful status. 
State verification of the remaining identity documents listed in Sec.  
37.11(c), however, does not provide satisfactory evidence of lawful 
status and the applicant must provide additional documentation of 
lawful status as determined by USCIS.
    In response to comments on the exceptions process proposed in Sec.  
37.11(h), DHS has amended this final rule to allow U.S. citizens to 
utilize the process to prove lawful status. In response to comments 
that it was unrealistic and too costly to require States to provide 
quarterly reports analyzing the use of their exceptions process, this 
proposed requirement has been replaced with a requirement that States 
must conduct a review of the DMV's use of the exceptions process and 
submit the report to DHS as part of their certification package per 
Sec.  37.55. Section 37.11(h) has also reduced the information required 
to be maintained by the State when the exceptions process is used.

Section 37.13 Document Verification Requirements

    Based on numerous comments and ongoing State DMV programs, the rule 
now includes the provision that the State must make reasonable efforts 
to ensure that the person has not been issued identification documents 
in multiple or different names. Identified by several responders as the 
top priority for reducing the number of fraudulent licenses issued, 
this requirement has been reformulated and moved from Sec.  37.11 to 
37.13.
    In response to concerns that a number of the verification systems 
contained in the proposal would not be operational by the verification 
deadlines, the final rule gives States more flexibility in verifying 
documents and identity data.
    DHS added language that provides that nothing in this section 
precludes a DMV from issuing an interim license or a license under 
Sec.  202(d)(11) of the Act to permit an individual to resolve any non-
match issue, but clarifies that such cards cannot be accepted for 
official purposes.

Section 37.15 Physical Security Features for the Driver's License or 
Identification Card

    DHS has deleted the proposed card design standards in response to 
comments which stated that the standards were an undue burden on the 
States. DHS has added language that States must conduct a review of 
their card design and submit a report to DHS as part of its 
certification package that indicates the ability of the designs to 
resist compromise and document fraud attempts.

Section 37.17 Requirements for the Surface of the Driver's License or 
Identification Card

    In response to comments that some States allow a name other than 
the full legal name on the identity document to be on the surface of 
the license, this section has been amended to require full legal name 
as demonstrated on the applicant's identity document, but an individual 
may establish his or her name with other documentation where State law 
or regulation permits, as long as the State maintains copies of the 
documentation presented pursuant to Sec.  37.31 and maintains a record 
of both the recorded name and the full legal name on the identity 
document in a manner to be determined by the State.
    Under Sec.  37.17(d), the unique license or card identification 
number must only be unique to each license or card holder within the 
State and not unique across all the States and other covered 
jurisdictions.
    With regard to full facial digital photographs pursuant to Sec.  
37.17(e), DHS has clarified the discussion to bring it into closer 
compliance with DHS, Federal and national standards. Language was added 
that allows photographs to be in black and white or color.
    To provide States with greater flexibility in protecting 
confidential addresses, Sec.  37.17(f) contains new language that 
allows the display of an alternative address on the license or card, if 
a State permits this, and acceptance of an administrative order issued 
by a State or Federal court to show that an individual's address is 
entitled to be suppressed. States may also use an address convention 
used by the U.S. Postal Service where a street number and street name 
have not been assigned.
    Further, Sec.  37.17(g) now requires that States establish an 
alternative procedure for individuals unable to sign their names. The 
requirement to use the Roman alphabet has been replaced with use of the 
Latin alphabet which is more common.
    In response to several comments from States and AAMVA that REAL ID-
compliant documents should be marked or ``branded'' as REAL ID-
compliant, DHS has added 37.17(n) which requires that REAL ID-compliant 
licenses and identification cards bear a DHS-approved security marking 
in accordance with the level of compliance with the Act.

Section 37.19 Machine Readable Technology on the Driver's License or 
Identification Card

    This section contains technical conforming changes to reflect the 
changes made in Sec.  37.11(c)(2) allowing a name other than the full 
legal name to appear on the license or card if a State law permits. 
State or territory of issuance has been added to the MRZ data fields to 
accommodate instances where a State may not have a residency 
requirement or may allow use of an out-of-State address to receive a 
license.

Section 37.21 Temporary or Limited-Term Driver's Licenses and 
Identification Cards

    In response to comments that the term ``temporary'' may cause 
confusion under current terminology practices with some DMVs, this 
section adds new terminology and now refers to such licenses/cards as 
``limited-term or temporary.'' DHS also added language that provides 
that the verification of

[[Page 5279]]

lawful status for such licenses/cards may be through SAVE, or ``another 
method approved by DHS.''

Section 37.23 Reissued REAL ID Driver's Licenses and Identification 
Cards

    In response to comments, Sec.  37.23 now provides that States may 
conduct a non-in-person (i.e., remote) reissuance of a driver's license 
or card if State procedures permit the reissuance to be conducted 
remotely, except that a State may not remotely reissue a license or 
card where there has been any material change in information since 
prior issuance.

Section 37.25 Renewal of REAL ID Driver's Licenses and Identification 
Cards

    Section 37.25(a)(2) adds language that requires the States to 
reverify SSN information to ensure that the applicant's information is 
still valid. DHS has also added explicit language requiring that the 
State must verify electronically information that it was not able to 
verify at a previous issuance or renewal, if the systems or processes 
exist to do so.

Section 37.27 Driver's Licenses and Identification Cards Issued During 
the Age-Based Enrollment Period

    This section has been added to affirm the acceptability of driver's 
licenses and identification cards issued, reissued, or renewed prior to 
the end of the age-based enrollment period. For example, if an 
individual is 60 years of age and their license naturally expires in 
2009, the State may issue that individual a license under that State's 
current practices, and that license will be accepted for official 
purposes until 2017, after which time that individual must present a 
license that complies with this rule for that card to be accepted for 
official purposes. As of December 1, 2014, individuals born after 
December 1, 1964 (that is, under fifty years old on that date) must 
present a REAL ID card when they present a State-issued driver's 
license or identification for official purposes. As of December 1, 
2017, all individuals presenting a State-issued driver's license or 
identification card for official purposes must present a REAL ID card. 
The new section reemphasizes that an individual's driver's license will 
continue to be accepted for official purposes until the expiration of 
the individual's applicable enrollment period.

Section 37.29 Prohibition Against Holding More Than One REAL ID Card or 
More Than One Driver's License

    In response to numerous comments to clarify the ``one driver one 
license'' concept in the REAL ID rules, DHS has created a stand-alone 
section, Sec.  37.29, that specifically states that an individual may 
hold only one REAL ID card, whether it is a REAL ID identification card 
or a REAL ID driver's license. In addition, prior to issuing a REAL ID 
driver's license, a State that is complying with REAL ID must check 
with all other States to determine if the applicant currently holds a 
driver's license or REAL ID identification card in another State, and 
if so, the receiving State must take measures to confirm that the 
person has terminated or is terminating the driver's license or REAL ID 
identification card issued by the prior State pursuant to State law, 
regulation or procedure.

Section 37.31 Source Document Retention

    DHS has added language to Sec.  37.31 to reiterate the requirement 
that States must protect any personally identifiable information 
collected pursuant to the REAL ID Act as described in the Security Plan 
(Sec.  37.41).
    In response to comments, DHS deleted the following requirements 
from this section:
     That States must replace black and white imagers with 
color imagers by December 31, 2011;
     That States using digital imaging to retain source 
documents must use the AAMVA Digital Exchange Program or a standard 
that has interoperability with the AAMVA standard;
     That all images must be linked to the applicant through 
the applicant's unique identifier assigned by the DMV; the amended 
requirement now states that all images must be retrievable by the DMV 
if properly requested by law enforcement.
    DHS has also added a provision that allows States to record 
information from birth certificates in lieu of retaining an image or 
copy if State law permits and if requested by the applicant. This will 
protect medical and other personal information not relevant to REAL ID.

Section 37.33 DMV Databases

    DHS changed the title of this section from ``Database connectivity 
with other States'' to ``DMV Databases.'' This section has also been 
amended to require that the DMV database allow capture of the full 
legal name and any other name recorded under Sec.  37.11(c)(2) without 
truncation.

Section 37.41 Security Plan

    DHS amended this section to clarify that each State submit a single 
security plan to address DMV facilities involved in the enrollment, 
issuance, manufacturing and production of driver's licenses and 
identification cards, rather than all State DMV driver's license/
identification facilities as stated in the NPRM. This change is in 
response to comments that it does not enhance overall security to 
require every DMV office (which could be interpreted to include 
administrative offices) to submit a security plan and individual risk 
assessments.
    Furthermore, in response to comments asking for clarification, 
Sec.  37.41(b)(iii) now provides that the release and use of personal 
information must, at a minimum, be consistent with the Driver's Privacy 
Protection Act, 18 U.S.C. 2721 et seq.
    This section of the final rule now indicates that the fraudulent 
document training requirement would be satisfied by a fraudulent 
document training program approved by AAMVA. DHS has also deleted the 
requirements that the security plan contain procedures to revoke and 
confiscate driver's licenses or identification cards fraudulently 
issued in another State, in response to comments that States have no 
authority to carry out such a requirement.
    A new section has been added to Sec.  37.41 to state that the 
Security Plans contain Sensitive Security Information and must be 
handled and protected in accordance with 49 CFR Part 1520.

Section 37.43 Physical Security of DMV Production Facilities

    This section is unchanged.

Section 37.45 Background Checks for Covered Employees

    Section 37.45(d) has been amended to recognize background checks 
that are similar to those required under Sec.  37.45 and that were 
conducted on or after May 11, 2006, and that the DMV does not have to 
check references from prior employers for individuals that have been 
working with the DMV for at least two consecutive years prior to the 
Act taking effect. (The Act becomes effective on May 11, 2008). 
Therefore DMVs would not have to seek references from prior employers 
of employees who have been with the DMV consecutively from May 11, 2006 
to May 11, 2008. The final rule clarifies that the waiver provision in 
Sec.  37.45(b)(1)(v) allows a waiver of requirements for the 
determination of arrest status and includes circumstances where the 
individual has been arrested, but no final disposition on the matter 
has been reached.

[[Page 5280]]

    In response to comments, DHS deleted the requirement that States 
must conduct a financial history check as part of the background check 
of covered employees.
    Section 37.45 now requires that the State confirm the employment 
eligibility of the covered employee, rather than lawful status through 
SAVE, and recommends that the State participate in the USCIS E-Verify 
program (or any successor program) for employment eligibility 
verification.

Section 37.51 Compliance--General Requirements

    DHS has modified this section in response to many comments. DHS 
recognizes that States will be unable to meet all the requirements of 
this rule beginning on January 1, 2010, the day after the termination 
of the extension period proposed by DHS in the NPRM. For example, 
requirements for State verification of source documents depend upon the 
deployment of electronic systems that have not yet been developed. 
Therefore, DHS proposes that States meeting key benchmarks for progress 
toward compliance with the REAL ID Act be granted an additional 
extension until no later than May 10, 2011 to meet all the requirements 
of Subparts A through D. States seeking a second extension would submit 
a Material Compliance Checklist to DHS no later than October 11, 2009, 
documenting their progress in meeting the benchmark requirements. 
States meeting these benchmarks would also be able to issue driver's 
licenses and identification cards bearing security markings indicating 
that the license was issued in conformity with REAL ID standards.

Section 37.55 State Certification Documentation

    The title of the section was amended to reflect the changes to the 
certification process discussed above. The required contents of the 
State certification have been amended in the final rule to delete the 
requirement for a copy of all statutes, regulations, and administrative 
procedures and practices related to the State's implementation program. 
DHS has amended the requirement that a State's governor certify 
compliance to read that a State's highest level official with oversight 
responsibility over the DMVs certify compliance. In addition, the 
frequency of certification reporting has been modified to be similar to 
the three-year intervals required by several Department of 
Transportation programs. Thus, in accordance, Sec.  37.57 ``Annual 
State Certifications'' has been removed.

Section 37.59 DHS Reviews of State Compliance

    DHS has rephrased the information requirement in the section to 
require any reasonable information pertinent to determining compliance 
with this part as requested by DHS. Also, DHS must now provide written 
notice to the State in advance of an inspection visit. The final rule 
provides that, in the event of a DHS preliminary determination that the 
State has not submitted a complete certification or that the State does 
not meet one or more of the minimum standards for compliance under this 
part, DHS will inform the State of the preliminary determination within 
forty-five days. Finally, this section now includes DHS procedures for 
reviewing a Material Compliance Checklist as part of the procedure for 
granting States an additional extension until no later than May 10, 
2011.

Section 37.61 Results of Compliance Determination

    The final rule now states that DHS will determine that a State is 
not in compliance when it fails to submit the certification as 
prescribed or to request an extension as prescribed in the subpart.

Section 37.63 Extension of Deadline

    The NPRM was not clear on the timing of submissions for requests 
for extension. Although proposed regulatory text stated that requests 
for extension must be submitted no later than October 1, 2007; the 
preamble requested submission of compliance plans and strongly 
encouraged ``States to communicate their intent to certify compliance 
or request an extension by October 1, 2007.'' We clarify the deadline 
for submission of requests for extension in the final rule, providing 
that requests for extension must be submitted to DHS ``no later than 
March 31, 2008.'' DHS will notify a State of its acceptance of the 
extension within forty-five days of receipt.
    This section now includes the procedure for requesting an 
additional extension until no later than May 10, 2011. States seeking 
an additional extension shall submit a Material Compliance Checklist to 
DHS no later than October 11, 2009, documenting the State's progress in 
meeting certain benchmarks. States meeting the benchmarks included in 
this checklist will be granted a second extension until no later than 
May 10, 2011.

Section 37.65 Effect of Failure To Comply With This Part

    DHS amended this section to provide that REAL ID driver's licenses 
and identification cards issued by the State during the term of any 
extension will continue to be acceptable for official purposes until 
the card expires.

Section 37.67 Non-REAL ID Driver's Licenses and Identification Cards

    This section was renumbered to Sec.  37.71, consistent with the 
structure of the Part. The section was also renamed to ``Driver's 
licenses and identification cards issued under Sec.  202(d)(11) of the 
REAL ID Act'' to further clarify that DHS interprets this section of 
the Act to apply only to States that certify and DHS determines are 
compliant with the REAL ID Act, as defined by these regulations, and 
that choose to also issue driver's licenses and identification cards 
under the Act that are otherwise not acceptable by Federal agencies for 
official purposes.

IV. Discussion of Comments

    During the sixty-day comment period, DHS received over 21,000 
comments on the NPRM. DHS received numerous requests to extend the 
comment period past the sixty days provided in the NPRM. DHS has 
carefully considered the comments and determined not to extend the 
comment period for the NPRM. As discussed above, under the REAL ID Act, 
Federal agencies will be prohibited from accepting driver's licenses or 
other State-issued identification cards from States that are not in 
compliance with the requirements of the Act by May 11, 2008, less than 
one year away. Given the complexity of the Act's requirements and these 
implementing regulations, extending the comment period beyond sixty 
days would serve only to delay issuance of this final rule and deprive 
States of the information necessary for their DMVs to begin 
preparations and adjust their operations consistent with the 
requirements of this final rule and the Act. Further, in addition to 
the 60-day comment period, DHS provided several opportunities for 
additional public participation through such events as the May 1, 2007, 
public meeting in Davis, California (with participation also available 
via webcast); and meetings with stakeholders. We determined that the 
60-day comment period and additional DHS outreach during the comment 
period provided adequate time for the public to consider and provide 
meaningful comment on the NPRM.
    We also received several comments that were filed well past May 8, 
2007, the close of the comment period. As discussed above, given the 
upcoming May 11, 2008, compliance deadline and the adequacy of the 
sixty-day comment

[[Page 5281]]

period and public outreach, DHS has not accepted or considered comments 
that were filed after the May 8, 2007 close of the comment period. 
Because DHS did not extend the comment period, allowing some commenters 
to file late--or to provide late filed supplements to their comments--
would disadvantage those commenters who did not file late and would 
also have preferred additional time to file comments or amend the 
comments that were filed within the deadline. Comments that were timely 
filed, but not processed immediately by DHS due to technical errors by 
the submitter or DHS, are not considered to have been filed late and 
were considered in the development of this final rule.

A. General Comments on the Proposed Regulation

1. General Comments in Support of the Proposed Regulation
    Comments: Several commenters expressed general support for the 
proposed rule. Commenters wrote that the REAL ID program will provide a 
measurable and positive impact on a wide range of security matters, and 
that the cost estimates, methods of implementation, and the projected 
time frames were reasonable. One commenter wrote that REAL ID correctly 
specified a set of performance standards rather than listing static 
prescriptive standards, and that enhanced document security is 
essential to combat terrorists, can help improve transportation safety, 
and can combat identity theft or other criminal acts.
    Response: DHS agrees with these commenters, and believes that 
States that fully implement these rules will improve national security 
by improving the security and reliability of a key document carried by 
many Americans. Both the REAL ID Act and the REAL ID regulations focus 
on improving the reliability of State-issued driver's licenses and 
identification cards and decreasing the likelihood that an individual 
can fraudulently obtain an identity document or alter a legitimate 
identity document to create a false identity. The availability of 
better and more reliable security documents means that government and 
law enforcement officials have a greater opportunity to prevent 
terrorists and other unauthorized persons from gaining access to 
commercial airplanes and Federal facilities.
2. General Comments in Opposition to the Proposed Regulation
    Comment: Many commenters expressed general opposition to the REAL 
ID program. General comments included the following: DHS misinterpreted 
the REAL ID Act, the proposed rule is incomplete and problematic, 
adequate studies have not been conducted to determine that the program 
will work, the rule's requirements will lead to degradation in the 
level of State DMV customer service, the rule would harm citizens' 
privacy, and the rule requires additional Federal funding. Many 
commenters wrote that the rule fails to provide appropriate security, 
utility, or privacy and one commenter said the rule ``is inadequate to 
meet the intent of the REAL ID Act and the needs of the states and 
citizens of the U.S.'' Another commenter wrote that DHS ``could have 
done a better job of creating a regulatory framework that does not 
increase the risk of identity theft nor enable widespread governmental 
and commercial tracking of U.S. residents.'' Several commenters 
requested that DHS provide a revised NPRM reflecting comments and that 
DHS accept at least a second round of comments before issuing a final 
rule. Other commenters asked that public advocacy groups and other 
stakeholders be consulted to ensure the final rule properly considers 
citizen rights and interests. Several commenters, including States, 
wrote that a secure identity credential could increase fraud, identity 
theft, and other forms of misuse, including the ability to access 
confidential information, and that many security leaks would occur. Two 
commenters said the Federal government has an existing program, the 
passport program, that does everything the REAL ID is supposed to 
accomplish, and that it makes sense to expand the passport program 
rather than revamping State driver's license requirements. Other 
commenters wrote that an improved system of Social Security number 
verification is a more efficient, less intrusive system for work status 
verification and driver's license eligibility.
    Response: DHS appreciates the many comments received; however, DHS 
respectfully disagrees with the comments generally opposing the REAL ID 
program. DHS believes that both DMVs and the American public will 
welcome having a more secure and reliable form of identification, and 
that DMVs will take the necessary steps to ensure that their customer 
service efforts are not degraded as a result of the regulations. DHS 
strongly disagrees with the proposition that the rules will lead to an 
increase in identity theft, harm privacy, or enable the government to 
track individuals in their daily lives. To the contrary, the rules 
create an environment where it is far less likely that an individual 
can fraudulently obtain a State-issued identity document using another 
person's identity and identity documents and minimizes the possibility 
that one individual can obtain identification documents in multiple 
names and identities. The privacy interests of driver's license and 
identification card applicants are strengthened, rather than weakened, 
since this rule requires all States to protect the personally 
identifiable information that DMVs collect from applicants. 
Establishing minimum standards for States to issue more secure licenses 
does not confer any ability on the government to monitor or track 
anyone, although it does improve the ability of the government and 
private sector parties to rely on the identity document an individual 
presents.
    DHS does not believe that additional rounds of comments on the 
requirements proposed in the NPRM are necessary before issuing this 
rule. Some 21,000 comments were filed in the docket covering the full 
range of issues. In addition, DHS hosted a town hall meeting in 
California to hear directly from the public and reconstituted the 
groups that participated in the 2005 Department of Transportation-led 
negotiated rulemaking committee in order to gather input and comments 
directly from those groups.
    DHS does not agree that a passport issued by the Department of 
State fulfills the same function as a State-issued driver's license. 
Individuals who have no intention of leaving the United States do not 
need to obtain a passport in order to enter another country or reenter 
the United States. Any of these same individuals who desire to drive 
would need to obtain a driver's license.
    DHS also disagrees with the comment that a Social Security number 
(SSN) is an adequate substitute for the statutory requirement that an 
individual have lawful status in the United States. Mere possession of 
a SSN cannot replace the statutory requirement that States verify an 
individual's lawful status in the United States. There are individuals 
who are no longer lawfully present in the United States who have SSNs.
3. Cost Considerations
    Comment: Numerous commenters questioned the anticipated costs of 
the REAL ID requirements. Specifically, commenters wrote that the costs 
of the REAL ID program would be ``huge,'' ``exorbitant,'' 
``significant,'' or ``excessive.'' Some States wrote that estimated 
costs for implementing REAL ID were equal to or substantially

[[Page 5282]]

exceeded their current operating budgets for motor vehicle licensing. 
One State estimated its costs for verification and re-verification will 
be over $100 million in the first year; another State estimated its 
costs would be $19.5 million for initial expenses and $9 million a year 
for ongoing expenses. Another commenter suggested that the burden would 
be particularly heavy on small States, which would be overwhelmed by 
the volume of queries they would receive each day from States with 
large populations and which would not have funds to improve their 
systems to handle the query volume. Commenters identified several 
features of REAL ID implementation that they believed would be the most 
costly, including verification requirements; the requirements for 
issuing driver's license and identification card renewals; background 
checks for State personnel issuing cards; the need to upgrade computer 
systems; hiring additional staff; and renegotiation of existing 
contracts.
    Response: DHS has examined both the budgetary impacts and economic 
impacts of the proposed rule and understands the significance of these 
costs for States. DHS has also reviewed various options that would 
reduce the disproportionate burden upon small states but have not found 
a feasible alternative that would provide the same benefits but at a 
lower cost.
    DHS has also reviewed many of the high-cost options of the proposed 
rule and has significantly reduced both the infrastructure costs and 
the costs of reenrollment for States. As stated in other parts of this 
document, DHS agrees with an age-based approach and concludes that 
there is a higher risk of individuals under age fifty obtaining 
fraudulent identification than there is for those over this age limit.
    Comment: Commenters wrote that DHS had overestimated the benefits 
of REAL ID and that the potential benefits did not justify the high 
cost of implementation. One commenter stated that cost estimates are 
low given that DHS has ``no clear idea of how to implement the REAL ID 
Act's dictates and has made some unrealistic calculations.''
    Response: DHS understands that the benefits of the proposed rule on 
REAL ID are difficult to quantify and that there are some imperfections 
in the methodology. Commenters stated that DHS has overestimated the 
benefits when in fact it developed a ``break-even analysis.'' DHS 
estimated that if the requirements of the proposed rule lowered by 
0.061% per year the annual probability of a terrorist attack that 
caused both immediate and longer run impacts then the quantified 
benefits of the REAL ID regulation would be positive.
    This ``break-even'' analysis was based on the rule having an impact 
on the annual probability of the U.S. experiencing 9/11 type attacks in 
the ten years following the issuance of the rule. DHS believes that the 
probability and consequences of a successful terrorist attack cannot be 
determined for the purposes of this analysis. However, it was not 
necessary to assume that there was (or is) a probability of being 
attacked in any particular year. Instead, the analysis examined the 
reduction in the probability of an attack so that the expected cost of 
REAL ID equaled the expected value of the benefits. Since it is 
extremely difficult to predict the probability and consequences of a 
hypothetical terrorist attack, DHS asked what impact would the proposed 
and final rule have to have on the annual probability of experiencing a 
9/11 type of attack in order for the final rule to have positive 
quantified net benefits. The analysis does not assume that the United 
States will necessarily experience this type of attack, but rather is 
attempting to provide the best available information to the public on 
the impacts of this rule.
    Comment: Many commenters wrote that the cost of REAL ID would be 
borne initially by the States, and then passed on to those States' 
citizens in the form of higher fees for driver's licenses, higher 
taxes, or reduced services. Commenters wrote that higher fees would be 
paid by persons who need driver's licenses but who do not fly, enter 
Federal buildings, or go into nuclear facilities. Another commenter 
wrote that citizens would incur large costs to acquire the source 
documents needed to obtain REAL ID cards. One commenter wrote that the 
costs of REAL ID would drain resources from other vital public 
services. One commenter wrote lost income would be borne by commercial 
drivers and motor carriers domiciled in non-compliant States, and that 
the costs to commercial drivers to obtain new REAL ID commercial 
drivers licenses may result in reduced trucking services to Federal 
facilities. One commenter wrote that the DHS cost estimate of $7.88 
billion over ten years would amount to a cost of $96.25 per REAL ID 
holder.
    Response: DHS acknowledges the concerns of the individuals who 
commented that this rule will impose significant costs and believes 
that a large portion of the costs will be passed on from the States to 
the States' REAL ID applicants in the form of higher fees for driver's 
licenses. But each citizen in the United States, whether he or she has 
a driver's license or not will be receiving security benefits as a 
result of this rulemaking. For example, the 9/11 Commission believes 
that acceptable forms of identification will help ensure that people 
are properly identified. The Commission's report, which informed the 
basis for the REAL ID Act of 2005 said that: ``At many entry points to 
vulnerable facilities, including gates for boarding aircraft, sources 
of identification are the last opportunity to ensure that people are 
who they say they are and to check whether they are terrorists.''
    DHS agrees that some applicants might incur added costs to acquire 
the source documents needed to obtain REAL ID cards but, overall, DHS 
has attempted to minimize the potential added costs while remaining 
true to the intent of the Act. People are being provided ample time to 
acquire any source documents that they might not have so the potential 
added costs will be lessened should they take advantage of this 
flexibility. Consequently, the added costs are expected to be small.
    With regards to commercial drivers and motor carriers domiciled in 
non-compliant States, the commenter did not provide any useful cost 
data that could be included in the regulatory analysis. This was 
probably due to the fact that it is impossible to estimate at this time 
how many states would choose to not participate.
    Comment: Several States wrote that the costs of REAL ID would 
divert money from other homeland security projects whether or not the 
States diverted a portion of the Homeland Security Grant Program 
funding, as DHS would allow them to do. States that raised the 
possibility of diverting twenty percent of their Homeland Security 
Grant funds wrote that a diversion would be impossible immediately as 
funds were already committed to other uses. One commenter called the 
use of DHS grants for REAL ID ``at best, window dressing,'' and another 
commenter called it ``an empty hole.'' An additional commenter 
identified training and equipment for rescue and first responder 
personnel as areas likely to suffer reduced funding. One commenter 
wrote that if REAL ID security measures ultimately have no effect, 
those spent dollars would have been spent more effectively in 
maintaining and strengthening proven security measures.
    Response: DHS believes that some commenters may have misunderstood 
DHS's announcement about the use of State Homeland Security Grant 
Program

[[Page 5283]]

 (SHSGP) funds for REAL ID purposes. DHS did not suggest that SHSGP 
funds would replace appropriated monies from Congress to help the 
States implement the rules and comply with the REAL ID Act. DHS and the 
Administration are continuing to work with Congress on the availability 
of additional funding to the States for these purposes.
    All homeland security funding decisions require trade-offs among 
various competing priorities given the available funding. The 9/11 
Commission Report noted that fraudulently-obtained identification is 
equivalent to a weapon in the hands of a terrorist.
4. Unfunded Mandate Reform Act
    Comment: Numerous commenters wrote that REAL ID is an unfunded 
mandate. The American Association of Motor Vehicle Administrators 
(AAMVA) wrote that past and proposed Federal budget submissions had 
fallen far short of securing necessary funding for both the Federal 
government and the States to implement REAL ID. More than twenty-seven 
States called for Federal funding of the REAL ID program. Two States 
suggested that Federal funding for REAL ID not be in the form of grants 
for which a State would have to submit applications, but rather be 
either a block grant or set-aside match for State funds. AAMVA wrote 
that because eighty percent of a SHSGP funding must be passed along to 
local governments, in fact a much smaller percentage of available DHS 
funding will be available to each State for REAL ID implementation.
    Response: As discussed elsewhere in this preamble, DHS is adopting 
a more flexible approach for States to implement the requirements of 
REAL ID, including a second extension period and age-based enrollment. 
This approach will permit States to spread out implementation costs 
over a greater period of time. Congress has appropriated $40,000,000 in 
grant funding to the States. These grants will be made available to the 
States through both categorical and competitive grants. In addition, 
States may utilize up to 20% of their SHSGP funding. This combination 
of funding, flexibility and phasing provides the relief that States and 
other commenters are seeking.
5. Privacy Concerns
    Comments: Several States and many other commenters expressed 
concerns about threats to the privacy of State residents who apply for 
REAL ID cards once the requirements are implemented. Commenters also 
expressed concern for the privacy of DMV employees who would be subject 
to background screening. Some commenters wrote that any privacy 
requirements must adhere to those of the Driver Privacy Protection Act 
and applicable State laws. Other commenters urged DHS to encourage 
States to meet agreed-upon privacy and security requirements. Another 
commenter asked that privacy and acceptable use policies address State 
DMV information systems, equipment, employees, and contractors. One 
commenter wrote that the regulations omit crucial privacy and security 
protections to the point that the proposed rule conflicts with Federal 
privacy and security principles. Several commenters were concerned 
about privacy protection for immigrants, ethnic minorities, and others 
who might be discriminated against based on use of the REAL ID.
    Response: DHS understands that commenters have many concerns that 
implementation of the REAL ID Act may impact the privacy of driver's 
license and identification card holders and their personally 
identifiable information. DHS recognizes, however, the importance of 
privacy protection and has sought to address privacy in a comprehensive 
manner. First, the final rule requires a minimum of information to be 
collected by the States to verify identity for issuance of a license or 
identification card and a minimum of information to be printed on the 
card and in the machine readable zone.
    Second, the final rule requires the States to file, as part of the 
certification process, a security plan that explains how the State will 
protect the personally identifiable information collected, stored, and 
maintained in DMV records or information systems including a privacy 
policy.
    In addition to this rulemaking, DHS intends to issue a set of 
Privacy and Security Best Practices that are built on the Fair 
Information Principles and Federal Information Security Management Act 
(FISMA) standards to help guide the States in protecting the 
information collected, stored, and maintained pursuant to the REAL ID 
Act.
    DHS plans to include the following elements in its Privacy and 
Security Best Practices: Issuing a clear and understandable privacy 
policy to each card holder; providing individual access and correction 
rights for card holders; specifying the purpose for collecting 
personally identifiable information in the privacy policy and 
limitation of the use to those purposes; limiting the information 
collected for those purposes; limiting disclosure of the information 
except to a governmental agency engaged in the performance of official 
responsibilities pertaining to law enforcement, the verification of 
personal identity, or highway and motor vehicle safety, or a third 
party as authorized under the Driver's Privacy Protection Act; 
requiring data quality standards and security safeguards to protect 
against loss or unauthorized access, destruction, misuse, modification, 
or disclosure; performing a Privacy Impact Assessment (PIA) to identify 
and analyze how personally identifiable information related to 
implementation of the REAL ID Act is collected, used, maintained, and 
protected; and establishing accountability for compliance with the 
State's privacy and security policies to ensure that these best 
practices are fully implemented.
    Finally, DHS recognizes that States will also be guided by their 
own privacy laws, which may provide greater protections and are not 
preempted by the REAL ID Act.
6. Concerns With the REAL ID Act Itself
    Comments: Many commenters wrote that the REAL ID Act has 
deficiencies that the regulatory process cannot cure. One State asked 
DHS to work with States to identify problematic statutory components 
and to seek Congressional amendments to facilitate a ``rational and 
funded approach for implementation.'' Some commenters wrote that the 
rule sets no clear minimum standards for States to follow. A commenter 
wrote that there were no hearings or Senate floor debate on the REAL ID 
Act; another commenter wrote that DHS held only one town hall meeting 
before the comment period ended. One commenter asserted that the 
development process did not recognize its tribal entitlement to 
meaningful consultation regarding the REAL ID regulations.
    Response: DHS was charged to issue regulations to implement the law 
that Congress enacted. DHS held extensive consultations with the States 
during the development of the NPRM and during the public comment 
period, and the Town Hall meeting held in California during the comment 
period was published in the Federal Register and available via the Web 
to a national audience. Over 21,000 comments were filed in the docket. 
While additional individuals may have preferred to express their 
comments orally at town hall meetings, DHS believes that the scope and 
breadth of the comments filed adequately informed DHS on the issues of 
concern to the commenters. DHS does not believe that the tribal 
consultation obligations required by Executive Order 13175 were 
triggered in this rulemaking, as this final rule will not have a

[[Page 5284]]

substantial direct effect on one or more Indian tribes and will not 
impose substantial direct compliance costs on Indian tribal 
governments. Further, tribal governments will not be substantially 
affected as tribal members are licensed through State agencies.
7. DHS Acting Outside the Scope of Its Authority
    Comment: Several commenters wrote that DHS is acting outside the 
scope of its authority, and cited several examples, including requiring 
States to conduct various document verifications, requiring States to 
implement motor vehicle facility security plans, and requiring States 
to revoke licenses collected by other States. Two States commented that 
requiring background checks for employees other than those engaged in 
manufacturing REAL ID cards was outside the scope of authority and 
interferes with employee collectively bargained rights. Several 
commenters wrote that the REAL ID Act constitutes a delegation of 
licensing authority to DHS. Another commenter wrote that Congress only 
intended to exclude illegal aliens from eligibility to obtain a REAL 
ID.
    Response: The REAL ID Act provides the Secretary of Homeland 
Security with authority to issue regulations necessary to implement the 
requirements of the Act. DHS understands that there is a balance 
between Executive discretion in interpreting the REAL ID Act through 
regulation, while also respecting the State's autonomy to govern an 
inherently State function--the driver's license issuance process. DHS 
has attempted to preserve State autonomy wherever possible, while 
remaining consistent with the Act, and believes these regulations 
represent a logical interpretation of the Act and Congressional intent.
8. Constitutional Concerns
    Comment: Several commenters wrote that requiring a REAL ID for 
access to Federal courts may raise Constitutional issues for litigants, 
jurors, attorneys, witnesses, media, and the public. Another commenter 
wrote that requiring REAL ID for accessing Federal ports will have 
consequences for intrastate licensees attempting to conduct business.
    Response: DHS does not believe that the REAL ID Act or the 
implementing regulations will impede the public's Constitutional 
rights. Once REAL ID is in effect, an individual presenting a driver's 
license to access a Federal courthouse must use a REAL ID driver's 
license to do so. However, that individual may present other documents, 
or may not be required to present identification at all, depending on 
the courthouse's pre-existing identification policies.
    Comment: Several commenters wrote that the REAL ID rules would 
impermissibly commandeer and coerce State governments in service of a 
Federal objective and would prohibit Congress from exercising its 
Commerce Clause powers. One commenter wrote that courts have long 
recognized that licensing of drivers is a traditional State police, 
health, and safety function, and under the Tenth Amendment, such State 
authority generally is not subject to encroachment by the Federal 
government.
    Response: DHS recognizes both the important national interest in 
secure identity documents and the Federalism implications of the 
policies which underpin this rule. Accordingly, DHS has welcomed and 
encouraged State participation in this process and, where possible, 
drafted these rules in such a way as to maximize State discretion. 
Where the exigencies of national security and the need to prevent 
identity fraud have militated in favor of a uniform national standard 
(e.g., baseline security features on identity cards and background 
check requirements), DHS has, as reflected above, consulted with States 
in order to ensure that the uniform standards prescribed could be 
attained by the States and would reflect the accumulated security 
experience of State motor vehicles administrations.
    Comment: Some commenters wrote that the REAL ID Act and regulations 
violate the Constitutional right to travel freely from one State to 
another by denying citizens in non-compliant States the right to board 
any plane, interstate bus, or Amtrak train. Other commenters wrote that 
government initiatives conditioning the ability to travel upon the 
``surrender of privacy rights'' require particular scrutiny. One 
commenter wrote that the situation is acute for residents of Hawaii or 
Alaska who often have no choice but to travel via Federally-regulated 
modes of travel.
    Response: DHS does not agree that the REAL ID Act will hinder 
individuals' rights to interstate travel. The REAL ID Act states that a 
Federal agency may not accept State driver's licenses or identification 
cards for official purposes unless a State is meeting the requirements 
of the Act. At this time, the definition of ``official purposes'' 
includes boarding Federally-regulated commercial aircraft; no other 
form of transportation is included. Moreover, travelers will be able to 
use identification other than a REAL ID driver's license to board an 
aircraft. While Federally-regulated commercial aircraft are a mode of 
transportation, the Act only prohibit Federal agencies from accepting a 
non-REAL ID license or card where a State-issued driver's license is 
presented by the individual. Where individuals are allowed to board 
aircraft or enter Federal facilities with documents other than a State-
issued driver's license or identification (such as a passport or 
military identification card), neither the Act nor these rules change 
those processes and procedures. Further, an individual with a State-
issued non-compliant driver's license or identification card may travel 
interstate or intrastate in a commercial motor carrier, Amtrak train, 
ship, individual automobile, or any other mode of transport aside from 
Federally-regulated commercial aircraft. These transportation options 
illustrate that individuals' rights to travel are not substantially 
impeded.
    Comment: Several commenters and States expressed concern with a 
State's lack of authority to request or demand that other jurisdictions 
correct erroneous records about individuals and that there is no easily 
available process for resolving errors. A number of commenters wrote 
that the lack of a process for correcting errors in the REAL ID Act 
violates both procedural and substantive due process under the Fifth 
and Fourteenth Amendments. One commenter expressed concern with the 
requirements that licensing authorities maintain for ten years the name 
and photograph of individuals denied licenses because of suspicion of 
attempting to obtain a fraudulent license.
    Response: DHS recognizes that the provision of redress is an 
important element of any credentialing program. Applicants need a 
process by which they can access their records, correct errors, and 
obtain due process if denied a card. States already provide such a 
redress process for driver's license applicants. Generally, State DMVs 
direct applicants to the appropriate Federal agency, SSA, to resolve 
SSN verification issues or to USCIS to resolve immigration status 
verification issues. SSA and USCIS have redress programs in place to 
assist individuals whose records are incomplete or inaccurate. State-
to-State record checks are also done routinely, and when an applicant 
needs to access his or her out-of-State DMV record, the applicant must 
make the request directly to the State DMV. DHS will work with the 
States to inform the public of their ability to access and correct DMV 
records as well as records

[[Page 5285]]

held in the various Federal data verification systems used to implement 
this rule.
    The ten-year retention period proposed in the NPRM for the 
photograph and identity of individuals denied a license has been 
reduced in the final rule to five years. This limited retention is 
necessary to enable State DMVs to reduce the incidence of individuals 
who shop among DMVs until one issues a license.
    Comment: Three commenters wrote that there is no due process in 
instructing DMVs to refer an applicant to the local USCIS office when 
there is a non-match through SAVE. There may be no local USCIS office, 
and a non-citizen has no straightforward route to review and correct 
their records and USCIS lacks jurisdiction to correct errors made by 
different immigration agencies. One commenter wrote that only through 
the FOIA process can an immigrant gain access to his or her immigration 
records, and that tens of thousands of FOIA requests are currently 
pending.
    Response: DHS disagrees that there is a lack of effective due 
process or redress when there is a non-match through SAVE. An 
individual who believes that information about him or her in SAVE is 
inaccurate, can schedule an appointment online with USCIS at 
www.uscis.gov and be assigned an appointment at the appropriate USCIS 
office based on the individual's residential zip code. These 
appointments afford an opportunity to meet with an Immigration Officer 
face-to-face to resolve any non-asylum related issues relating to a 
current or pending immigration case. Minimal information, including an 
Alien Registration Number or Receipt Number is required to schedule an 
appointment.
    Comment: Several commenters wrote that REAL ID has the potential 
for fostering discrimination, particularly against non-citizens. One 
commenter urged DHS to ensure REAL ID-compliant cards are all accepted 
equally, without ``geographic discrimination.'' One commenter wrote 
that REAL ID will cause discrimination against U.S. citizens who 
``look'' or ``sound'' foreign. This commenter wrote that DMV employees 
must make subtle judgments about who is a citizen. Another commenter 
wrote that non-citizens and foreign nationals who are in the United 
States for work or study will be singled out and that renewing a 
document will be difficult because DMV employees will not understand 
the complexities of immigration law. One commenter urged DHS to 
promulgate rules prohibiting discriminatory behavior and creating 
penalties for DMV staff who discriminate against individuals.
    Response: DHS believes that the States will take adequate measures 
to prevent discrimination and is unable to create private rights of 
action for the behavior of DMV employees. DHS disagrees that citizens 
will be treated differently based on their ``looks'' or ``sounds'' 
since all persons seeking to obtain a REAL ID-compliant driver's 
license or identification card have to establish their identity, date 
of birth, and lawful status in the United States. Furthermore, State 
DMVs already work with immigration documents and questions of 
citizenship and immigration status under their applicable State laws 
and have developed increasing familiarity with this subject already, 
without evidence of discriminatory practices in so doing.
9. REAL ID Will Not Make the Nation Safer
    Comment: Commenters wrote that terrorist intentions cannot be 
predicted based on identification and that REAL ID will not prevent 
determined bad actors from using a compliant REAL ID to gain access to 
Federal buildings, nuclear facilities, and aircraft. A number of 
commenters wrote that it is not clear whether REAL ID will enhance the 
nation's security or create new opportunities for those seeking to 
exploit the nation's security. Commenters also wrote that 
centralization of personal data would create a greater security risk 
and may raise demand and value of a counterfeit document. Some 
commenters wrote that the proposed regulations would not have prevented 
the 9/11 terror attacks since all but one of the hijackers could still 
have obtained a State driver's license. One commenter said that REAL ID 
is predicated on a flawed belief that only ``outsiders'' intend to harm 
the United States, yet U.S. citizen ``insiders'' have committed 
terrorist acts.
    Response: The commenters are correct that the REAL ID rules cannot 
completely eliminate the possibility that an individual will commit an 
act of terrorism inside the United States. However, by improving the 
security and reliability of State-issued identification documents, the 
rules substantially increase the ability of the government and law 
enforcement to identify with greater accuracy an individual at a check 
point or screening opportunity. Furthermore, the rules minimize the 
possibility of an individual possessing multiple documents, as some of 
the 9/11 terrorists did. The 9/11 Commission and Congress have 
concluded that this ability may prevent or deter future acts of 
terrorism.
    It is incorrect to assume that the REAL ID rules could have had no 
impact on the 9/11 terror attack. As described in great detail in the 
9/11 Commission Report, the ability of the terrorists to easily obtain 
multiple, legitimate identity documents facilitated their ability to 
move about the country and to board the ill-fated aircraft with minimal 
scrutiny. Under this final rule, it will be significantly more 
difficult for an individual to use a false name or provide fraudulent 
documents to obtain an identification that can be used for purposes of 
boarding a commercial airplane. Therefore, the final rule makes it less 
likely that a terrorist could circumvent watch-list screening processes 
and security procedures (as upgraded or developed post-9/11) and board 
a commercial airplane.
    Further, several of the terrorists no longer had lawful status in 
the United States. Under the REAL ID Act and this final rule, those 
individuals would now be unable to obtain REAL ID driver's licenses or 
would only obtain a temporary driver's license that clearly indicates 
on its face an expiration date tied to the expiration of the holder's 
status.
10. REAL ID Will Result in Persons Driving Without Licenses and Auto 
Insurance
    Comment: Several commenters wrote that REAL ID, and the weeks it 
can take to collect documents needed to replace lost or stolen 
licenses, would result in illegal immigrants driving without a license 
and auto insurance, and this would present health and safety risks on 
the roadways.
    Response: DHS does not believe that the implementation of the REAL 
ID requirements will result in persons, particularly illegal aliens, 
driving without a license and auto insurance any more than may already 
be occurring. Most States already require the collection and submission 
of particular documents in order to replace lost and stolen licenses.
11. REAL ID Will Place a Heavy Burden on State DMVs
    Comment: Many States and AAMVA wrote that if States are to maintain 
their present levels of service while incorporating REAL ID, they will 
need to hire additional employees, increase service hours, expand or 
increase facilities to accommodate customer volume, purchase additional 
equipment to support personnel, create and implement public education 
campaigns

[[Page 5286]]

to inform customers, and anticipate and handle increases in customer 
inquiries. The commenters recommended several DHS actions, including 
coordinating between DHS and DOT's Federal Motor Carrier Safety 
Administration (FMCSA) to reassess their approach to funding REAL ID 
requirements; prohibiting Federal agencies from charging transaction 
fees for verification; coordinating among DMVs, the National 
Association for Public Health Statistics and Information Systems 
(NAPHSIS), and State vital record agencies to provide reliable data and 
acceptable fees; requiring States to employ electronic verification 
systems only as they become available; and consolidating and 
synchronizing system development schedules. Other commenters 
recommended changes to the enrollment and renewal processes, including 
allowing for waivers of verification requirements for certain 
categories of persons whose identification had already been vetted by 
the Federal government, allowing transfers of authorization from State 
to State of persons with valid REAL ID identification cards, and 
exempting certain segments of the population from REAL ID requirements.
    Response: Based on these comments, DHS is taking several measures 
to reduce the impact of the rule. First, States meeting specific DHS 
benchmarks for progress toward REAL ID compliance will qualify for 
additional extensions until no later than May 10, 2011. Second, DHS is 
adopting an age-based approach to REAL ID implementation. The rule 
requires individuals born after December 1, 1964 to enroll and receive 
REAL ID cards prior to December 1, 2014, in order for those cards to be 
accepted for official purposes. Individuals aged fifty or older on 
December 1, 2014 will not be required to enroll until December 1, 2017. 
After December 1, 2017, all individuals will have to possess REAL ID 
cards in order for those cards to be accepted for official purposes. 
This timeline will substantially reduce the impact of REAL ID on DMV 
operations and budgets.
    Comment: Many States and commenters wrote that REAL ID will 
significantly increase service times at DMVs, resulting in a 
degradation of service. AAMVA estimated that DMV workloads will 
increase by 132 percent and that transaction times for license renewals 
will double. One commenter wrote that central issuance would impose 
considerable burdens on citizens of rural, low-density states. Several 
States wrote that the inability to use the Internet would impose a 
significant burden on DMV operations; one State wrote that the 
elimination of telephone and mail-in address changes would force 
approximately 400,000 additional persons into its DMV offices. 
Commenters also wrote that State DMVs will be required to add new 
staffing and infrastructure and, at the same time, replace or 
reconfigure their existing offices. States commented that hundreds of 
new employees will need to be hired and new costs incurred to obtain 
fingerprinting and background and financial checks of DMV staff. A few 
States noted that they will have to renegotiate contracts for services 
such as card printing or purchase new printers.
    Response: DHS understands the commenters' concerns and agrees that 
forcing the entire driver's license and identification card holder 
population into a compressed timeframe would likely result in increased 
DMV service times and a general degradation of services. The final rule 
permits, for example, additional time for enrollment, remote license 
transaction processing, and eliminates the necessity of in-person DMV 
visits for address changes. Further, there is no requirement for 
financial background checks or central issuance of licenses, although a 
number of States have adopted central issuance as a best practice.
    Comment: Several commenters wrote that State DMV officials will 
require extensive training in recognizing the many types of immigration 
documents and statuses that applicants may present. One commenter wrote 
that REAL ID would change State DMVs ``into a wide-ranging enforcement 
agent of the Federal government in areas from immigration rules to 
Social Security fraud.'' Commenters also wrote that State DMVs will be 
required to add new staffing and infrastructure and, at the same time, 
replace or reconfigure their existing offices. A few States noted that 
they will have to renegotiate contracts for services such as card 
printing or purchase new printers.
    Response: DHS disagrees that the REAL ID Act or its implementing 
rules would result in DMV employees acting as enforcement agents. The 
rules require that the DMV issue compliant licenses only to individuals 
lawfully present in the United States and whose Social Security Number 
can be verified with the Social Security Administration. DHS also 
believes that the rules simplify the handling of immigration-related 
issues, which DHS concedes is a very complicated area. DMV officials 
are required to verify a non-citizen's lawful status with DHS. The SAVE 
system administered by USCIS permits DMVs ``one stop shopping'' to 
verify an individual's lawful status in the United States. Furthermore, 
many States provide extensive document training to their personnel to 
assist in identification and authentication of valid documents. 
Furthermore, State DMVs already work with immigration documents and 
questions of immigration status under their applicable State laws and 
have developed increasing familiarity with this subject.
    Comment: Commenters wrote that State DMVs will be required to 
undertake other activities that they do not currently perform. One 
State wrote that by some State laws, driver's licenses and State ID 
cards are issued by two separate government agencies. Several States 
said they would need to acquire new or enhanced records management 
systems. Other States wrote that they will have to physically rearrange 
their facilities to comply with the REAL ID requirement to maintain a 
photo of everyone who applied for a license.
    Response: While there may be activities DMVs may now need to 
perform in order to issue more secure driver's licenses and 
identification cards under REAL ID, Congress determined that these 
activities are necessary in order to ensure more secure and reliable 
forms of identification. Understanding that these new functions may 
cause strain on some DMV facilities, the final rule provides 
flexibility and additional time for states to implement these 
activities.
12. Those Without Access to Required Documents
    Comment: Several commenters wrote that REAL ID would impose 
significant burdens on low-income individuals in the form of 
significantly higher fees for licenses and ID cards, higher additional 
costs to obtain necessary underlying documents, and extra time from 
work, potentially involving lost wages, to apply for REAL ID cards. One 
commenter wrote that a consequence of these burdens could be a likely 
increase in counterfeited ID cards and large numbers of individuals who 
lack Federally-compliant identification. Several commenters stated that 
certain groups would be unfairly affected by the requirement to produce 
certain documents, including foreign nationals, Native Americans, 
domestic violence victims, the homeless, the elderly, and military 
personnel. In addition, commenters described circumstances that could 
impede individuals' access to required documents, such as natural 
disasters.
    Response: DHS believes that the REAL ID Act does not have a

[[Page 5287]]

disproportionate impact on certain groups. There is no evidence that 
many of these groups lack the documents required to establish an 
individual's name, date of birth, SSN, and lawful status. Should States 
determine that the economically disadvantaged individuals are 
experiencing a hardship in obtaining the necessary documents or cannot 
afford the license fee established by the State, nothing in the rule 
precludes a State from offering the driver's license or identification 
card or copy of a birth certificate at a reduced cost or waiving the 
fee altogether. In addition, the final rule enables States to establish 
an exceptions process for a variety of situations and circumstances, 
including circumstances where a particular suite of documents are 
unavailable following a natural disaster.
13. REAL ID Will Be a Burden to End-Users
    Comment: Two commenters wrote that the responsibility for 
validating REAL ID cards is a government function and should not be 
delegated to air carriers. Instead, DHS should provide ``readers,'' 
similar to those used by Immigration and Customs Enforcement, for use 
at airports. Two commenters requested the rule make clear that the 
current option regarding individuals submitting to a more extensive 
physical search rather than showing ID before passing through airport 
security will not be affected by the REAL ID Act.
    Response: Neither the NPRM nor this final rule govern what 
documents should be accepted or procedures followed at airports and 
Federal facilities when an individual is unable to present a REAL ID-
compliant document as his or her form of identification. DHS does not 
agree with the comment that validating a REAL ID is exclusively a 
government function, and believes that a wide variety of entities would 
want to validate a REAL ID document before accepting it as a valid form 
of identification.
    Comment: Another commenter asked how end-users could continue 
routine functions if, after 2013, State-issued driver's licenses do not 
meet REAL ID standards, since REAL ID would be required for access to 
nuclear facilities. If a State is not in compliance or elects not to 
participate in the REAL ID program, access by persons with licenses 
from those States would be prohibited, and the ability of the plants to 
function could be seriously impaired. A commenter mentioned that an 
access authorization program supervised by the Nuclear Regulatory 
Commission is already in place. One commenter wrote that while 
commercial nuclear power plants are licensed by the NRC, they are 
privately owned and operated and security is the responsibility of the 
owner/operator, not the Federal government; therefore, they should be 
exempted from the final rule requirements.
    Response: Since the REAL ID Act specifically included access to a 
nuclear facility as an example of an ``official purpose,'' DHS cannot 
simply exempt nuclear power plants from the scope of the rules. DHS 
agrees with the commenter that access authorization programs supervised 
by the Nuclear Regulatory Commission may provide sufficient safeguards 
concerning access to nuclear facilities. The NRC-supervised programs 
may set forth alternative procedures or acceptable forms of 
identification for persons seeking access to a nuclear facility; 
however, if an individual is presenting a driver's license or State-
issued identification card, it must be REAL ID-compliant pursuant to 
the REAL ID Act.
    Comment: One commenter expressed concern about the impact of REAL 
ID on commercial truck drivers, and suggested that drivers without REAL 
ID identification cards would be far less valuable to carriers. One 
commenter wrote that motor carriers domiciled in non-compliant States 
would be at a severe disadvantage in finding drivers, and commercial 
drivers themselves will have to absorb the additional costs of REAL ID, 
including increased fees to obtain licenses and lost income.
    Response: Any additional fees that DMVs may charge to obtain a REAL 
ID document will not fall disproportionately on commercial drivers. 
Nothing in the rules precludes companies employing commercial drivers 
from subsidizing the costs incurred by the drivers they employ. 
Furthermore, a REAL ID driver's license is not the sole document a 
commercial driver could use to access a Federal facility. Since a 
Federal facility may accept other forms of identification or establish 
alternative procedures to admit individuals with non-compliant licenses 
to Federal facilities, DHS does not believe that commercial driver's 
license holders will be disadvantaged by living in a State that chooses 
not to comply with the REAL ID requirements.

B. Scope, Applicability, and Definitions

    Comment: Two State commenters and the AAMVA requested clarification 
of the terms verification, authentication, and validation. Two 
commenters asked for a clear definition of the term ``Federal 
facility.'' One commenter wrote that it is a statutory requirement to 
consult with the U.S. Department of Transportation in developing new 
definitions for driver licensing terms. Commenters also requested 
clarification regarding what age individuals will be required to obtain 
a REAL ID. It was suggested that the age requirement should be 
consistent with the age airlines require passengers to have their own 
identification documents. One commenter expressed the need to inform 
the public, in detail, how individuals will be impacted by not 
obtaining a REAL ID.
    Response: DHS agrees that the term ``verification'' should be 
clarified. The final rule defines ``verify'' to include two processes: 
Ensuring that the source document is genuine and has not been altered 
and that the identity data contained on the document are valid.
    DHS does not believe that the term Federal facility needs further 
definition and cannot predict how individuals without a REAL ID-
compliant driver's license or identification card (either through their 
own choice or because a State does not issue compliant documents) will 
be impacted. DHS notes that individuals without a REAL ID-compliant 
document will still be able to enter Federal facilities and board 
commercial aircraft, and these rules cannot determine what alternative 
documents are acceptable for those purposes. DHS believes that each 
State can determine the appropriate minimum age to issue a REAL ID-
compliant driver's license or identification card to its residents and 
does not believe that a single Federal standard is necessary in this 
area.
1. Definition of ``Official Purpose''
    Comment: Two States wrote that since many Federal areas require 
identification, all ``official purposes'' must be clearly stated in the 
rule so that States can make informed decisions on whether to be REAL 
ID-compliant based upon the impact on the State budget versus the 
negative convenience impact on its citizens. Numerous commenters wrote 
that the definition of ``official purpose'' captures the requirements 
of the REAL ID Act and they are opposed to expanding the definition. 
Commenters stated that, should DHS decide on expanding the definition 
of ``official purpose,'' it should not be done without an open comment 
period. One commenter wrote that DHS has arbitrarily chosen to restrict 
the required presentment of REAL ID-compliant documents to a much 
smaller set of official uses than was contemplated by Congress, and 
this contradicts and undermines DHS's statutory mandate to enforce 
Federal immigration law. One State suggested that DHS create a list of

[[Page 5288]]

applicable Federal facilities. One commenter voiced concern over 
possible expansion of the definition to include Federally licensed 
firearms dealers and that residents of non-compliant States could be 
blocked from purchasing firearms. One commenter encouraged DHS to 
consider all the ways in which REAL ID could be used and not limit it 
to boarding of Federally-regulated commercial aircrafts, entering of 
Federal facilities, and nuclear power plants.
    Response: DHS agrees with those commenters who noted that the 
proposed definition of ``official purpose'' is consistent with 
Congressional intent. DHS is neither expanding nor limiting the 
definition further in this rule. DHS will continue to consider 
additional ways in which a REAL ID license can or should be used and 
will implement any changes to the definition of ``official purpose'' or 
determinations regarding additional uses for REAL ID consistent with 
applicable laws and regulatory requirements. DHS does not agree that it 
must seek the approval of Congress as a prerequisite to changing the 
definition in the future (except of course to remove one of the three 
statutorily-mandated official purposes) as Sec.  201(3) of the Act 
gives discretion to the Secretary of Homeland Security to determine 
other purposes.
    DHS does not intend that a REAL ID document become a de facto 
national ID based on the actions of others outside of DHS to limit 
the99ir acceptance of an identity document to a REAL ID-compliant 
driver's license or identification card.
    Comment: Commenters proposed other acceptable documents, including 
over-the-counter interim identification cards and tribal identification 
documents that should be accepted for official purposes. Another State 
noted that Canadian citizens drive to the United States and fly out of 
local airports and that it would benefit them economically to accept 
Canadian passports as identification cards for Federal purposes. AAMVA 
wrote that for States choosing not to comply with REAL ID, an alternate 
form of identification is essential to ensure that commercial carriers 
and drivers who deliver to Federal facilities continue to have 
unimpeded access to these facilities and that interstate commerce is 
not impeded. One commenter wrote that tribal ID issues must be 
incorporated into the regulation at the outset. One commenter wrote 
that DHS's disallowing of Transportation Worker Identification 
Credential (TWIC) as an alternative to a REAL ID document because of 
``slow progress'' in implementing the TWIC program will be invalid if 
DHS extends REAL ID implementation. The commenter suggests permitting 
use of TWIC because like REAL ID, TWIC also is a Federally-vetted 
identification card.
    Response: As noted in other responses, the REAL ID rule does not 
control what other, if any, alternative documents can be accepted by 
Federal agencies where an individual seeks to present an identification 
document other than a State-issued driver's license or identification 
card (which, under the Act and this final rule, must be REAL ID-
compliant).
2. Other Definitions
    Comment: One State asked for several amendments to the rule 
definitions. Specifically, the State asked that ``ability to affect'' 
be clarified to mean ``direct ability to affect''; that digital 
photograph should read as ``a digitally printed color reproduction of 
the face of the holder of the license or ID card''; that a definition 
be added for foreign passports; clarification that providing a foreign 
passport with a valid visa is an acceptable document for validating a 
REAL ID; clarification that ``principal residence'' is not a residency 
requirement, but merely defines principal address; and clarification 
that Secretary means ``Secretary of the U.S. Department of Homeland 
Security.'' AAMVA suggested that the term ``reissued'' be amended to 
include ``only when material changes are required such as name 
changes.''
    Response: DHS agrees that the term ``principal residence'' needs 
additional clarification and has defined the term in the rule to mean 
the location where a person is currently domiciled (i.e., presently 
resides even if at a temporary address) in conformance with the 
residency requirements of the State of domicile, if such requirements 
exist. DHS agrees with the comment regarding material changes and the 
rule now states that a State may conduct a remote reissuance if State 
procedures permit as long as there has been no material change in the 
applicant's information since prior issuance. DHS believes that the 
definitions of ``ability to affect'' and ``foreign passport'' do not 
need further clarification. DHS decided against the proposed definition 
of ``digital photograph'' since certain high-security features work 
best with a black and white photograph and DHS does not want to 
preclude States from using such technology to secure their licenses.

C. Compliance Period

    Comment: Many commenters, including at least twenty States and 
AAMVA, wrote that the compliance period is too short and is impossible 
to meet. Specific reasons cited for why the compliance period is too 
short included the following: The compliance deadline fails to take 
into account the States' cycles for valid driver's licenses and 
identifications; systems that DMVs must use to verify documents under 
REAL ID either do not exist or are not operational; the compliance 
deadline compels States to take on the unfunded expenses of hiring and 
training more staff and making significant infrastructure changes, 
waiting times for customers at DMVs will increase, the compliance 
deadline reflects a failure to understand how State legislatures work 
and how complex the process is for issuing State driver's licenses and 
identification cards, and compliance deadline leaves insufficient time 
for States to appropriate funds for the cost of implementing REAL ID. 
Commenters also wrote that States have no incentive for requesting such 
extensions, and several State legislatures have declined to even 
attempt compliance with the Act or the rule.
    Response: DHS agrees with the commenters that States would be 
unable to fulfill the entire range of REAL ID regulatory requirements 
by May 11, 2008. Therefore, DHS is taking several measures to reduce 
the impact of the rule. First, States meeting specific DHS benchmarks 
for progress toward REAL ID compliance will be granted additional 
extensions until no later than May 10, 2011. Second, DHS is adopting an 
age-based approach to REAL ID enrollment and will only require 
individuals born after December 1, 1964 to enroll by December 1, 2014, 
in order to receive cards acceptable for official purposes on December 
1, 2014. Thus, individuals aged fifty or older on December 1, 2014, 
will not be required to be enrolled until December 1, 2017. These 
measures will substantially reduce the impact of REAL ID enrollment on 
DMV operations and budgets.
    DHS has chosen this approach as the most effective and expeditious 
way to achieve the purposes of the Act. DHS believes that this approach 
balances the strong national security objective of improving the 
reliability of identification documents presented for official 
purposes, including the boarding of commercial aircraft, with the needs 
of the States to spread out their compliance costs over a greater 
period of time and to obtain the

[[Page 5289]]

necessary legal and budgetary approval from within their State to 
comply with the regulations.
    Comment: Many commenters and States did not agree on the proposed 
compliance period and suggested additional ideas, from basing the 
compliance period on the natural license expiration date to extending 
compliance through 2018. Two commenters wrote that a six-month planning 
deadline after possible publication of a final rule is unrealistic, and 
once there are operational systems available to all jurisdictions for 
implementing REAL ID, States should have at least one year to connect 
to those systems before issuing compliant cards. Other commenters 
suggested delaying the full implementation date by some other term of 
years commensurate with State driver's license renewal periods. Another 
commenter wrote that State legislatures need two years after issuance 
of a final rule to enact enabling legislation. One State suggested a 
four-year compliance delay, as the State has a lack of funding; other 
States proposed a delay of five years following final rule publication 
because those States will not complete legislation and budget actions 
before that time. One commenter wrote that the compliance date would 
result in every State requesting a waiver and compressing the 
enrollment process from five years to something less. AAMVA suggested a 
ten-year compliance period, to 2018, and also recommended that DHS 
avoid setting the implementation period until there are systems for 
verification accessible in all jurisdictions.
    Response: As noted above, DHS agrees that the compliance date 
should be extended and therefore has extended the enrollment deadline 
to December 1, 2014, for drivers after December 1, 1964 (that is, under 
age fifty), and to December 1, 2017 for all other drivers as described 
above.
    Comment: Commenters wrote that DHS should permit States to 
grandfather into REAL ID compliance those individuals who have held a 
driver's license for ten years. Another commenter wrote that DHS should 
give States the flexibility to delay re-verifying certain populations 
so that States maximize their resources and avoid severe service 
disruptions. Where a State can verify customer data before issuing a 
license or identification document, DHS should permit States to use 
``alternative renewal processes'' during the REAL ID enrollment period. 
Another commenter wrote that a State should be able to waive 
verification requirements for members of the military, Federal 
employees, and passport holders who already have been through a Federal 
vetting process. Another commenter proposed grandfathering in any State 
that can demonstrate that its process for issuing driver's licenses or 
identification documents is similar to REAL ID.
    Response: The REAL ID Act does not authorize Federal agencies to 
accept non-compliant cards from specific age groups or other 
populations through a grandfather clause. DHS, as discussed above, 
recognizes the operational burden on States if they were required to 
reenroll all licensed drivers by the initial proposed enrollment date 
of May 2013. DHS has determined, based on comments received requesting 
deferments or exemptions for populations based on age and a statistical 
analysis of TSA incident report data, that an age-based enrollment 
would provide States with the most reasonable implementation options.
    DHS has determined that, based on TSA incident report data it has 
reviewed, that a logical dividing point for age-based enrollment would 
be fifty years of age. As a result, the rule requires the States to 
focus first on individuals born after December 1, 1964, when issuing 
REAL ID cards. These individuals will be under fifty years of age on 
December 1, 2014. DHS has determined that deferring the REAL ID 
enrollment requirements until December 1, 2017, for those individuals 
born on or before December 1, 1964, will relieve the States of some 
operational burden associated with re-licensing their license holders. 
This provision will enable States to extend the enrollment of this 
lower-risk population until December 1, 2017.
    This approach is based on a review of several data sets that 
correlated age and the propensity to commit a terrorist act and age and 
the likelihood to commit a criminal act.
    Depending on the specific data set examined, different age cutoffs 
starting at the age of thirty-five would be appropriate for the REAL ID 
final rule. Of the several data sets that were examined, the best data 
set is one from TSA, because it is the only one that shows a 
correlation between activities occurring within TSA's purviews, an 
incident resulting in a arrest, the age of the individual and the use 
of a fraudulent identification.
    For this final rule, data was collected and analyzed on the total 
number of TSA incidents involving the use of fraudulent identification 
representing the time period from October 1, 2004 through July 25, 
2007. The data was then sorted and those potential incidents involving 
the use of a fraudulent identification (using the key words fraud, 
false, fake, and ID) were extracted. Each incident report was read and 
those incidents that were not germane to the REAL ID rulemaking were 
purged. Finally, DHS, using both the raw data as well as the calculated 
rates (based on the number of individuals flying), grouped the 
incidents into different age groups. The results were a data set that 
correlated one of the primary requirements of this rulemaking (the need 
to present an appropriate identification prior to boarding an airplane) 
to the use of a fraudulent identification by the age of an individual.
    A total of 98 incidents of where an individual was arrested that 
involved the use of a fraudulent identification was included in this 
group. The age of the individuals arrested was available for 86 of the 
arrests. The weighted mean age of an individual arrested was 32 years 
of age with a standard deviation of 8.95 years. This means that about 
two-thirds of those individuals who were involved in an incident where 
an arrest occurred were between the ages of 23 and 41. About ninety-
five percent were between the ages of 14 and 50.
    Using this data, DHS estimated the percentage of individuals who 
would be prevented from using a fraudulent identification (as a result 
of the REAL ID rule) for the age cutoffs 41, 45.5, and 50. Based upon a 
normal distribution, 66.7% of all individuals using a fraudulent 
identification would be between the ages of 23 and 41 (1 standard 
deviation) and 95% of all individuals would be between the ages of 41 
and 50. These statistics were then used to estimate the risks 
associated with the age cutoffs of 41, 45.5, and 50. An age cutoff of 
41 would allow DHS to potentially prevent the likelihood of 83% of all 
individuals from using a fraudulent identification. But as a means of 
providing additional national security, the final REAL ID rule would 
not have prevented 17% of the individuals from using a fraudulent 
identification.
    With a cutoff of age 50, DHS would potentially prevent the 
likelihood of 97% of all individuals from using fraudulent 
identification. But as a means of providing additional national 
security, the final REAL ID rule would not have prevented 3% of the 
individuals from using a fraudulent identification. Since the age 
cutoff 45.5 is the midpoint of the ages 50 and 41, DHS estimated the 
likelihood that REAL ID would prevent the use of a fraudulent 
identification, by using the averages for

[[Page 5290]]

the age cutoffs 50 and 41 and found that an age cutoff of 45.5 would 
prevent the likelihood of 90% of all individuals from using a 
fraudulent identification. But as a means of providing additional 
national security, the final REAL ID rule would not have potentially 
prevented 10% of the individuals from using a fraudulent identification 
(See Table Below).

          Table 1.--Risks Associated With Different Age Cutoffs
------------------------------------------------------------------------
               Risks associated with different age cutoffs
-------------------------------------------------------------------------
                                                              Potential
                                                 Potential    percentage
                                                 percentage   number of
                  Age cutoff                     number of    incidents
                                                 incidents       not
                                                 prevented    prevented
                                                    (%)          (%)
------------------------------------------------------------------------
41............................................           83           17
45.5..........................................           90           10
50............................................           97            3
------------------------------------------------------------------------

    The TSA data was analyzed even further by stratifying the universe 
of these 86 arrests into three categories. The categories are (1) 
Arrests where a fraudulent identification was discovered, but the 
fraudulent identification was not the reason that the individual became 
a suspect; (2) arrests where the individual was a TSA Selectee and 
during the process, a fraudulent identification was discovered; and (3) 
arrests where the individual became a suspect because of his/her use of 
that identification and the use of a fraudulent identification was the 
cause for the arrest. Because DHS was not able to determine a priori 
the characteristics of the population as a whole as to who uses a fake 
identification and who does not (in order to determine an appropriate 
age cutoff), the best that can be done is to examine the ages of those 
who were arrested when the use of a fraudulent identification was the 
cause of the arrest and compare that population to those who were 
arrested where a fraudulent identification was discovered at the time 
of the arrest but the fraudulent identification was not the reason to 
suspect the individual. The results show that the means of each 
population are not statistically different from each other. In other 
words, we cannot say that the samples are from different populations 
and we accept the null hypothesis.
    Comment: One commenter wrote that the waiver process by which a 
State may request an extension of the compliance deadline to December 
31, 2009 is acceptable, as it gives States the time they need to plan, 
budget, and implement the regulations. Another commenter wrote that 
compliance related to the verification of lawful status of aliens could 
be implemented by all 56 states and territories by the May 11, 2008 
deadline, and that there is no rational basis to extend the specific 
deadline for SAVE compliance. One commenter wrote that DHS should 
institute a formal safe harbor so that a State may be deemed compliant 
if it is making reasonable progress toward implementing REAL ID. One 
commenter wrote that when there is a legitimate reason to grant an 
extension for one State, it should apply to all states. Another 
commenter wrote that a State's request for an extension should be 
deemed justified in the absence of extraordinary circumstances. One 
commenter wrote that DHS has demonstrated flexibility by allowing 
States to delay implementation and creating a petition process for 
States needing more time, and the commenter encouraged DHS to continue 
collaborating so that States have the necessary flexibility to comply 
with the law.
    Response: Although the above comments indicated that certain 
aspects of the proposed rule do not require an extended compliance 
period, all the commenters observed that States would be unable to meet 
the overall compliance deadline proposed in the NPRM. As noted earlier 
in this preamble, in addition to the extension proposed in the NPRM 
through December 31, 2009, DHS is allowing a second extension request 
valid until no later than May 10, 2011.
    Also as noted earlier in this preamble, DHS has chosen this 
approach as the most effective and expeditious way to achieve the 
purposes of the Act. DHS believes that this approach balances the 
strong national security objective of improving the reliability of 
identification documents presented for official purposes, including the 
boarding of commercial aircraft, with the needs of the States to spread 
out their compliance costs over a greater period of time and to obtain 
the necessary legal and budgetary approval from within their State to 
comply with the regulations. Furthermore, because some States are 
uniquely situated and have taken different steps to come potentially 
closer to compliance with the REAL ID Act than other States, DHS does 
not believe that ``one size fits all'' when it comes to the use of the 
Secretary's extension authority.

D. Privacy Considerations

    Comment: DHS received numerous comments regarding the need to 
protect the privacy of REAL ID cardholders. The comments raised a wide 
range of concerns including the creation of a national ID; 
establishment of a Federal database on all ID holders; the uses of the 
ID; the need to set specific standards to protect privacy, including 
addressing data storage, access rules, safeguarding the data, and 
retention period for the data; the need to provide a redress process; 
limiting Federal access to the data; who should operate or govern the 
query system; and best practices for privacy protection of the data. 
AAMVA also commented that the States are committed to protecting 
privacy and that they are prepared to address privacy in their security 
plans and many already have such plans in place.
    At least one State and several other commenters, including NASCIO, 
expressed concerns about the development, governance, and protection of 
privacy in Federal reference databases. NASCIO recommended collective 
State governance. Many commenters wrote that State information security 
requires extreme caution, given that exposing personal information in 
untested databases would result in great harm if a security breach 
occurred.
    Response: DHS recognizes that protecting the privacy of REAL ID 
cardholders is a prerequisite to obtaining the public's trust in the 
REAL ID card. DHS has addressed those concerns in the final rule to the 
full extent of its authority by mandating protections for the 
personally identifiable information DMVs collect, store, and use 
pursuant to the REAL ID Act and its implementing regulations.
1. Privacy Concerns Regarding a National ID and a Federal Database
    With regard to concerns that REAL ID will create a national ID, DHS 
does not intend that REAL ID documents become a de facto national ID 
and does not support creation of a national ID. The REAL ID Act, 
however, does not provide authority for DHS to issue restrictions on 
who may or may not use REAL ID cards. DHS can only define those 
``official purposes'' for which a REAL ID credential must be used in 
lieu of other State-issued driver's licenses. The final rule has 
limited ``official purposes'' to those set forth in the Act--accessing 
Federal facilities, boarding Federally-regulated commercial aircraft, 
and entering nuclear power plants. In addition, the final rule does not 
require that the REAL ID driver's license or identification card number 
or design be unique nationally, thus possibly limiting the 
functionality of the REAL ID card or identification number as a

[[Page 5291]]

national ID card. It is unclear at this early stage whether REAL ID 
cards in fact will be used differently from current State driver's 
licenses and identification cards; but if cardholders experience 
specific abuses regarding third-party misuse of these cards, Congress 
and the States can determine whether and how to address such abuses.
    With regard to concerns that REAL ID will create a Federal database 
on all REAL ID card holders, DHS does not intend to own or operate a 
database on all driver's license and identification card holders. REAL 
ID implementation, however, will require a messaging system (generally 
known as a ``hub'') to serve as the backbone to support the 
verification checks REAL ID requires. In addition, the State-to-State 
data exchange will likely require a software application (likely an 
index or pointer system) to enable the States to exchange limited 
information to identify whether an applicant for a card holds a card in 
another jurisdiction.
    DHS is mindful that the States expect to continue to have control 
over their systems, their information, and the processes that govern 
any use or access. DHS agrees that issues relating to the governance of 
any State-to-State exchange of information are critically important, 
and that the States will need to play an important role in determining 
the governance structure of any system(s) that may interface with State 
licensing systems and the Federal verification systems required to 
implement REAL ID. Many of the individual State comments emphasized 
that they are committed to protecting privacy and that they are 
prepared to address privacy in their security plans and already have 
such plans in place. The governance of the system(s) necessary to 
conduct the data checks will be established in consultation with DOT 
and the States during the first phase of the REAL ID implementation. 
The Privacy Impact Assessment issued in conjunction with the final rule 
discusses the governance issue in more detail.
    As described above, DHS is currently working with AAMVA, DOT, the 
Social Security Administration, the Department of State, National 
Association of Public Health Statistics and Information Systems 
(NAPHSIS), and State representatives to define requirements for a 
messaging system to support the multiple data verification checks REAL 
ID requires. The backbone of the messaging system could be AAMVAnet, 
the network system AAMVA already operates to facilitate data 
verification for the State DMVs. It is important to note for purposes 
of privacy and security that the AAMVAnet backbone resides on a private 
network with no connectivity to the Internet, making it much less 
vulnerable to attacks. It has been, and will continue to be, a highly 
secure transportation layer for all communications between the States 
and agency databases. DHS will work with DOT and AAMVA to build upon 
the security, privacy, and governance principles that have guided AAMVA 
and the States for decades in conducting licensing checks by 
reinforcing the security and privacy features of the AAMVA 
communications and systems architecture.
    In addition to potentially using AAMVAnet as the backbone, DHS, 
DOT, and the States are exploring the alternative of using the 
Commercial Drivers Licensing Information System (CDLIS) as the platform 
for supporting the State-to-State data exchange requirements of the 
REAL ID Act and regulation. CDLIS already supports queries to every 
State DMV every time an individual applies for a driver's license in 
any State or the District of Columbia. Although privacy groups urged 
DHS not to build upon CDLIS since it is a centralized database, it is 
more technically and economically difficult to design a State-to-State 
data exchange system that avoids using a central repository (an index 
or pointer system) to direct the checks to the appropriate State. DHS 
understands that State systems would not be able to handle the volume 
of messages received if all jurisdictions were sending and receiving 
messages from all jurisdictions at the same time. The central 
repository would facilitate the check by identifying which 
jurisdiction(s) has a match and obtaining the relevant record 
information. The repository would only be used to facilitate the State-
to-State data exchange or for authorized law enforcement personnel who 
are checking a specific license or identification card against the 
system. Moreover, CDLIS is a secure, State-governed system that stores 
only the minimum amount of personal information necessary to minimize 
false positives and to facilitate the routing of queries and responses 
between States.
    With regard to limiting access, (Federal, State, and private-
sector) to the State DMV data stored in the data verification system, 
DHS, DOT, and the States will define the access rules. The REAL ID Act 
does not create Federal access rights to State DMV databases. Moreover, 
DHS supports limiting access to the data verification system to 
authorized State DMV personnel and to Federal government agencies 
engaged in official responsibilities pertaining to law enforcement, the 
verification of personal identity, or highway and motor vehicle safety. 
For example, DHS personnel do not currently access CDLIS or AAMVAnet. 
Its law enforcement agents obtain access to State driver's license 
information using National Law Enforcement Telecommunications System 
(NLETs) and commercial data sources.
2. Protection of State DMV Databases
    To help protect the privacy and security of the personally 
identifiable information (PII) held in State DMV databases, Sec.  37.41 
of the final rule requires States to prepare a security plan for all 
State DMV facilities and systems involved in the issuance, enrollment, 
production, or manufacture of driver's licenses and identification 
cards, and to submit the plan to DHS as part of the State's application 
for certification. The final rule requirement for the security plan to 
include reasonable administrative, technical, and physical safeguards 
to protect the security, confidentiality, and integrity of the 
personally identifiable information collected, stored, and maintained 
in DMV records and information systems is consistent with key 
information safeguards outlined in the Privacy Act of 1974 (5 U.S.C. 
552a) and the Federal Information Security Management Act of 2002 (44 
U.S.C. 36).
    The security plan requires a number of important privacy and 
security safeguards including, but not limited to: (1) Procedures to 
prevent unauthorized access, use, or dissemination of applicant 
information and images of source documents retained pursuant to the 
Act; (2) standards and procedures for document retention and 
destruction; (3) a privacy policy; (4) a prohibition on release and use 
of personal information that, at a minimum, is consistent with the 
Driver's Privacy Protection Act, 18 U.S.C. 2721 et seq.; (5) access 
controls, including employee access badges, background checks and 
systems controls; (6) emergency incident response plans; (7) internal 
audit controls; (8) physical security of facilities where driver's 
licenses and identification cards are produced; (9) security of the 
document materials and papers from which driver's licenses and 
identification cards are produced (Sec. Sec.  37.41 and 37.43).
    The requirement that the security plan include a privacy policy 
regarding the personally identifiable information collected and 
maintained by the DMV provides a key privacy protection. Although the 
final rule does not define

[[Page 5292]]

the specific content of the privacy policy, DHS expects that the policy 
will reflect the fair information principles noted in the NPRM, which 
call for openness, individual participation (access, correction, and 
redress), purpose specification, data minimization, use and disclosure 
limitation, data quality and integrity, security safeguards, and 
accountability and auditing. These principles are widely recognized and 
embodied in numerous Federal, State, and international law and codes of 
practice. In addition to reflecting these principles, DHS recognizes 
that the privacy policies will need to be consistent with State privacy 
laws governing DMVs information practices, and the final rule in no way 
reduces the protections States already afford PII held by DMVs.
    With regard to concerns regarding disclosure of PII from DMV 
databases, the final rule requires that the security plan include a 
prohibition on release and use of personal information that, at a 
minimum, is consistent with the DPPA. Although the DPPA provides for a 
large number of permissible uses, it is the only Federal law that 
currently applies to State DMV records and will provide a floor that 
States can build upon to further limit the disclosure of DMV record 
information.
3. Privacy Concerns Regarding the Machine Readable Technology Employed 
by REAL ID
    Section.IV.I.8 of the comments discussion discusses the comments 
and responses regarding the machine readable zone (MRZ) on REAL ID 
cards. In brief, commenters were split between the privacy groups that 
were concerned about third party ``skimming'' of information from the 
MRZ if it is not encrypted, and the State and law enforcement groups 
that opposed encryption because it could interfere with speedy law 
enforcement access to the information and it would be difficult and 
costly to manage encryption keys across so many jurisdictions.
    Given law enforcement's need for easy access to the information, 
and the complexities and costs of implementing an encryption 
infrastructure, DHS is not requiring encryption of the MRZ at this 
time. If, in the future, the States collectively determine that it is 
feasible to introduce encryption, DHS may consider such an effort so 
long as the encryption program enables law enforcement easy access to 
the information in the MRZ. Moreover, in the future, DHS, in 
consultation with the States and DOT, and may consider technology 
alternatives to the PDF417 2D bar code that provide greater privacy 
protections after providing for public comment.
    As discussed in the Privacy Considerations section of the NPRM (72 
FR at 10824-25), DHS strongly encourages the States to address concerns 
about the ability of non-law enforcement third parties to collect or 
skim personal information stored on the REAL ID driver's licenses or 
identification cards. Some States, such as California, Nebraska, New 
Hampshire, and Texas have passed laws that prohibit the collection of 
information on a driver's license or identification card. In addition, 
AAMVA has drafted a Model Act \2\ that, if enacted by a State, would 
prohibit commercial users, except as provided by the State's 
legislation, from using a scanning device to: (1) obtain personal 
information printed or encoded on the card and; (2) buy, sell or 
otherwise obtain and transfer or disclose to any third party or 
download, use or maintain any data or database, knowing it to contain 
personal information obtained from a driver's license or identification 
card. The Model Act authorizes verification of age for purchasing 
alcoholic beverages or tobacco products, but with strict limitations on 
the storage and use of such information.
---------------------------------------------------------------------------

    \2\ ``Model Act to Prohibit the Capture and Storage of Personal 
Information Obtained from a Driver's License or ID Card,'' AAMVA 26-
8.2-03, 2003.
---------------------------------------------------------------------------

    In addition to concerns about third-party skimming, privacy groups 
commented that access to the MRZ should be restricted to law 
enforcement, while other commenters also supported access without 
information collection for bars and liquor stores to help prevent 
underage drinking. In response to commenters urging that the rule limit 
Federal agency access to the MRZ, DHS is not aware of any current plans 
by Federal agencies to collect and maintain any of the information 
stored in the MRZ. If a Federal agency should want to use the MRZ to 
collect and maintain personally identifiable information in the future, 
any such information collected from the MRZ would be subject to the 
protections of the Privacy Act of 1974 (5 U.S.C. 552a), and other 
Federal laws and policies regulating the use and handling of personally 
identifiable information, including requiring appropriate time for 
public notice.
    A number of commenters also urged DHS to limit the data elements in 
the MRZ to the minimum necessary, particularly if the MRZ is not 
encrypted. DHS has reviewed the elements identified in the NPRM and 
eliminated the requirement to include the name history in the MRZ. All 
other data elements are necessary for DMV and law enforcement purposes.
4. Additional Privacy Concerns
    The privacy groups and individuals also filed comments on a number 
of other privacy issues such as redress, the confidentiality of the 
address for certain at-risk individuals, and the Western Hemisphere 
Travel Initiative (WHTI)-compliant card and its use of Radio Frequency 
Identification (RFID) technology. The comments and responses to these 
additional privacy concerns are discussed in other sections of this 
final rule.
    Comment: Two States wrote that the proposed rule did not provide 
adequate safeguards for data storage, thereby significantly increasing 
the risk of identity theft. One commenter wrote that even the most 
rigorous security measures could be foiled by personnel with legitimate 
access intentionally or inadvertently exposing information. Several 
commenters wrote that the rule's broad expansion of data collection and 
storage creates a significant threat to privacy and that guidance on 
access to data and accountability should be issued. Commenters also 
wrote that stored data should be secured to protect the identities of 
victims from abusers in State government who have database access.
    Response: Section 37.41 of the final rule helps address concerns 
about adequate protections for the DMV databases and information 
systems. It calls for States to prepare a security plan, including 
providing reasonable administrative, technical, and physical safeguards 
to protect the security, confidentiality, and integrity of the 
personally identifiable information stored and maintained in DMV 
records and information systems. The rule specifically points out the 
need to include access control measures to prevent unauthorized access 
to the information. States are already sensitive to the importance of 
protecting their data and systems. Section 37.33(b) will help ensure 
that DMVs provide comprehensive, layered security protection to reduce 
the incidence of unauthorized access and use. In addition, this final 
rule does not preempt States from implementing privacy protections that 
are even more protective.
    Comment: One State wrote that DHS should set standards for 
accessing the required information from the Federal government and 
other States so that the verification process is performed

[[Page 5293]]

similarly by all States. Multiple commenters stated that they want data 
systems to be one-way and used solely for the purpose of verification; 
Federal system owners would not be able to query State databases. 
Similarly, other commenters wrote that the rule should limit how States 
can access Federal databases for purposes of verifying source documents 
and should only allow authorized DMV employees access to Federal 
databases. One commenter requested that the final rule make clear that 
no State may electronically access source documents contained in DMV 
databases in other States. Several States opposed Federal government 
access to the extensive data collected by States and suggested a 
network interface that only allowed State queries of the databases. One 
commenter wrote that it is unclear from the proposed rule how the 
federated query service will operate and manage the data between 
databases and DMVs, and while strict access controls to REAL ID data 
and documents will help minimize security and privacy risks, such 
controls will not be possible without DHS answering these questions 
prior to implementing REAL ID.
    Response: DHS is working with DOT, AAMVA, and the States to enhance 
existing querying systems to meet the requirements of the REAL ID Act 
and rule. This ``federated querying system'' builds upon existing 
systems that include verification of DMV applicant birth certificates 
and social security numbers. These existing systems enable States to 
query the SSOLV database managed by SSA and the EVVE database managed 
by NAPHSIS. In both cases, only State DMVs can initiate queries. 
Moreover, SAVE, the USCIS system for verifying the lawful status of 
individuals in the United States, is designed on a similar basis, with 
only States able to initiate queries. Enhancements to existing systems 
to verify information held by the Department of State will be designed 
and built on the same principles.
    In addition, State-to-State data exchanges required by REAL ID may 
consider leveraging the Commercial Drivers Licensing Information System 
(CDLIS) as the baseline platform for systems design, development and 
deployment. CDLIS is a secure, State-governed system that stores the 
minimum amount of personal information possible to facilitate the 
routing of queries and responses between States. Enhancements to CDLIS 
to support the requirements of REAL ID will not change the fundamental 
architectural, security, and privacy principles upon which CDLIS has 
been built and operated by the States for nearly two decades.
    As noted above, Sec.  37.41 of the final rule addresses these 
concerns. It calls for States to prepare a security plan, including 
providing reasonable administrative, technical, and physical safeguards 
to protect the security, confidentiality, and integrity of the 
personally identifiable information stored and maintained in DMV 
records and information systems. The rule specifically points out the 
need to include access control measures to prevent unauthorized access 
to the information.
    Comment: One State recommended that paper document retention should 
not be required once electronic formats were secured. Another commenter 
wrote that REAL ID should collect only the data that is absolutely 
necessary and keep it for only as long as necessary, and requirements 
should be in place to periodically review and purge information.
    Response: Section 202(d)(2) of the Act mandates that States 
``retain paper copies of source documents for a minimum of 7 years or 
images of source documents presented for a minimum of 10 years.'' DHS 
does not have discretion to change that requirement. Accordingly, under 
this final rule, States may choose to keep paper copies, microfiche, or 
digital images of source documents. Depending on the method of document 
retention adopted by the State, the State must maintain paper copies 
for a minimum of seven years, or microfiche or digital images of source 
documents for a minimum of 10 years pursuant to the Act. We note that 
the NPRM proposed to allow retention of microfiche for 7 years; 
however, as discussed above the statute mandates retention of 
``images'' of source documents for 10 years. A microfiche is a film 
image, rather than a paper copy, of a document; therefore, we have 
corrected the error in the proposed rule to more accurately reflect the 
statutory mandate.
    Comment: Many commenters wrote that obtaining a REAL ID could 
become a requirement for participation in American life, and that a 
REAL ID could be used for purposes beyond what is contemplated today, 
such as controlling gun ownership or smoking. Another commenter wrote 
that implementing REAL ID would undoubtedly result in a system that 
political and agency heads would not restrain themselves from using and 
expanding in the future, and that REAL ID would become a practical 
necessity for anyone wishing to travel on an airplane, open a bank 
account, collect Social Security benefits, or take advantage of other 
government benefit programs. Other commenters wrote that the result 
would be a dividing of the citizenry into those who have REAL 
identification cards and those who do not, with the later group subject 
to suspicion. One commenter urged DHS to make clear in the final 
regulations that driver's license numbers and ID card numbers must be 
unique within a State and that the REAL ID cards should not have a 
nationally standard format.
    Response: DHS agrees with the comment that a driver's license or 
identification card number needs to be unique only within a State and 
need not be a unique nationally identifying number. DHS also 
understands the concerns raised in the comments about how a REAL ID 
might be used outside of the defined ``official purposes'' identified 
in the Act and this final rule. DHS does not intend that a REAL ID 
document become a de facto national identification card. Whether States 
choose to require presentation of a REAL ID for State purposes is not 
within the purview of DHS's authority under the Act--which applies to 
documents that Federal agencies can accept for official purposes--and 
thus is outside of the scope of this rulemaking.

E. State to State Database Queries

    Comment: Several commenters suggested the following requirements 
for State databases: using a single agreed-upon naming record keeping, 
clarifying ``transferable'' functionalities, implementation of point-
to-point interfaces for data verification, a decentralized query 
system, and a system to check for duplicate registrations in multiple 
States. One commenter suggested that every State have a data governance 
committee. Several States offered best practice suggestions to support 
State database security, including encryption, annual employee 
confidentiality agreements, secured data centers, testing programs to 
determine tampering, security audits, and multi-factor authentication.
    Response: DHS agrees that issues relating to the governance of any 
State-to-State exchange of information is critically important, and 
that the States will need to play an important role in determining the 
governance structure of any system(s) that may interface with State 
licensing systems and the Federal verification systems. DHS is mindful 
that the States expect to continue to have control over their systems, 
their information, and the processes that govern any use or access.
    During the initial period of REAL ID implementation, States will 
conduct data verification using their current

[[Page 5294]]

methods of connection to SSOLV, SAVE, and the other State DMVs. States 
will continue to use AAMVAnet to connect to these data sources. 
AAMVAnet is governed by the Board of AAMVA and is subject to the 
security and privacy requirements established by the association of 
DMVs. As DHS, DOT, AAMVA, and the States complete the upgrade of 
existing systems to meet the requirements of REAL ID, these systems 
will be deployed and operated on the same basis as the current network 
of AAMVAnet-based systems for DMV verification of applicant data and 
State-to-State exchanges of driver information. The architecture of 
these systems will determine the scope and extent of the privacy 
concerns they pose.

F. Document Standards for Issuing REAL ID Driver's Licenses and 
Identification Cards

1. Identity
    Comment: One State agency asked whether the term ``source 
document'' in the proposed rule is synonymous with ``identity 
document'' used in the Act. One State wrote that it was concerned about 
individuals having to surrender their REAL ID card from one State when 
moving to a new State and applying for a new card. Many commenters 
wrote that certain applicants would have difficulties obtaining proper 
source documents, including refugees, lower-income individuals, persons 
who live in rural areas, the elderly, minorities, and abuse victims. 
Another State suggested that the rule should only specify criteria and 
procedures rather than a list of specific documents.
    Response: DHS disagrees with the comment that the rule should 
specify criteria rather than a list of specific documents acceptable to 
establish a person's identity. Limiting the number of documents means 
that only the documents which DHS has found to be the most secure may 
be used to demonstrate identity. Second, identifying specific documents 
improves the chances that DMV employees will be able to distinguish 
valid from fraudulent documents because there will be fewer categories 
of documents with which they will need to be familiar. Third, a smaller 
list of documents increases the ease of verifying the documents 
independently, a related statutory requirement and one that will be 
very effective in reducing document and identity fraud.
    DHS does not agree that certain categories of individuals cannot 
reasonably obtain the identity documents specified in the rule, but the 
rule provides a reasonable level of discretionary flexibility to 
address these types of cases.
    Comment: Commenters wrote that the list should be expanded to 
include a variety of documents, including adoption papers, refugee 
status paperwork, expired foreign passports if USCIS documentation is 
current, passports with expired visas, derivative visas, Immigration 
Court documents, foreign birth records, foreign national identification 
cards, the I-94 (Arrival-Departure Record), and the I-797 (Notice of 
Action). Refugees and asylees are more likely to have these documents 
before they receive an Employment Authorization Document (EAD). Two 
States suggested that documents that can be electronically verified 
through SAVE should be acceptable. Commenters wrote also that foreign 
applicants may have documents that are not on the list but may have 
been issued by DHS or the courts to prove immigration status.
    Response: The document list provided in the proposed regulation and 
adopted under this final rule is only for demonstrating identity, not 
lawful status in the United States. DHS agrees with the commenters who 
suggest that any document verifiable by SAVE is acceptable for proving 
lawful status, and that is what this final regulation provides. These 
can include Forms I-797 and I-94 as they provide sufficient information 
for a State DMV to check SAVE, which will be the method by which aliens 
lawfully present in the United States establish lawful status. But 
because many of these documents (including the ones listed above) 
cannot, and are not intended to, prove a person's identity, an 
additional document must be provided for that purpose. In the case of 
refugees and asylees, they will be able to obtain a Form I-766, 
Employment Authorization Document.
    DHS cannot accept the comment that foreign documents be included on 
the list of acceptable documents to prove identity. First, section 
202(c)(3)(B) of the Act specifically prohibits any States from 
accepting any foreign document other than a passport. Second, the Act 
requires that documents presented for proof of identity be verified by 
the issuing agency. State DMVs cannot be expected to verify with 
foreign governments the validity of documents. DHS has, instead, 
decided to use the U.S. visa within the foreign passport as the 
identity document that a nonimmigrant alien can present.
    Comment: One commenter wrote that a delayed birth certificate 
should be considered an acceptable document. One State wrote that many 
births in rural areas are not recorded, and States should be able to 
use other documents. One commenter wrote that a requirement for a 
certified copy of a birth certification would place a hardship on poor 
persons. One commenter supported the concept of re-verification of 
birth certificates for renewals of REAL identification cards, except 
that the rule should allow the option for the applicant to use 
documents with the current legal name instead of the name at birth.
    Response: While confirming identities with delayed birth 
certificates can be problematic, this final rule does not preclude a 
State from accepting a validly-issued delayed birth certificate. DHS 
agrees that some, mostly elderly, individuals may not have a birth 
certificate at all. As a result, the final rule permits a State to use 
its exceptions process to determine what alternative documents an 
individual may present in this limited circumstance to establish his or 
her date of birth. DHS does not agree that lower-income individuals 
will have a hardship obtaining certified copies of their birth 
certificates and believes that States may be able to assist those 
individuals for whom the cost of obtaining a birth certificate is 
prohibitive. Further, DHS believes that there is value in re-verifying 
applicant information upon renewal of driver's licenses and 
identification cards and has amended the renewal sections to require 
re-verification of SSN prior to issuance.
    Comment: Commenters requested a variety of additional documents be 
considered as acceptable source documents, including Federally-issued 
identification documents such as military identification cards, the 
Common Access Card, retired military ID cards, dependent military ID 
cards, Veteran Affairs Universal Access Photo ID cards, and 
Transportation Workers Identification Credentials (TWIC). Some 
commenters also requested that Native American Tribal Documents be 
deemed acceptable source documents. One State asked whether a tribal 
photo identification card accompanied with a Canadian birth certificate 
(which is currently acceptable to the commenting State) will be 
acceptable to DHS. If not, these populations may encounter particular 
difficulty obtaining a REAL ID.
    Response: DHS does not agree with comments suggesting addition of 
Native American Tribal Documents, TWIC cards, or Common Access Cards 
(CAC) or military identification issued by the U.S. Department of 
Defense as identity documents for REAL ID purposes at this

[[Page 5295]]

time. DHS continues to understand from the Department of the Interior 
and Bureau of Indian Affairs that Tribal members are similarly situated 
to the general population, and have access to the identification 
documents set forth in the rule. Where a Tribal member does not have 
the necessary document to establish identity, date of birth, or lawful 
status, a State's exception process can take this into account based on 
the State's knowledge and experience with Tribal documents in its area 
of jurisdiction.
    In regard to the use of a TWIC as proof of identity, at this time, 
DHS does not believe that it would be feasible for States to accept 
TWIC cards as initial proof of identity by persons applying for a REAL 
ID card. First, section 202(c)(3) of the REAL ID Act requires States to 
verify all documents presented by applicants as proof of identity. The 
capability for States to verify a TWIC card currently does not exist at 
this time.
    Second, although a TWIC holder must have been determined to be 
lawfully present in the United States to obtain the TWIC, the TWIC does 
not necessarily expire when the holder's lawful status expires. 
Therefore, a DMV could not use the TWIC card alone as evidence of 
lawful status and the applicant would have to present both a TWIC (for 
identity) and a separate document (for status).
    Accordingly, there is little benefit to the individual or the DMV 
at this time to include a TWIC as an acceptable identity document. As 
such, the final rule does not include TWIC as an acceptable form of 
identification. However, DHS will revisit this issue in the future 
should such a capability become available and will consider the ability 
for States to verify TWICs with the federal government as the standards 
for the ``hub'' are developed.
2. Social Security Documentation
    Comment: Several commenters, including States, wrote that obtaining 
a Social Security card can be a lengthy process. They argued that some 
individuals may have lost their original card, a Social Security number 
(SSN) does not enhance the identification process, and ineligibility 
for a SSN is difficult to determine and verify. One commenter wrote 
that individuals might not have a SSN because of religious beliefs. One 
State wrote that States should have the option of requiring a Social 
Security card.
    Response: The REAL ID Act requires that individuals provide proof 
of their Social Security account number or verification that they are 
not eligible for a Social Security account number. While the typical 
proof submitted to DMVs is a Social Security card, the rule allows for 
the submission of alternate documents, such as a W-2 form, SSA-1099 
form, or pay stub to establish the SSN. Use and verification of the SSN 
is widely seen by almost every State as an effective tool in enhancing 
the identification process. DHS has further amended the rule to clarify 
for the DMVs when an individual will have not have a SSN, which is 
largely tied to immigration status and identity documents used to apply 
for a driver's license. Other instances may be addressed in exceptions 
processing.
3. Principal Residence Documentation
    Comment: Many commenters suggested that the definition of 
``principal residence'' be amended. One State recommended that DHS 
define ``principal residence'' as the jurisdiction in which an 
individual spends the most time. Another commenter requested 
``principal residence'' be defined as the primary or most important 
place of abode of an individual and at which he or she presently has an 
intention of living for an indeterminate period. Another State 
suggested that the definition be changed to require that a person's 
principal residence be within the jurisdiction issuing the card and to 
allow the States to issue exemptions. One State suggested that DHS 
clarify the definition so that students, military, visitors, and others 
who are temporarily residing in another jurisdiction are not required 
to change their principal residences.
    Response: DHS agrees that the definition of ``principal residence'' 
needs to be clarified in the rule. The term is defined in the final 
rule as the location where a person is currently domiciled (i.e., 
presently resides even if at a temporary address) in conformance with 
the residency requirements of the State of domicile, if such 
requirements exist.
    Comment: Commenters wrote that requiring two documents proving 
residence is burdensome on certain individuals (i.e., recent movers, 
minors, homeless, and those not listed as primary payer on accounts) 
and suggested use of the United States Postal Service (USPS) National 
Change of Address system as a verification tool. One State recommended 
that the rule allow use of an on-line address verification system to 
replace the two forms of address documents, at least for remote 
renewals.
    Response: DHS does not agree that it is too burdensome to require 
an individual to produce two documents to establish his or her address 
of principal residence. Since the State has maximum flexibility in 
determining what documents are acceptable for this purpose, DHS 
believes that the States will be able to find a combination of 
documents for each person eligible to apply for a REAL ID driver's 
license or identification card. DHS believes States may use the 
procedures established in their exceptions processes when seeking to 
document the address of principal residence of the homeless or other 
individuals who may not have a fixed street address.
    Comment: Commenters wrote that there are certain groups of people 
including students, long-haul truck drivers, the homeless, migrant 
workers, and others who do not have a single fixed address and who will 
not be able to meet this requirement. One commenter requested that the 
rule be strengthened by clarifying in the exceptions process that the 
requirement of a fixed address will be waived as long as a REAL ID 
applicant can make a showing that they have none and that they can 
comply with other documentation requirements.
    Response: As noted above, DHS believes that States will be able to 
resolve these issues through the use of their exceptions process.
    Comment: Several commenters noted the difficulty in providing a 
street address because many rural addresses use rural route numbers 
only, and recommended new regulatory text: ``An acceptable street 
address includes rural delivery route and/or box number or other 
address convention used by the USPS in all areas of the U.S. where a 
number and street name has not been assigned for U.S. mail delivery.'' 
One commenter wrote that in its jurisdiction, it is common to find 
streets with same names throughout different communities and that rural 
addresses are identified by kilometers and hectometers within a street 
address or neighborhood. Another commenter (a State) has islands that 
do not have home addresses; mail is delivered to post offices where the 
residents must go to retrieve their mail. One State noted that many 
Native American populations do not have physical addresses.
    Response: DHS agrees with these comments and has amended the rule 
to define ``address'' as an address convention used by the USPS in 
areas of the United States and Territories where a number and street 
name has not been assigned for U.S. mail delivery.
    Comment: One commenter wrote that address changes make up the 
largest number of driver record changes and many States do not require 
issuance of

[[Page 5296]]

a replacement card until the next renewal cycle. Several commenters, 
including States, wrote that when an address change occurs, no REAL ID 
card need be required and that it is cost prohibitive for States to 
issue new documents for address changes.
    Response: DHS agrees with these comments and is no longer requiring 
an in-person transaction for an individual to change his or her 
address. DHS also leaves it to State law and procedure when and under 
what circumstances a State requires issuance of a replacement driver's 
license or identification card.
4. Lawful Status Documentation
    Comment: Several commenters wrote that there are many examples of 
lawfully present immigrants who may not have the listed documents and 
that the list should be expanded. One commenter wrote that these 
omissions violate the Constitution by denying to individuals in these 
classes the rights and privileges accorded to others, and stated 
immigration documents do not always reflect actual status. A State 
wrote that Temporary Protected Status aliens should be required to 
provide documentation from DHS of an established identity. Some 
commenters objected to the need for an unexpired U.S. visa on a foreign 
passport. They pointed out that renewing a visa would involve foreign 
travel, and in any case a visa does not authorize a stay in the U.S. 
for any particular period of time. An alien with nonimmigrant status 
may lawfully extend or change his or her nonimmigrant status without 
maintaining a valid visa stamp. One State noted that in some cases a 
passport might expire before the visa.
    Response: DHS has included the list of documents as verifying 
identity of the person presenting them, not lawful status. Lawful 
status may be determined through verification against DHS's SAVE 
system. Aliens who are granted Temporary Protected Status are already 
eligible for EADs, Form I-766, and thus have a document proving 
identity. DHS does not believe that this rule treats citizens and 
aliens differently--each is required to prove identity and lawful 
status to obtain a REAL ID driver's license. Further, DHS does not 
believe that treating citizens and aliens differently is in violation 
of the Constitution, but an inherent right of a sovereign nation and 
one that reflects American constitutional law. Regarding the visa in a 
foreign passport, DHS is not treating the visa itself as a document 
establishing lawful status. Again, the check of DHS's SAVE system will 
accomplish that purpose. The visa is used to verify identity and can be 
verified with the issuing agency--the U.S. State Department. DHS cannot 
verify, with the issuing agency as required by statute, foreign 
passports because there is no guarantee that issuing a foreign 
government would respond to a DMV request for a specific passport. 
Finally, like all documents that verify identity, the document itself 
must be unexpired to assure that a significant amount of time has not 
passed such that the person's appearance has changed. This is a 
fundamental rule with issuance of all types of documents that are 
designed to prove a person's identity.
5. Verification of Documentation Presented
    Comment: One commenter wrote that DHS should partner with AAMVA in 
implementing document verification requirements. Several commenters 
wrote that States need ongoing training and guidance for verification 
and to be advised what to do if documents cannot be verified. A few 
commenters noted that the verification of documents is only a 
verification that paper contains legitimate data and not that the 
applicant is the owner of the paper or that the document is authentic. 
A State asked who makes the determination of whether a State's 
verification procedure is ``effective.'' Several commenters wrote that 
Federal electronic verification systems do not exist yet or need 
significant enhancements; therefore, compliance requirements should be 
delayed. One commenter wrote that States must find their own ways to 
verify documents but that States lack the legal authority to force 
compliance. Commenters suggested States use third party databases or 
automated document authentication systems and share images to deter 
identity fraud. One State asked whether it would have to re-verify 
source documents if the applicant already had a REAL ID from another 
State.
    Response: DHS is working with AAMVA and State representatives to 
design and implement verification systems to support the requirements 
of the REAL ID Act and this rule. Representatives of numerous States 
and the Federal agencies responsible for verification of identity 
information for REAL ID and related Federal government programs are 
continuing to meet to develop recommendations on prioritization of data 
and document verification systems based on risk and value. Two 
verification systems are currently available for use by all States--the 
SSOLV system for verification of social security numbers with the SSA 
and the SAVE system managed by USCIS for verifying that an applicant is 
lawfully present in the United States and for how long. These systems 
have been in widespread use for many years and are highly effective. 
DHS is working to improve further the usability and accuracy of these 
systems and to meet REAL ID-specific requirements. DHS is also working 
with the appropriate Federal and nongovernmental agencies to verify 
other documents and applicant data mandated by this rule. As these 
systems are deployed and become widely available for use by States, DHS 
plans to publish notices of availability and timetables for required 
use in the Federal Register.
    DHS recognizes that verification consists of two separate elements: 
(1) Determining that the source document is genuine and has not been 
altered; and (2) determining that the identity data contained on the 
document is valid. Electronic verification systems can support these 
elements. However, DHS recognizes that other methods can be employed by 
States to confirm one or more elements of identity assurance. 
Electronic verification systems are only one component of a suite of 
measures to assure States that the applicants are who they say they are 
and that they are lawfully present in the United States.
    DHS recognizes that there are many different techniques for 
verifying the identity and qualification of applicants and will 
evaluate the effectiveness of such techniques.
    Comment: AAMVA and several States wrote that a system of passport 
verifications through the Department of State is not available and it 
will be difficult for States to determine name matches. One commenter 
wrote that States must find their own ways to verify documents but that 
States lack the legal authority to force compliance. Commenters 
suggested that States use third party databases or automated document 
authentication systems and share images to deter identity fraud. One 
State asked whether it would have to re-verify source documents if the 
applicant already had a REAL ID from another State.
    Response: DHS is working with the Department of State and AAMVA to 
provide a capability to verify passports, U.S. visas, and other 
information held by the Department of State. When this capability is 
widely available for State use, DHS will publish a Notice of 
Availability in the Federal Register and establish timelines for State 
use of this capability. DHS is also working with Federal, State, and 
nongovernmental organizations to identify and improve

[[Page 5297]]

name formats and matching algorithms used by identity verification 
systems.
    Comment: Commenters wrote that they supported the use of a SAVE 
system to verify lawful status because State DMV staff should not have 
to be immigration officials, but that many improvements needed to be 
made to the system. Commenters wrote that SAVE needs to indicate the 
type of pending nonimmigrant status the applicant has, as well as work 
authorization information. Another commenter wrote that for students 
and exchange visitors, information is provided in the Student and 
Exchange Visitor Information System (SEVIS) system, but SAVE and SEVIS 
are not yet linked. Several States wrote that they should not have to 
pay transactional costs for Federally-mandated verification through a 
Federal system.
    Response: The SAVE system has proven to be a highly effective means 
of verifying immigration status information for many DMVs and other 
Federal and State agency users for twenty years. DHS is working with 
AAMVA and USCIS to improve the usability, accuracy, and reliability of 
the SAVE system even further, to include access to SEVIS and other data 
through SAVE.
    DHS is committed to expediting and subsidizing the improvement, 
design, development, deployment, and operation of verifications systems 
to support the requirements of the REAL ID Act and this rule; however, 
the States have typically borne the costs of verifying the identity and 
qualifications of applicants for driver's licenses and identification 
cards.
    Comment: Several commenters supported the use of the EVVE system, 
but pointed out that it is not ready for implementation, and that an 
exception process would be needed. States opposed having to bear the 
costs for verification.
    Response: DHS recognizes that the EVVE system is not ready for full 
implementation. The final rule provides for additional time for States 
to implement EVVE or another system that provides for the verification 
of birth records. Verification of identity information is a valuable 
tool that many DMVs utilize. Birth data is currently collected and 
maintained by the States, and DHS is not seeking to Federalize these 
records.
    Comment: A few commenters supported the continued use of the SSOLV 
system, even though manual intervention is sometimes needed and the 
system is sometimes not available. One State wrote that it opposed 
having to re-verify SSNs that were previously verified through SSOLV.
    Response: DHS agrees that the SSOLV system is the best existing 
system to verify an individual's SSN. DHS does not believe that the 
short amount of time it takes a State to enter an SSN and verify it 
through SSOLV is an unreasonable burden to impose, even for those 
persons whose SSN was previously verified through SSOLV. Forty-eight 
States and the District of Columbia currently have the capability to 
verify SSNs through SSOLV or other means. This requires electronic 
verification of SSNs with SSA but allows States to use other means than 
SSOLV. Verification of SSNs through SSOLV costs pennies and is 
typically completed in a few seconds. DHS, AAMVA, and the States are 
working with SSA to improve the accuracy and reliability of the SSOLV 
system.
    Comment: Several States and commenters expressed concern that 
States are required to verify an individual's address of principal 
residence, yet DHS concedes in the rule that no such method exists. 
AAMVA wrote that in order for the States to support the verification 
process, DHS must clarify what the ``system of document verification 
acceptable to DHS'' really means. One State wrote that DHS should 
develop national standards for address requirements and verification; 
AAMVA wrote that this verification should be left to the States to 
determine and provide to DHS in their certification plans. Several 
States wrote that development or implementation of an electronic 
verification system for proof of principal residence is not feasible.
    Response: DHS agrees that States are best situated to verify an 
individual's address of principal residence. The rule gives States 
maximum flexibility in determining an individual's address of principal 
residence.
    Comment: Many commenters wrote that DHS should delay implementation 
of this final rule until all system components needed for verification 
are in place and tested. AAMVA and several States expressed concern 
about the cost for verification processes, particularly programming 
costs for States to adapt State systems for the new requirements and to 
establish connections with verification systems. States wrote that an 
all-driver verification system is needed for implementing the REAL ID 
program. Commenters suggested expanded use of the Commercial Driver 
License Information System to satisfy the one-driver, one-record goal. 
Some commenters objected to the concept of a national database. Some 
commenters wrote that electronic verification systems must be fast and 
reliable; provide real-time, accurate information; and be integrated 
into the REAL ID issuance process. One commenter favored a 
decentralized query system where one DMV uses an applicant's basic 
identifying information to send requests to other jurisdictions. A few 
States asked how a compliant State would interface with a noncompliant 
State in verifying an out-of-State card. Other commenters wrote that 
the requirement to check with other States to see whether a REAL ID had 
been issued should apply to all driver's licenses, not just REAL ID 
identification cards.
    Response: Two of the critical systems for verifying Social Security 
Numbers and lawful status are fully operational and currently used by 
many or most States. As stated above, DHS is working with other Federal 
agencies, nongovernmental agencies like AAMVA and NAPHSIS, and the 
States to design and deploy additional systems as quickly as possible. 
These systems will be integrated with the licensing issuance process in 
each State. States cannot and will not be required to use systems that 
are not fully operational and available for use.
    DHS is also working with the Department of Transportation, AAMVA, 
and the States to enhance the functionality of CDLIS to meet the 
requirements of the REAL ID Act and this regulation. Neither the Act 
nor this regulation requires the design or deployment of a new national 
database or any new system of exchanging of information between States 
beyond that already implemented through CDLIS and the National Driver 
Register. All States currently participate in the exchange of driver 
information mandated under these processes. The REAL ID final 
regulation simply requires States issuing REAL ID driver's licenses or 
identification cards to verify that an individual does not possess a 
valid driver's license or identification card in another State. This 
requirement is similar to the existing statutory and regulatory 
requirements for commercial driver's licenses. When this functionality 
is available, DHS will publish a Notice in the Federal Register 
detailing the procedures and timeline for State-to-State exchange of 
data required under the Act.

G. Exceptions Processing for Extraordinary Circumstances

    Comment: Three States and three other commenters said that DHS 
should set minimum standards for the

[[Page 5298]]

exceptions process so that there is consistency across the States. 
However, other States noted that the process should not be too rigidly 
defined, because the very nature of an exception will by necessity 
deviate from the current process, and that there are too many variables 
that need to be analyzed on a case-by-case basis to develop a rigid 
exceptions process.
    Response: DHS disagrees with the comments that DHS should establish 
a uniform exceptions process for each State. DHS recognizes that each 
jurisdiction may face its own unique and particular set of facts and 
circumstances to resolve and that DHS is unable to address all such 
circumstances. DHS believes that States must have the flexibility to 
craft an exceptions process adequate to the needs of their States and 
recognizes that no two State exceptions processes may be identical.
    Comment: AAMVA and multiple States opposed the requirement that 
States submit quarterly reports to DHS analyzing their exceptions 
processes. Four of these commenters suggested that the information 
could be included in a State's annual certification report instead. 
Further, AAMVA and many States opposed the provision requiring State 
exceptions processes to be approved by DHS and said this requirement 
would reach too far into the day-to-day operations of State agencies.
    Response: DHS agrees that the proposed rule's requirement for a 
quarterly report on the use of the exceptions process is too burdensome 
a requirement for the States. The final rule strikes the quarterly 
reporting and requires States to submit a report as part of the 
recertification package a State will submit to DHS in connection with 
REAL ID. As necessary and appropriate, a State can designate this 
report as Sensitive Security Information (SSI).
    Comment: One commenter said that DHS should allow States to employ 
exceptions processing on any list of documents that they deem 
circumstantially appropriate. Numerous commenters opposed prohibiting 
use of the exceptions process to demonstrate lawful status. In general, 
these commenters believed that many legal immigrants and other groups 
of people would not be able to meet the rule's requirements for proving 
lawful status. One commenter said that the scope of the exceptions 
process described in the proposed regulatory text does not correspond 
to the scope of the exceptions process described in the rule's 
preamble. The commenter urged DHS to revise the proposed regulation to 
explicitly include all data elements required under the REAL ID Act 
within the scope of the exceptions process.
    Response: DHS agrees in part with the comments submitted. Under 
this rule, the exceptions process can now also be used by a U.S. 
citizen to establish his or her lawful status in the United States. 
This will accommodate the needs of elderly or rural residents, for 
example, who have not obtained a birth certificate but were born in the 
United States. The exceptions process may not be used by non-citizens 
to establish lawful status in the United States. That status must be 
verified in all instances with DHS.
    Comment: Several commenters requested that State records not 
include a ``full explanation'' regarding why alternative documentation 
was accepted. These commenters expressed concern that victims of 
domestic violence would be forced to disclose their history of abuse 
and that information about their location and any name changes would be 
widely accessible in State databases of driver records. They 
recommended that a generic statement be added to records of victims of 
domestic abuse that would indicate that alternative documents were 
accepted ``for reasons of public safety.'' Three commenters said that 
it would not be feasible for States to mark exceptions in their data 
files until they complete computer system upgrades.
    Response: DHS agrees that States may use statements like ``for 
reasons of public safety'' or similar generic expressions when using 
the exceptions process for victims of domestic violence or others, 
where the State feels it is necessary to preserve the confidentiality 
of the reason the exceptions process was used.
    Comment: Some commenters suggested that the exceptions process be 
broadened to include specific populations of individuals who may have 
problems producing the required documents, who may not spend the 
majority of time at home (out-of-State students, active military 
personnel), or who may not be able to come to the DMV in person 
(individuals with disabilities). Other commenters, including AAMVA, 
suggested that the exceptions be related to risk and could factor in 
year of birth or duration of continuous relationship with the State of 
licensure. Similarly, one State suggested that the rule grandfather all 
current holders of driver's licenses or identification cards that were 
previously verified as lawfully-present through SSOLV and/or SAVE.
    Response: As noted above, DHS does not believe it would be 
beneficial to establish a uniform exceptions process for all States. 
DHS recognizes that each jurisdiction may face its own unique and 
particular set of facts and circumstances to resolve and that DHS is 
unable to address all such circumstances. DHS believes that States must 
have the flexibility to craft an exceptions process adequate to the 
needs of their State and recognizes that no two State exceptions 
processes may be identical.
    DHS does not agree with the comment that individuals can be 
``grandfathered'' for REAL ID purposes. The fact that an individual 
once had lawful status in the United States when checked through SAVE 
is not indicative of his or her present status. As noted elsewhere 
above, DHS does not believe it is burdensome to require an SSOLV check 
for all persons seeking a REAL ID driver's license or identification 
card.

H. Temporary or Limited-Term Driver's Licenses and Identification Cards 
[Sec.  37.21]

    Comment: Two commenters said that use of the term could cause 
confusion with other license types and requested that another label 
such as ``limited-term'' be substituted to avoid confusion. One 
commenter suggested that temporary cards indicate on the face whether 
the holder is a citizen or non-citizen because any immigration status 
can be lost or revoked or expire at any time during life of the card.
    Response: DHS agrees with these commenters. DHS has added the 
phrase ``limited-term'' to avoid any confusion with existing State 
licensing schemes involving temporary driver's licenses or 
identification cards. The section of the rule is now entitled 
``Temporary or Limited-Term Driver's Licenses and Identification 
Cards.''
    Comment: Two States said that matching the expiration date of a 
temporary driver's license or ID card to the end date of an applicant's 
authorized stay would require major internal system and business 
process changes and may also require a legislative change in some 
States.
    Response: DHS notes that matching the expiration date of a 
temporary or limited-term driver's license to the end date of an 
applicant's authorized stay in the United States is a requirement of 
the statute that DHS lacks the authority to change.
    Comment: Several commenters opposed the provision limiting the 
duration of temporary licenses or ID cards to the duration of admission 
or to one year if the applicant's authorized stay does not have a fixed 
expiration date. Numerous commenters cited concern with how the period 
of authorized stay is determined, in the

[[Page 5299]]

event, for example, that a person has a visa that expires in two years 
but the I-94 expires in two months. One country urged DHS to accept the 
term of validity of the visa, which are generally valid for relatively 
long periods, as the ``period of time of applicant's authorized stay.''
    Response: These comments cannot be accepted. Section 
202(c)(2)(C)(ii) of the Act requires that the duration of the driver's 
license to be limited to the period of the person's authorized stay or 
in the case of no specific period, a duration of one year. DHS does not 
have the authority to amend or change this direct statutory 
requirement. The period of admission will be determined not by 
documents themselves, but with the use of the SAVE system which can 
best identify a person's lawful period of admission. Finally, a visa 
cannot be considered to be a person's period of authorized stay as a 
visa only allows a person to apply for admission to the United States. 
It does not represent, in any sense, permission to stay within the 
United States for any particular period of time.
    Comment: Commenters said that this provision would be unduly 
burdensome for many individuals who have lawful status for extended 
periods of time, such as F and J visa holders, and specifically 
expressed concern that the rule is eliminating a long-standing 
provision for J-1 participants, who, under State Department 
regulations, are entitled to a thirty-day grace period after completion 
of their programs to travel within the United States One of these 
commenters suggested that States be allowed to use the end dates listed 
on the certificates of eligibility for each of these visa types as the 
``ending date'' of status for the purpose of obtaining a driver's 
license.
    Response: Again, the determination for lawful status in the United 
States will be made by the SAVE system, not particular documents. SAVE 
takes into account the grace periods to which those in certain F and J 
statuses are generally entitled. It should be noted, however, that 
since F and J non-immigrants are admitted for ``duration of status,'' 
which is an indeterminate period, they would normally be issued 
licenses valid for one year.
    Comment: Two States said that annual, in-person enrollment for 
these individuals would provide little added homeland security value 
while overcrowding DMV offices.
    Response: DHS agrees in part with these comments. The final rule 
provides that individuals holding REAL ID cards that are not temporary 
or limited-term may renew remotely where there has been no material 
change in the individual's information (i.e., name or lawful status) 
and the State re-verifies the individual's lawful status and SSN where 
applicable. Because lawful status can change over time, DHS believes 
that it is necessary for a State to determine that these individuals 
remain in lawful status prior to extending the validity period of any 
REAL ID-compliant driver's license or identification card.
    Comment: Three commenters asked DHS to clarify whether temporary 
driver's licenses and ID cards need to have the security features of 
REAL ID-compliant documents.
    Response: Temporary or limited-term driver's licenses and 
identification cards qualify as REAL ID-compliant documents so they 
must contain the same security features as any full-term REAL ID 
driver's license or identification card.
    Comment: One commenter asserted that temporary driver's license or 
identification cards should not be permitted because international and 
foreign licenses are valid for individuals who are in the United States 
for less than one year.
    Response: The REAL ID Act permits States to issue temporary or 
limited-term driver's licenses and identification cards. States will 
continue to determine how long an individual must be present or have 
residence in a State before the State requires that person to obtain a 
driver's licenses or identification card. Nothing in these rules 
precludes States from permitting an individual to use an international 
or foreign license to operate a motor vehicle in a State.
    Comment: Commenters had specific comments about how this annual 
renewal provision would affect particular groups. Several domestic 
abuse advocacy organizations said that the annual requirement would 
give more power to abusers who have confiscated or destroyed the 
identification documents of their victims. One commenter said that DHS 
needs to amend the rule because the confidentiality requirements under 
the Violence Against Women Act (VAWA) preclude entry of certain 
immigrant victims into the SAVE system. The group suggested that if 
yearly renewal is required of immigrant victims, it should use the fax-
back system developed by the INS to verify eligibility for Federal 
public benefits. A State expressed concern with DHS having defined 
``sexual assault,'' ``stalking,'' ``[d]omestic violence,'' and ``dating 
violence'' in establishing exceptions for the REAL ID requirement to 
display an individual's principal residence address on the license or 
identification card. The State argues that the proposed regulation 
would require that any State wishing to comply with the regulations 
must adopt the Federal definition of these crimes. This commenter 
argues that DHS can avoid this Federalism implication by allowing 
States to continue to decide who should be protected under address 
confidentiality programs.
    Response: DHS agrees, in part, with these comments. The final rule 
clarifies any misperception in the NPRM that a State would have to 
adopt the VAWA definition of certain terms, and makes it clear that 
States can continue to enroll and safeguard victims based on their own 
laws. DHS disagrees with the comments that the renewal requirement 
conflicts with any provisions of VAWA. If an individual's identity 
documents have been destroyed by an abuser, a State can address this 
situation through its exceptions process.
    Comment: AAMVA, two other commenters, and four States expressed 
concern with the proposed requirement that a temporary document clearly 
state on its face that it is temporary. The commenters said that 
modifying cards to comply with the proposed rule would be costly and 
suggested that the rule instead allow States to use a restriction code 
on the front with clarifying language on the back. One State requested 
that DHS provide the exact wording that must be displayed on the face 
of a temporary card. One privacy group said that identifying the card 
as temporary on its face would amount to a ``scarlet letter'' for 
immigrants and would lead to discriminatory interactions with police 
and other individuals. One State commented that it does not support the 
``facial branding'' of cards.
    Response: DHS does not agree with these comments and has clarified 
the rule to state that a temporary or limited-term license must 
indicate on the license and in the machine-readable zone that it is 
temporary. States may use different methods to indicate the temporary 
nature of the license, such as using restriction codes on the front of 
the card and explanatory text on the back of the card.
    Comment: AAMVA and one State said that they support in-person 
renewals for temporary REAL ID driver's licenses or identification 
cards because lawful status can change and the population of 
individuals with temporary lawful status is far smaller and easier to 
manage with in-person renewals than the larger population of U.S. 
citizens. In contrast, one State requested that DHS allow applicants to 
mail in copies of the appropriate documents proving lawful status as 
long as the State verifies the information via the SAVE system. One

[[Page 5300]]

commenter suggested that foreign students be allowed to renew online if 
they are required to do so annually. One State questioned how many one-
year terms of extension would be permitted if length of stay is not 
specified on a submitted Federal immigration document. Two States wrote 
that after an applicant obtains a REAL ID card, the applicant should 
not have to re-supply source documents for renewals or conversions. 
Several States suggested that the rule state that notice of change of 
address may be made on-line or by mail as long as electronic 
verification can be accomplished.
    Response: DHS agrees with the AAMVA comment that individuals 
holding a temporary or limited-term license must renew in person in 
order to present evidence of continued lawful status. DHS believes that 
this is necessary because lawful status can change, and this policy is 
consistent with the language of the REAL ID Act. As such, the 
requirement remains unchanged from the NPRM.
    Changes of address may be made on-line, by mail, or as otherwise 
permitted by the DMV. There are no limits on how many years a State can 
issue a one-year license or identification card to an individual who is 
present for an undetermined ``duration of status'' as long as that 
individual remains in that lawful status or another.
    Comment: Numerous States expressed concern that the current 
processing time involved in USCIS review of applications for various 
immigration statuses impacted by REAL ID will result in a large number 
of applicants who wish to renew their licenses but their applications 
to extend their status has not been acted on by USCIS within the year. 
Two States suggested that States issue interim documents that would be 
valid for very short periods until an applicant receives his or her 
permanent document demonstrating lawful status. Another commenter 
suggested that such an interim card be based on the applicant's visa 
until authorization is received and verified through SAVE, which should 
be programmed to contact the querying State when there is an updated 
applicant status. One commenter recommended that the rule allow States 
to use a license expiration date 90 days beyond the expiration date of 
the immigration document to allow for USCIS processing of applications 
to extend lawful status. Commenters said that individuals in certain 
statuses will not be able to comply with the requirement to present 
documentation showing extended lawful status upon renewal because in 
most cases, their statuses will not have been extended but merely 
continued.
    Response: Again, State DMVs will use the SAVE system, and not 
particular documentation, to determine that the license applicant is in 
lawful status. An application that is properly filed with USCIS 
entitles the person to remain in lawful status beyond the period listed 
on the person's Form I-94 or other immigration document, that 
information is reflected in the SAVE system. Thus, aliens in these 
situations would be able to obtain REAL ID-compliant licenses and 
States would not have to add any additional processes with USCIS.

I. Minimum Driver's License or Identification Card Data Element 
Requirements

1. Full Legal Name
    Comment: Many commenters raised issues about the concept of full 
legal name. One commenter stated that the provision infringes on powers 
reserved to the States in that it dictates to the States acceptable 
methods for name changes, and that it effectively nullifies the common 
law name change process that some States permit. Proposed Sec.  
37.11(c)(2) would have required the applicant to present documents 
showing a legal name change, but several commenters pointed out that 
these documents may come from local or foreign government sources in 
addition to Federal and State governments. Two States opposed the 
proposed requirement to present these documents, and an individual 
opposed having name change information on the REAL ID. One State 
suggested that the rule also should provide instructions for 
individuals whose gender has been legally changed.
    Response: DHS agrees that where State law or regulation permits an 
individual to establish a name other than that contained on the 
identity document he or she presents for a REAL ID driver's license or 
identification card, the State shall maintain copies of the 
documentation presented pursuant to Sec.  37.31 and maintain a record 
of both the recorded name and the name on the source documents in a 
manner to be determined by the State. The use of initials or nicknames 
shall not be permitted, except to the extent that an initial is 
necessary to truncate a name longer than 39 characters in length, in 
which case the name should be truncated pursuant to ICAO-9303 
standards. DHS also agrees that local or foreign government-issued 
documents can be used to establish a name history. The final rule 
reflects these changes.
    Comment: Numerous States and AAMVA stated that there is no standard 
naming convention for Federal agencies and as a result passports, 
immigration documents, and social security cards list disparate names, 
making identifying the full legal name difficult. Many States commented 
that the Federal government needs to adopt a single standard for full 
legal name and apply it to all Federal records, rather than depending 
on the State DMVs to resolve this in the face of multiple Federal 
approaches. Due to discrepancies among naming conventions, one 
commenter suggested that DHS provide a list of most acceptable to least 
acceptable documents used to establish full legal name. Several 
commenters wrote that documents evidencing a name change may come from 
local or foreign government sources in addition to Federal and State 
governments.
    Response: DHS agrees that there is no standard naming convention 
currently used by Federal agencies. It would be beyond the scope of 
DHS's rulemaking authority to impose such a convention on all Federal 
agencies. Nevertheless, the lack of a common Federal standard does not 
mean that DHS should not establish minimum standards for the States to 
follow as required by the REAL ID Act. However, based on comments 
received, DHS is slightly modifying the definition of the definition of 
``full legal name'' to bring it closer to existing name conventions 
used by the Social Security Administration, the Department of State, 
and other issuers of source documents.
    Comment: AAMVA and numerous States commented that the States need 
flexibility and DHS should drop the prohibition against using initials 
and nicknames. One State wrote that the name on the driver's license 
should be the one the person chooses to use, with the full legal name 
stored in the database and in the MRZ, and that without common naming 
conventions, it is imprudent to assume that a regulatory requirement 
forcing the public to adopt a single name will achieve any desired end. 
One State commented that it should be able to use an alternative name 
if the applicant's source documents clearly show a link between that 
name and the name presented on other source documents.
    Response: As noted above, DHS agrees that where State law permits 
an individual to establish a name other than that contained on the 
identity document presented for a REAL ID driver's license or 
identification card, the State must maintain a record of how the name 
was established in a manner to be prescribed by the State. The use

[[Page 5301]]

of initials or nicknames shall not be permitted, except to the extent 
that an initial is necessary to truncate a name longer than 39 
characters in length, in which case the name should be truncated 
pursuant to ICAO-9303 standards. Where the individual has only one 
name, that name should be entered in the last name or family name 
field, and the first and middle name fields should be left blank. Place 
holders such as NFN and NMN should not be used.
    Comment: Both States and victim advocacy groups objected to the 
full legal name requirement because the rule would not provide 
exceptions for victims of domestic violence. The rule would require 
that past names be included in DMV records, which would expose victims 
to danger. In addition, the SSA requires victims to change their names 
before changing SSNs and prohibits them from revealing previous names 
and SSNs. Commenters wrote that the proposed rule conflicts with this 
prohibition by requiring that the previous names be revealed as well as 
with the court orders under which many victims are granted new 
identities.
    Response: The REAL ID Act does not include any exceptions for 
victims of domestic violence not to provide their full legal names. 
DMVs may want to take appropriate measures to protect the 
confidentiality of those records so that a stalker or victimizer could 
not use the DMV database to locate the individual.
    Comment: Many commenters noted concern with the name requirement 
for the MRZ, particularly inclusion of the name history on the MRZ. 
States questioned whether some name histories would fit on the MRZ. 
Others questioned the need for the requirement if the history is 
available in the State DMV database and cited the potential for abuse. 
Many also commented that the requirement would result in a complete 
rewrite of States' systems and is one of the most costly parts of the 
rule. For example, one State commented that the 125-character field 
would delay its implementation for 3 to 5 years until it can obtain a 
new mainframe.
    Response: DHS agrees with the comments and is no longer requiring 
that the name history be stored on the MRZ.
    Comment: One State asked for guidelines for translating names from 
other alphabets: a name in the Cyrillic alphabet can be changed to the 
Latin alphabet a variety of ways. Another commenter recommended 
referencing the AAMVA name specifications generically rather than a 
particular edition. The commenter also suggested changing ``Roman 
alphabet'' to ``Latin alphabet.'' Commenters noted other problems with 
the full legal name requirement, such as naming conventions in other 
countries and cultures, conversion of these names onto various 
immigration documents, and the ``Americanization'' of foreign names 
when living in the United States.
    Response: DHS has changed ``Roman'' alphabet to ``Latin'' alphabet 
in the final rule. DHS is not requiring any particular transliteration 
method, but notes that both AAMVA and ICAO have published standards 
that address the issues raised in these comments.
2. Gender
    Comment: Two States raised issues about how gender is determined 
for transgender individuals and whether gender will be included as a 
verifiable identifier through EVVE.
    Response: DHS will leave the determination of gender up to the 
States since different States have different requirements concerning 
when, and under what circumstances, a transgendered individual should 
be identified as another gender. Data fields in EVVE are outside the 
scope of this rulemaking.
3. Digital Photograph
    Comment: A number of States objected to the requirement to take the 
applicant's photograph at the beginning of the licensing process 
because doing so would require extensive changes to State processes, 
facilities, and vendor contracts. According to one commenter, only 
seven States currently take an applicant's photo at the beginning of 
the process. One State requested a cost-benefit analysis for taking the 
photograph at the start of the process. One commenter suggested using 
an inexpensive image capture at first, then replacing the image with 
the final digital photo on issuance.
    Response: Under Sec.  202(d)(3) of the REAL ID Act, States must 
subject each person applying for a driver's license or identification 
card to a mandatory facial image capture. Submission of an application 
for a driver's license occurs at the beginning of the licensing 
process, and as such, requires that the photo be taken at the beginning 
of the process. Additionally, from a law enforcement and operational 
perspective, an up-front image capture process serves as a deterrent to 
individuals attempting to present fraudulent documents or to ``office 
shop'' within a jurisdiction when their application may have been 
already denied in another office.
    Comment: A number of commenters objected to the requirement for a 
color photograph because it would bar the use of laser engraving. One 
commenter stated that photographs are better for checking identities. 
However, AAMVA and other States recommended that the required image be 
in color.
    Response: DHS agrees with those commenters that a black and white 
photograph should also be acceptable in order to facilitate the use of 
laser engraving technology by States choosing to employ this technology 
to deter counterfeiters, and the altering and tampering of their 
driver's licenses and identification cards. The final rule has been 
changed accordingly.
    Comment: One commenter suggested that DHS replace the ICAO 9303 
standard's aspect ratio with the AAMVA's aspect ratio, which is the 
Universal Camera Aspect Ratio.
    Response: DHS believes the proposed ICAO aspect ratio, with an 
Image Width: Image Height aspect ratio range of 1:1.25 and 1:1.34, will 
accommodate the AAMVA Universal Camera Aspect Ratio of 1:1.33.
    Comment: Several commenters wrote that requiring photographs could 
burden the free exercise of religion for some groups, such as Amish 
Christians and Muslim women. One commenter noted that banning the 
wearing of veils and scarves would require new State legislation. 
Another commenter asked DHS to clarify that a person may not wear any 
garment that affects the reliability of facial recognition 
technologies. Another State said the regulation should require States 
to refuse a license or ID to anyone who appears in disguise or distorts 
the face when photographed.
    Response: As DHS stated in the preamble to the NPRM, the REAL ID 
Act requires a facial photograph, which serves important security 
purposes. Given these security concerns and the clear statutory 
mandate, DHS believes that a driver's license or identification card 
issued without a photograph could not be issued as a REAL ID-compliant 
driver's license or identification card. Many States now issue non-
photo driver's licenses or identification cards based on the 
applicant's religious beliefs. States may continue to issue these 
driver's licenses or identification cards to such individuals and DHS 
recommends that these driver's licenses and identification cards be 
issued in accordance with the rules for non-compliant driver's licenses 
and identification cards at Sec.  37.71.
    While the final rule does not specifically address individuals who 
appear in disguise or who distort their face when photographed, DHS 
expects that States will implement their own

[[Page 5302]]

procedures to ensure that the photographs are accurate representations 
of the individuals.
    Comment: Some States objected to the requirement for a profile 
photograph for people under 21 years of age because it will defeat 
biometric facial recognition systems. One commenter suggested printing 
the cards with a different orientation to differentiate under-21 
licensees while allowing for facial recognition technologies.
    Response: A typographical error in the NPRM left the misimpression 
that DHS was requiring a profile photograph for individuals under age 
21. The final rule does not require a profile photograph for people 
under 21, and instead requires a full facial digital photograph.
    Comment: One commenter recommended that States be required to share 
their images. Another State commented that the requirement to retain 
images of people suspected of fraud would mean that they had to keep 
all images because the suspicion of fraud may occur long after the 
license is issued, and data storage costs would be significant.
    Response: DHS agrees that there would be substantial value in 
preventing the acquisition of multiple identity documents if States 
were able to exchange images of their license holders with one another. 
DHS believes that the States have the same interest and therefore 
States must ensure that the same individual does not have multiple 
driver's licenses or identification cards from the same State. DHS also 
encourages States to participate in AAMVA Fraud Early Warning System 
(FEWS) or similar system for exchanging information on fraud or 
attempted fraud in the issuance of driver's licenses or identification 
cards. DHS believes that the volume of images of individuals who start, 
but do not complete the application process, will not be so great as to 
impose substantial data storage costs on the States.
4. Address of Principal Residence
    Comment: One State noted that it has a ``homeless exception'' to 
its proof of residency requirement where proof of residency documents 
are waived if the applicant provides a letter, on letterhead, signed by 
the director of a homeless shelter, certifying that the individual is 
homeless and stays at that shelter. It suggested that this be an 
acceptable action under an ``exceptions process'' for the homeless. 
Other States voiced concern that the rule does not address the ``truly 
homeless,'' those not living in a shelter.
    Response: DHS agrees that a letter, on letterhead, signed by the 
director of the homeless shelter, certifying that an individual is 
homeless and stays at that shelter, should be sufficient to establish 
an individual's address of principal residence under a State's 
exceptions process. As noted above, States have wide latitude to 
address issues concerning an individual's address of principal 
residence within their State-specific exceptions process.
    Comment: AAMVA, other commenters, and many States commented that 
DHS allow States the authority to provide for the confidentiality of 
individual's address of principal residence, including the categories 
of individuals who would be subject to the address exception. One 
commenter suggested that DHS devise standard rules governing address 
confidentiality rather than allowing each State to devise separate and 
unique requirements. One State claimed that a confidential address 
program is unnecessary.
    Response: DHS agrees that States should have broad authority to 
protect the confidentiality of the address of principal residence for 
certain classes of individuals. DHS has added additional clarifying 
language in the final rule that should help to alleviate any 
uncertainties.
    Comment: Numerous commenters claimed that the confidential address 
provision in the rule did not address all individuals who may have 
legitimate reasons for protecting their addresses from public 
disclosure. Commenters noted that Sec.  37.17(f)(1) was too narrow and 
would not qualify individuals who would otherwise be protected under 
State law. Several States recommended additional address exceptions for 
the following categories: sitting and former judges, Federal officials 
in limited circumstances, covert law enforcement officers as long as 
the officer provides a letter of authorization, State administrative 
personnel engaged in law enforcement, participants in the witness 
protection program, and victims of domestic violence. One commenter 
stated that the exemption should include family members when laws or 
court orders suppress the addresses of those individuals.
    One commenter claimed that the partial exemption to the principal 
address requirement is inadequate by removing the option of not listing 
an address and relying solely on State laws that cover a limited number 
of individuals. The commenter noted that only 24 States have 
confidentiality programs in place, which is a requirement for the 
exemption to apply. Victims in the remaining jurisdictions will not be 
protected unless they can obtain a court order suppressing their 
addresses. Another commenter wrote that States have created formal 
address confidentiality programs and have also provided general 
measures of residential address privacy and this rule overrides these 
substantial protections.
    Response: As noted above, DHS agrees that States should have broad 
authority to protect the confidentiality of addresses. DHS has 
clarified language in the final rule so that it is clear that a DMV may 
apply an alternate address on a driver's license or identification card 
if the individual's address is entitled to be suppressed under State or 
Federal law or suppressed by a court order including an administrative 
order issued by a State or Federal court.
    Comment: A few States claimed that use of alternative addresses is 
justified on the REAL ID cards, but that the principal residence must 
be captured and stored in a secure database. They requested 
clarification from DHS on how States would meet the requirements 
related to the protection of the principal residence addresses. Another 
State noted that it has no confidential address program, but it permits 
a post office box to be displayed on the identification document if 
requested, but again it retains the permanent address in a database. 
One commenter stated that the better level of protection would be to 
note in the MRZ that the individual's address is protected and provide 
a pointer to whatever relevant authority handles those addresses for 
that jurisdiction. This process would also serve a secondary purpose in 
that anyone seeking the address would make a request that could be 
logged and validated.
    Response: DHS agrees that an individual's true address must be 
captured and stored in a secure manner in the DMV database even if an 
alternate address appears on the face and MRZ portions of the driver's 
license or identification card.
    Comment: One commenter recommended that the final rule allow courts 
to issue administrative orders suppressing the collection of REAL ID 
information or its display on identification documents in any 
jurisdiction where the legislature has not acted to protect privacy.
    Response: DHS agrees with this comment and has changed the final 
rule to reflect that an address may be suppressed by a court order 
including an administrative order issued by a State or Federal court.

[[Page 5303]]

5. Signature
    Comment: Two States and another commenter stated that the rule 
needs to allow for people who cannot sign the card, such as minors, and 
older or disabled persons. If States use a signature match, an 
alternative process must be available.
    Response: DHS agrees with these comments. Section 37.17(g) now 
provides that a State ``shall establish alternative procedures for 
individuals unable to sign their names.'' This language gives the 
States wide latitude in how to address situations where an individual 
is unable to sign his or her driver's license or identification card.
6. Physical Security Features
    Comment: Numerous States and other commenters stated that DHS 
should provide security objectives or performance standards, and not 
specify particular technologies, materials, or methods. AAMVA wrote 
that States are using the AAMVA Driver Licensing/Identification Card 
Design Specification as the minimum standard and to change direction 
now would be costly for States. AAMVA further commented that 
restricting all State-issued driver's licenses and identification cards 
to a single security configuration could introduce new security 
vulnerabilities rather than protect the driver's licenses and 
identification cards against fraud. AAMVA wrote that it is not aware of 
any jurisdiction that uses all the listed security features with the 
proposed card stock in its card design or production. Numerous 
commenters stated that the proposed requirements would eliminate over-
the-counter issuance systems and place an unnecessary financial burden 
on States.
    Response: DHS understands that there are challenges States may face 
in producing secure driver's licenses and identification cards. The 
final rule removes requirements to use specific technologies, and 
provides the flexibility for States to implement solutions using a 
combined set of security features that provide maximum resistance to 
counterfeiting, alteration, substitution, and the creation of 
fraudulent documents from legitimate documents. DHS will work with 
stakeholders to develop performance standards and a methodology for 
adversarial testing.
    Comment: Commenters were concerned that DHS was not targeting its 
security enhancement properly, and that increased security features 
would not accomplish the goal of reducing fraud. AAMVA and another 
State commented that major DMV fraud and abuse issues are not 
associated with the cards, but with source documents that cannot be 
verified, system breakdowns, and people who breach integrity. Another 
State commented that unless airports, Federal facilities, and nuclear 
plants have document authentication systems, implementation of REAL ID 
is without purpose. One State also stated that unless inspectors are 
trained in fraud detection or equipment is available for detection, 
fraud will continue. One commenter recommended that the AAMVA 
fraudulent document recognition training be used.
    Response: DHS agrees, generally, that no single solution eliminates 
all fraud relating to an identity document. That is why the NPRM 
proposed, and the final rule requires, steps to improve internal 
procedures at DMVs as well as the physical driver's license or 
identification card issued by the States. DHS agrees that fraud 
detection training is an important element in an anti-fraud regime and 
endorses the use of AAMVA's fraudulent document recognition training or 
equivalent by the States.
    Comment: AAMVA stated that States cannot consider making any 
changes until existing contracts with card integrators expire or they 
will face high penalties for breaking existing contracts; any change 
would require States to proceed though the competitive bidding 
processes, evaluate proposals, award new contracts, and implement the 
complex and expensive process of re-engineering their issuance 
processes. Any wholesale change in card design will be costly, complex, 
and time consuming. Several States also noted that contractual 
processes will slow implementation.
    Response: DHS understands that existing vendor contracts make it 
difficult for some States to make changes during the term of their card 
contracts. The final rule provides flexibility in card solutions. DHS 
will require States to take appropriate measures to issue driver's 
licenses and identification cards that are resistant to tampering, 
alteration or counterfeiting.
    Comment: Commenters, particularly States that issue driver's 
licenses and identification cards ``over the counter,'' objected to 
check digit specification, unique serial number, application of 
variable data, and laser printing. One commenter supported associating 
card stock serial number with a customer. One State agreed with 
incorporation into the card of taggant (a radio frequency 
identification chip) and marker, but said that only State employees 
need to know if the State is using such embedded technology. One State 
noted that it uses seventeen overt, covert, and forensic security 
features to make counterfeiting difficult; it recommended that States 
use different designs and combinations of security features to deter 
counterfeiters. One commenter wrote that the proposed rule includes a 
requirement for an optically variable feature and suggests that a 
``diffractive optically variable feature'' be included to enhance 
protection. The commenter said it is unclear how this feature enhances 
protection over existing State-issued driver's licenses and 
identification cards as many already use such technology. The commenter 
recommended optically variable ink as a security feature. This ink 
technology, currently used in U.S. passports and outlined in the FIPS 
201 security standards, is not reproducible using commonly used or 
available technologies, and requires much less training to authenticate 
quickly. No readers or special equipment are required to observe the 
color shifting effect, meeting the requirements in the proposed rule 
for a Level 1 security feature. Additional forensic security, such as 
micro-flakes with etched on numbers, logos or words that are visible 
under low-power magnification can be included in the micro-flakes of 
the overt optically variable color shift technology, meeting the 
requirements in the proposed rule for Level 2 and Level 3 security 
features.
    Response: The final rule provides for a performance-based, not 
prescriptive, approach to card solutions. Specific security 
requirements are not mandated in the rule. However, the final rule 
includes requirements for three levels of document security designed to 
provide maximum resistance to counterfeiting, alteration, substitution, 
and the creation of fraudulent documents from legitimate documents that 
are not reproducible using common or available technologies. DHS 
encourages States to explore the range of existing and still-to-be 
developed technologies in this area. The final rule requires States to 
use card stock and printing materials that are not widely available 
commercially in order to significantly decrease the likelihood that a 
driver's license or identification card could be easily counterfeited 
or altered.
    Comment: One commenter recommended inclusion of a digital signature 
as a Level 3 security feature.
    Response: The final rule provides for performance-based, not 
prescriptive requirements for implementation. While digital signatures 
offer a higher level of security, States may choose to invest in other, 
similarly secure technologies.

[[Page 5304]]

DHS encourages States to consider the use of this and other security 
features.
    Comment: States asked for clarification as to the meanings of 
``inspector,'' ``microline text,'' ``micro print,'' ``external 
surfaces,'' ``taggant,'' and ``marker.''
    Response: DHS has removed the requirements involving these terms, 
so does not need to clarify these terms.
    Comment: Two commenters stated that security features should not 
make it impossible to copy or create a digital image of a license, and 
that the rule should make it clear that any print on the image must not 
obscure the features. One State asked that DHS remove language 
forbidding reproducible security features and retain Sec.  37.15(f)(2).
    Response: DHS agrees that the security features employed should not 
make it impossible to copy or create a digital image of a license. Many 
private sector industries, including the banking sector, often need to 
reproduce and retain a copy of an individual account holder's driver's 
license or identification card. DHS also agrees that print on the image 
should not obscure the individual's features.
    Comment: One commenter recommended incorporating some security 
features in the substrate.
    Response: The final rule requires level 1, 2 and 3 security 
features that provide multiple layers of security, and States may adopt 
security features that meet their needs, including incorporating 
security features into the substrate.
    Comment: One commenter stated that requiring a color photo and 
laser printing means that two printers will be needed.
    Response: The final rule allows for either a color or black and 
white photograph. Laser engraving, while a very effective security 
measure, is not a requirement of this rule.
    Comment: One State commented that it currently uses adversarial 
testing for its cards and provided detailed information on its process. 
AAMVA and several States said that there are no adversarial testing 
standards and that DHS should develop them and either take 
responsibility for testing the cards or certify the testing 
organizations. Another commenter recommended that there should be a 
single center for adversarial testing using a single set of criteria to 
avoid the undue influence of vendors and disparate standards. Some 
States suggested alternatives to adversarial testing, such as card 
design security programs or security audits. One commenter suggested 
that adversarial testing occur only if the State card has changed 
rather than annually. Another commenter recommended testing every five 
years or at contract changes.
    Response: The development of standards and adversarial analysis and 
testing of driver's licenses and identification cards is an effective 
approach to ensuring that these documents provide maximum resistance to 
counterfeiting, simulation, alteration and creation of fraudulent 
driver's licenses and identification cards. DHS will work to develop 
performance standards and adversarial analysis and testing.
    Independent adversarial testing is an important tool in limiting 
the ability of someone to tamper, alter, or counterfeit a driver's 
license or identification card. DHS agrees with the comments that there 
are no recognized testing standards to date and a lack of available and 
accredited testing facilities. Therefore, DHS has removed the 
requirement for States to obtain an independent adversarial test of 
their card security.
    Comment: Numerous commenters objected to the card stock 
requirement, stating that the NPRM design specification essentially 
calls for polycarbonate material and AAMVA and its members do not 
support polycarbonate as the only option for the cards. This material 
is not used anywhere in the United States today, is the highest cost 
card material in production today, and is only available from a limited 
number of vendors, which negates State requirements for competitive 
bidding. Another commenter noted an inconsistency between polycarbonate 
card stock and the requirement to meet ICAO 9303. The ICAO standard 
requires a color photo, but polycarbonate card stock allows only black 
and white photos.
    Privacy groups supported use of polycarbonate cardstock in 
conjunction with laser engraving because laser engraving on other card 
stocks may be removable. One commenter indicated that other stocks 
would function as well. Another commenter stated that requirements for 
card stock durability should be based on the renewal period used by the 
State. One State asked to whom missing card stock should be reported.
    Response: The final rule reflects a less-prescriptive approach to 
card security, and does not mandate the use of a specific card stock 
and prescriptive security features. The final rule requires States to 
use card stock and printing methods that are not widely available 
commercially in order to significantly decrease the likelihood that a 
driver's license or identification card can easily be counterfeited or 
altered. States should develop and utilize a system of reporting 
missing card stock and other secure supplies and equipment related to 
the production of driver's licenses and identification cards to other 
State DMVs and law enforcement.
7. Machine Readable Technology
    Comment: Privacy groups and several States recommended laws 
limiting the collection and storage of Machine Readable Zone (MRZ) data 
by third parties. Several other States commented on the importance of 
accessibility for law enforcement and noted that the same information 
is available on the front of the identification cards in human-readable 
form. Some commenters wanted MRZ access restricted to law enforcement, 
while others supported also providing access for bars and liquor stores 
to help prevent underage drinking but limiting their collection and 
storage of the personal information. One commenter stated that nothing 
in the REAL ID Act authorizes Federal agencies to read and collect 
information contained in the MRZ and cited to the Conference Report 
statement that the MRZ must only be able to be read by law enforcement 
officials. One commenter opposed any indication in the MRZ that a 
person was an owner or buyer of firearms or was licensed to carry a 
firearm; the commenter also asked that DHS forbid the inclusion of this 
information unless required by State law.
    Response: The REAL ID Act does not provide DHS with authority to 
prohibit third party private-sector uses of the information stored on 
the REAL ID card. As noted in the proposed rule and the PIA issued in 
conjunction with the rulemaking, at least four States (California, 
Nebraska, New Hampshire, and Texas) currently limit third-party use of 
the MRZ, and AAMVA has issued a model Act limiting such use. DHS 
encourages other States to take similar steps to protect the 
information stored in the MRZ from unauthorized access and collection. 
In response to commenters urging that the rule limit Federal agency 
access to the MRZ, DHS is not aware of any current plans by Federal 
agencies to collect and maintain any of the information stored in the 
MRZ. If a Federal agency should decide to use the MRZ to collect and 
maintain personally identifiable information in the future, any such 
information collected from the MRZ will, of course, be subject to the 
protections of the Privacy Act and other Federal laws and policies 
regulating the use and handling of personally identifiable information. 
This final rule does not require (and the NPRM did not propose) that 
the MRZ

[[Page 5305]]

contain any information about firearm ownership.
    Comment: Many commenters suggested data elements that should or 
should not be in the MRZ. AAMVA stated that the final rule should limit 
the MRZ elements to those set out in its driver license card design 
standard. Another commenter wrote that DHS should set the minimum data 
elements in the MRZ at zero and the maximum at full legal name, date of 
birth, and license number. Other commenters stated that data on the MRZ 
should be limited to what is on the face of the document. One State 
recommended inclusion of the issuing State in the MRZ to facilitate the 
routing of NCIC inquiries by law enforcement agencies using in-car bar 
code reading equipment. Another commenter suggested limiting the MRZ 
data to a pointer that does not correspond to the ID number that would 
link to a database limited to law enforcement. One commenter 
recommended including the digital image in the MRZ using the ISO/IEC 
18013-2 standard. Two States opposed including an inventory control 
number (ICN). One commenter objected to the PDF standard because the 
NPRM preamble had referenced adopting most of the data elements in the 
2005 AAMVA Driver's License/Identification Card Design, which includes 
coding for race.
    Response: The final rule mandates that the States use the PDF417 2D 
bar code standard with the following defined minimum data elements: 
Expiration date; holder's legal name; issue or transaction date; date 
of birth; gender; address; unique identification number; revision date 
(indicating the most recent change or modification to the visible 
format of the license or identification card); inventory control number 
of the physical document; and State or territory of issuance. The 
proposal in the NPRM to include the full name history, including all 
name changes, has been dropped. Race is not a data element contemplated 
in this rulemaking and the reference in the NPRM to the AAMVA standard 
was not intended to include race as a data element in the MRZ for REAL 
ID.
    The majority of commenters on the issue of data elements 
recommended limiting the data elements to those needed by law 
enforcement and the DMVs to carry out their duties. The final rule sets 
the minimum elements to include, but recognizes the authority of the 
individual States to add other elements such as biometrics, which some 
currently include in their cards.
    Changes in technology in the future may enable the States to reduce 
the elements to a pointer that would electronically link to a database 
and provide only authorized parties access to information that today is 
stored in the MRZ. The current technology available to State DMVs and 
most law enforcement officers, however, does not provide that 
capability.
    Comment: Several commenters said the 2D barcode is easily copied 
and reproduced. One commenter supported the 2D barcode, but noted that 
it is not meant to be a security feature; the 2D barcode does not allow 
an upgrade of an encryption scheme, does not employ dynamic forms of 
authentication, does not store audit trails, and does not use other 
security features. One commenter stated that the rule for the barcode 
was insufficient, particularly that there was no barcode standard 
specified which would facilitate the common machine readable technology 
requirement mandated by the REAL ID Act. Two existing standards could 
provide the basis for what is needed: One is the AAMVA format and the 
other is the format in the draft of part 2 ISO standard 18012. However, 
the proposed rule required fields that are specified differently or are 
just not in either of these standards. One commenter objected to the 
standard because the selected version includes coding for race. One 
commenter stated that mandatory requirements make it difficult to keep 
up with technology. A security group and one State stated the bar code 
should include a revision date.
    Response: DHS recognizes that a 2D barcode may have security 
vulnerabilities and technology limitations compared to other available 
technologies. However, the PDF417 2D barcode is already used by 45 
jurisdictions and law enforcement officials across the country. A 
different technology choice could hamper law enforcement efforts and 
may pose an additional financial burden on the States. DHS supports 
efforts of States to explore additional possible technologies in 
addition to the PDF417 2D barcode.
    DHS disagrees with the notion that the standard selected should be 
rejected because it includes coding for race. DHS has never stated that 
race should be encoded on the license, and specifically stated in the 
proposed rule that it was not incorporating wholesale the card data 
elements currently required by AAMVA.
    Comment: One commenter supported the decision to omit an RFID 
device. It stated, however, that the NPRM does not discuss what 
information from a card should be made available digitally and what 
purpose it would serve.
    Response: DHS is not requiring that States employ RFID in REAL ID 
Act cards; rather the only technology required by the final rule is the 
use of the PDF417 bar code, which most States already use on their 
cards. The information stored on the MRZ enables law enforcement 
officers to compare the information on the MRZ with the information on 
the front of the card to determine whether any of the information on 
the front has been altered and to automatically populate law 
enforcement reports, increasing officer safety. The ability to run the 
MRZ through a scanner device also enables an officer to quickly 
retrieve the information on the card and request from their dispatch 
office additional information on the individual, while maintaining 
visual contact with a suspect, a safety consideration for the officer.
8. Encryption of MRZ Information
    Comment: Commenters were divided on whether some or all data in the 
MRZ should be encrypted. In general, groups concerned with privacy 
issues supported encryption, although one commenter argued that 
encryption would provide a false sense of security. Three States 
supported encrypting MRZ data. Groups supporting encryption cited the 
following:

--The capture of data by other users, such as financial, retail, or 
commercial institutions that could retain, use, and sell the personal 
data.
--The possible inclusion of additional private information in MRZ, such 
as residential address, race, [trans]gender, or legal name history that 
could expose the holder to harm if captured and revealed.
--Congressional intent to limit use of the data to law enforcement.

    Some commenters stated that if DHS does not mandate encryption, it 
should at least not prohibit it. Others supported encryption of only 
some data, specifically data not available on the front of the card. 
One supporter stated that DHS should have done a comprehensive analysis 
of encryption systems and their costs and presented that data.
    Numerous other commenters, including the States and AAMVA, opposed 
encrypting the data. Other commenters were divided among those who 
believed it is feasible to encrypt the data, those who considered it 
infeasible, and those who offered alternative technologies, 
particularly smart cards and public key infrastructure. Commenters 
opposing encryption cited the following reasons:


[[Page 5306]]


--The difficulty of managing encryption keys that could be used to 
decrypt any REAL ID. If a single key was used, once the key was 
compromised, every driver's license issued with the key would be 
insecure. If multiple keys are used (e.g., different keys for each 
State), then every law enforcement agency would have to be able to 
access all of the keys. Multiple keys would limit the threat because 
key compromise would affect fewer driver's licenses, but would increase 
the difficulty of using the MRZ data across the country. Once a key is 
compromised, any license issued using that key would have to be 
replaced to be secure.
--The cost of systems for law enforcement. The costs cited included the 
cost to replace existing readers plus the cost of setting up an 
encryption system and the ongoing costs of managing keys.
--The additional time required for law enforcement. Particularly if 
multiple keys are used, law enforcement and DMV officials may need more 
time to read the data. This added time requirement would limit the 
ability to check the validity of documents quickly, particularly those 
from other States.
--The inability of non-law enforcement to use the data to verify the 
validity of the information on the face of the card. Businesses also 
use the MRZ data to determine if the document is genuine. Eliminating 
that ability would harm businesses that rely on the driver's license 
and would affect the ability of restaurants and bars to confirm ages. 
These businesses can help identify criminal use of false documents 
using the MRZ. Some commenters argued that the government should set 
limits on the retention and use of the data rather than encrypt the 
MRZ.
--The futility of encrypting data present on the front of the card. 
Commenters stated that if the data included in the MRZ are readable on 
the front of the card, encrypting the MRZ provides no protection 
because optical scanning readers are capable of translating the card 
data into a database. The information can also be copied or 
transcribed.

    Response: DHS considered the many comments on this issue and 
acknowledges that the skimming of the personally identifiable 
information from the MRZ raises important privacy concerns. 
Nevertheless, given law enforcement's need for easy access to the 
information and the complexities and costs of implementing an 
encryption infrastructure, no encryption of the MRZ will be required at 
this time. If the States collectively determine that it is feasible to 
introduce encryption in the future, DHS will consider such an effort, 
as long as the encryption program enables law enforcement to have easy 
access to the information in the MRZ. Moreover, DHS, in consultation 
with the States, DOT, and after providing for public comment, is open 
to considering technology alternatives to the PDF417 2D bar code in the 
future to provide greater privacy protections.

J. Validity Period and Renewals of REAL ID Driver's Licenses and 
Identification Cards

1. Validity Period
    Comment: At least two commenters said that the proposed eight-year 
validity period is too long, because it would give counterfeiters and 
forgers too much time to learn how to simulate or alter cards in 
circulation. The groups recommended that DHS require States to adopt a 
validity period of no more than five years. AAMVA and one State said 
that State DMVs should be allowed to determine the duration of their 
licenses based on business processes and needs. A few States said that 
a validity period of no more than eight years would create difficulties 
for elderly and some disabled persons who are clearly not national 
security risks. These States asked for the flexibility to grandfather 
these populations or to issue cards with extended validity periods.
    Response: The REAL ID Act establishes a maximum license validity 
period of eight years. Nothing in the Act or the rules precludes a 
State from adopting a shorter validity period for business, security, 
or other needs.
2. Reverification of Source Document Information
    Comment: AAMVA and several States expressed strong opposition to 
the requirement that States re-verify information and source documents 
for renewals and replacements of driver's licenses and identification 
cards. They said that this requirement would be costly, burdensome, and 
unnecessary in part because of the processes that many States already 
have in place for renewals and replacements. In addition, some 
commenters claimed that the requirement to re-verify source documents 
such as address documentation is impossible to comply with because 
there is no electronic system to do so. One State DMV pointed out that 
because Federal and State databases are not updated in real time, it is 
likely that changes would not be immediately verifiable.
    One State supported requiring re-verification of birth certificates 
because changes to the birth certificate, such as a name change, could 
be made after the original birth certificate verification occurred. 
This suggestion would also allow for matching against State death 
information to prevent fraud. Another State endorsed the re-
verification of information for temporary REAL ID licenses and for 
driver and ID card holders who do not have Social Security numbers.
    Response: DHS agrees with the comments that it is not necessary to 
re-verify all source documents at renewal. DHS proposed this 
requirement in the NPRM since it recognized that the quality of 
recordkeeping in both Federal and State databases would improve over 
time. Instead DHS has amended the rule to require reverification of SSN 
and lawful status prior to renewal and verification of information that 
the State was previously unable to verify electronically.
    Comment: Several State DMVs asked DHS to clarify exactly what they 
would need to do to ``re-verify'' information. For example, one State 
asked if States would be required to verify each source document and 
imaged piece of information if electronic verification systems were not 
available at the time of initial enrollment. One State asked if States 
could use original source documents to re-verify applicant information 
if the documents have expired since the date of original verification. 
Another State asked DHS to explain the difference between ``verified'' 
and ``validated'' as referenced in Sec.  37.23(b)(1)(ii) of the NPRM.
    Response: As noted above, DHS is not requiring States to re-verify 
source documents at renewal. However, States must reverify the SSN and 
lawful status upon renewal and electronically verify information that 
the State was previously unable to verify electronically.
    Comment: AAMVA said that DHS should allow States to determine if 
they want to re-verify information that has already been verified by 
another State. AAMVA said that the new State of residency should be 
able to determine whether to ``re-vet'' an applicant's information. One 
State requested that DHS allow a license transferred from another State 
to be renewed or replaced remotely, even if the new State of residence 
does not have electronic copies of the applicant's identity 
documentation. One State said that the renewal of a REAL ID-compliant 
card should only require the minimum

[[Page 5307]]

combination of a REAL ID document and some proof of address. Another 
State suggested that States be allowed to exempt from re-verification 
applicants who have been verified at initial enrollment as U.S. 
citizens and who have had no changes to name or Social Security 
information. A few commenters mentioned that a birth certificate should 
not be re-verified if there was a copy of it maintained at the DMV.
    Response: The NPRM did not propose any requirements for how a State 
should treat a REAL ID issued by another State except to propose that a 
REAL ID driver's license or identification card be accepted as an 
identity document, to establish name and date of birth. When an 
individual moves from one State to another, the new State would still 
be required to verify the individual's SSN and ensure that he or she is 
lawfully present in the United States
3. Renewals
    Comment: AAMVA recommended that Sec.  37.23 be entirely stricken 
except for paragraph (b)(2)(iii) of the NPRM, which would require 
holders of temporary REAL ID cards to renew them in person each time 
and to present evidence of continued lawful status.
    Response: DHS disagrees with the comment and believes that it is 
necessary to have standards governing the renewal of a REAL ID-
compliant driver's license or identification card.
    Comment: One commenter wrote that the rule would make it far more 
difficult and expensive for current holders of a commercial driver's 
license (CDL) to renew or replace their licenses, that delays and the 
expense in having a license renewed or reissued are particularly 
important for this segment of the population, and that they might force 
drivers to seek other employment altogether.
    Response: DHS disagrees with this comment. DHS has not been 
presented with evidence that CDL holders will be affected 
disproportionately by the REAL ID requirements or that the REAL ID 
requirements will force commercial driver's license holders to seek 
other employment.
    Comment: Commenters expressed strong opposition to the restriction 
that remote transactions would be allowed only if ``no source 
information has changed since prior issuance'' (Sec.  37.23(b)(1) of 
the NPRM). In particular, many States, AAMVA, and other commenters 
wrote that applicants should be able to make address changes without 
having to appear in a DMV office, and that only material changes (e.g., 
name change) should prompt the need for an in-person visit. In general, 
commenters wrote that they do not currently require an office visit for 
address changes, and some said they do not issue a new card when 
notified of an address change. They said that requiring in-person 
visits for address changes would dramatically increase the number of 
visitors to DMV offices, with huge cost increases for State agencies 
(which some DMVs said the Federal government should cover), without 
necessarily improving national security. Some States further commented 
that making address changes more difficult for customers will result in 
these individuals simply not notifying the motor vehicle department of 
new addresses, which creates greater problems for State and local 
government and law enforcement.
    Response: DHS agrees with these comments and has removed the 
requirement that an address change must be accomplished through an in-
person visit to the DMV. Additionally, there is no requirement in the 
final rule for States to issue a new card when notified of an address 
change.
    Comment: DHS received several comments on some of the methods 
listed in the preamble for authenticating identity prior to issuing a 
renewed license.
    Response: Since DHS is only requiring that States establish a 
procedure to ensure that the proper individual is receiving a renewed 
document and is not requiring any specific method, these comments are 
not discussed as they are deemed outside the scope of the regulation.
    Comment: AAMVA commented that the requirement that every other 
renewal take place in-person to allow for an updated photo would 
penalize residents of States with shorter renewal cycles. One State 
suggested that Sec.  37.23(b)(2) of the NPRM should be changed to 
require in-person renewals and recapture of a digital image once every 
sixteen years, regardless of the period of validity of a State's cards. 
Two commenters stated that allowing sixteen years between photo updates 
might be too long because a person's appearance can change 
significantly during that time, and that the usefulness of the photos 
for facial recognition (manual or computerized) would greatly diminish 
over a sixteen-year time period. One State recommended that DHS adopt a 
ten-year in-person renewal cycle. Two States commented that exceptions 
to in-person renewals should be established for active military and the 
elderly.
    Response: DHS disagrees with the comments and is retaining the 
requirement that a new photo be taken at every other renewal of a REAL 
ID driver's license or identification card. Enabling States to maintain 
their own renewal cycles permits States to plan for the flow of people 
through the DMVs. While DHS agrees that an individual's appearance can 
change significantly over sixteen years, DHS has concluded that an 
every-other-cycle photo requirement will meet State needs to reduce in-
person visits at the DMVs while not posing an unacceptable security 
risk. States are free to impose a more frequent photo requirement.
4. Reissuance of Documents
    Comment: One State said that it would be overly burdensome to 
require all applicants for replacement driver's licenses or ID cards 
resulting from lost, stolen, or mutilated documents to personally 
appear at a DMV office. Another State wrote that, in many instances, 
the affected customer will not have the supporting documents readily 
available, which may result in some individuals driving without a 
license.
    Response: DHS agrees with the comments. In the final rule, States 
may replace a lost, stolen, or mutilated document without requiring an 
in-person transaction. Current State practices will dictate what 
documentation needs to be presented for replacement driver's licenses 
and identification cards.
    Comment: Some States, AAMVA, and several other commenters 
recommended against requiring a new card for address changes and asked 
that DHS allow States to propose interim methods of tracking address 
changes between renewal cycles without the requirement for issuance of 
a replacement card (unless State law requires it).
    Response: DHS agrees with the comments. The final rule does not 
mandate that a State reissue a driver's license or identification card 
for an address change unless otherwise required by State law.
    Comment: A number of States suggested that the definition of 
``reissued'' be changed to indicate that the license contains material 
changes to the personal information on the document. An applicant for a 
``reissued'' document would be required to personally appear at a DMV 
office to provide proof of the change. Furthermore, the State suggested 
that DHS create a definition of ``duplicate'' as a card that was issued 
subsequent to the original document that bears the same information and 
expiration date as the original.
    Response: DHS agrees with the comments. The final rule does not 
mandate a personal appearance at a

[[Page 5308]]

DMV for a reissued driver's license or identification card unless 
material information, such as name or lawful status, has changed. The 
final rule adopts the proposed definition for a duplicate card.

K. Source Document Retention

    Comment: AAMVA expressed concern about the proposed requirements 
dealing with transferring document images and linking document images 
to the driver record, and opined that the requirement to color scan and 
exchange documents using AAMVA's Digital Image Exchange program is 
misplaced. Another commenter stated that this program deals only with 
photos and that ``it would be a giant leap to consider its use for 
documents.'' Several commenters objected to the costs of purchasing 
scanners, using computer storage space, retaining color images, and 
integrating the image into the driver record. Some commenters believed 
the document retention period should be the same for paper copies and 
electronic storage, while others believed that the retention period for 
paper copies should be shorter than electronic. A few commenters 
pointed out that the Driver Privacy Protection Act and State laws had 
their own record retention requirements. Some commenters objected to 
the storage of documents containing sensitive personal information as 
such documents are attractive target for criminals and hackers, and 
thereby pose significant privacy and security risks.
    Response: The specific record retention period for imaged documents 
and paper documents is required by the REAL ID Act and the final rule 
applies those time periods. However, DHS agrees with the comments that 
some source documents may contain sensitive personal information and 
has modified the document retention requirements for birth 
certificates. Under the final rule, a State shall record and retain the 
applicant's name, date of birth, certificate numbers, date filed, and 
issuing agency in lieu of an image or copy of the applicant's birth 
certificate, where such procedures are required by State law and if 
requested by the applicant.

L. Database Connectivity

    Comment: AAMVA stated that DHS has yet to provide specific 
information on how this ``query'' system will work and does not expect 
to provide that information until the comment period is over. AAMVA 
wrote that final rulemaking should not take place until there is 
opportunity for another round of comments and an extension of 
compliance dates.
    Privacy groups argued that the proposal does not define security 
standards or a governance structure for managing any of the shared 
databases and systems. In their view, this abdication places the States 
in an impossible position: they are being forced to make their own 
citizens' personal information available to every other State with no 
guarantee of privacy or security.
    One commenter recommended that the PCI Data Security Standards that 
apply to the credit card industry should be applied to DMV databases. 
One group suggested a decentralized query system that allows States to 
check all other States to see if an applicant already holds a REAL ID 
and returns a yes or no answer, rather than providing detailed data. 
One commenter recommended audit logs and audits to ensure compliance 
with privacy policies.
    Response: DHS has provided a brief overview of the proposed 
architecture for data verification and State-to-State data exchange in 
the sections above. This architecture will likely build on the existing 
architecture of AAMVAnet and the systems design principles of its 
hosted applications. The proposed architecture will also build upon the 
security, privacy and governance principles that have guided AAMVA and 
the States for decades.
    In addition, DHS will work with DOT, AAMVA and the States to 
reinforce the security and privacy features of this communications and 
systems architecture.
    Comment: A commenter stated that DHS had exceeded its authority in 
the requirement that interstate access must be ``in a manner approved 
by DHS.'' This commenter stated that since the rule does not describe, 
even in general terms, what the approval is based upon, States are left 
to guess at the DHS criteria for approval. Since the database exchange 
and the connectivity thereto are of utmost importance to States, the 
conditions upon which approval will be based need to be specified in 
the rule. They should not be provided by some yet to be developed 
guideline issued by DHS after the rule has become final.
    Response: DHS will work with DOT, AAMVA, and the States to develop 
a path forward for both verification systems and State-to-State data 
exchange, including criteria DHS will employ to evaluate the adequacy, 
security, and reliability of such data exchanges.

M. Security of DMV Facilities Where Driver's Licenses and 
Identification Cards Are Manufactured and Produced

1. Physical Security of DMV Facilities
    Comment: A few States said the security requirements would force 
closure of many DMV offices. At least one State said that the security 
requirements would lead to closure of remote offices, and that this 
could lead the State to opt out of complying with REAL ID requirements.
    Response: In general, DHS does not agree with comments that 
indicate a State would prefer to have a security vulnerability rather 
than take the necessary steps to close it. There have been a number of 
well-documented instances where DMV offices have been burglarized and 
the equipment and supplies to manufacture driver's licenses and 
identification cards taken, highlighting the need to ensure that 
adequate procedures are in place to protect the equipment and supplies 
necessary for the production of REAL ID driver's licenses and 
identification cards. Protecting these materials and equipment are 
critical to reducing the possibility of fraud and identity theft.
    Comment: While a few States supported the proposed ANSI/NASPO-SA-
v3.OP-2005, Level II standard, numerous States said that this standard 
was intended to apply to manufacturing facilities, not to the issuance 
of driver's licenses. The commenters opposing use of the ANSI/NASPO 
standard stated that until a reasonable standard is developed, States 
should have the flexibility to determine what works for their issuance 
processes. Privacy groups are concerned that without a uniform 
standard, States could have 56 different security and privacy policies 
with different levels of protection.
    One State supported a narrow application of the ANSI/NASPO standard 
only to the DMV facility containing the database on license holders, 
while another State thought that the standards should apply only to the 
DMV production facilities. One commenter wrote that the NASPO standard 
needs to be reviewed every two years and that requirements should be 
added throughout the supply chain.
    Response: DHS agrees with the comments that the proposed NASPO 
standard may be more appropriate to manufacturing and production 
facilities, as opposed to issuance sites. DHS is not requiring the use 
of the ANSI/NASPO standard in the final rule, but commends to the 
States the proposed standards as a good practice for securing materials 
and printing supplies.

[[Page 5309]]

    Comment: One commenter proposed additional requirements for alarm 
systems, disposals, and suppliers. Another commenter suggested allowing 
DMVs to secure part of a building, rather than the whole building. The 
commenter wrote that the standard did not address the security of work 
stations and recommended biometric passwords. One commenter noted that 
providing the license directly to the person, rather than mailing it, 
was more secure; one State noted that the Post Office does not 
guarantee delivery.
    Response: The final rule specifies what must be addressed in a 
security plan, including physical security of the buildings used to 
produce driver's licenses and identification cards, storage areas for 
card stock and other materials used in card production, and security of 
Personally Identifiable Information (PII).
    If a DMV is located in a building shared by other offices or 
tenants, the area dedicated to the manufacture or issuance of driver's 
licenses and identification cards, storage of card stock and related 
materials, and PII must be secured in such a fashion to prevent 
unauthorized access. This requirement covers any equipment utilized to 
produce driver's licenses and identification cards as well as storage, 
access and retrieval of PII. States will determine how these items are 
protected in their security plans.
    The rule does not mandate central issuance versus over-the-counter 
issuance.
2. Security Plan
    Comment: One State said that DHS had exceeded its authority under 
the Act in the requirement that a State's security plan address 
``reasonable administrative, technical and physical safeguards to 
protect the security, confidentiality, and integrity of * * * personal 
information stored and maintained in DMV * * * information systems.'' 
Another State wrote that the Act does not authorize DHS to compel 
States to establish or make available standards or procedures for 
safeguarding the information collected by motor vehicle agencies. AAMVA 
asserted that tools such as information security audits, individual 
employee access audits, employee confidentiality polices, and privacy 
and security plans are already used in many DMVs.
    Privacy groups commented that the rule must provide meaningful 
privacy and security protections and that the lack of clear privacy and 
security guidance in the Act does not preclude DHS from providing 
strong protections in the regulations. In fact, they urged DHS to 
include specific standards or minimum criteria against which the State 
plans could be evaluated.
    At least two States objected to the provision that DHS could 
require ``other information as determined by DHS.'' The States argued 
that any further requirements should be agreed upon and clearly 
identified in the regulations. One State said that unspecified 
requirements should not be left to DHS to develop outside of the 
regulatory process. Another State wrote that the access badge 
requirement is unrealistic.
    Response: DHS believes that it has the authority to require States 
to take reasonable measures to safeguard the confidentiality of PII 
maintained in DMV information systems pursuant to the REAL ID Act. DHS 
believes that inherent in the Act's requirement that States must 
provide electronic access to the information contained in their 
databases is the principle that such information must be protected, and 
this concept is supported in the legislative history for section 202(d) 
(12) of the Act which states that ``DHS will be expected to establish 
regulations which adequately protect the privacy of the holders of 
licenses and ID cards * * *.'' H.R. Rep. No.109-72, at 184 (2005) 
(Conf. Rep). Failure to protect the PII held in DMV databases could 
result in identity theft and undermine the very purpose of the Act, 
which is to strengthen the validity of the cards. DHS also believes 
that it can require States to provide other, reasonable information 
that DHS determines is necessary in the future without requiring future 
rulemaking.
    Comment: AAMVA and several States requested guidance on what 
``written risk assessment of each facility'' means and a template. 
Another State asked for guidance on which law enforcement officials 
should be notified. One State recommended that the rule limit the 
amount of data in any State's database and create stronger protections 
for information to limit the danger of aggregating information on 240 
million Americans.
    Response: DHS, DOT, AAMVA and the States will work together to 
develop best practices for risk and vulnerability assessments as well 
as for security plans for DMV facilities.
    Comment: A trade association objected to the lack of standards for 
the security plan and further stated that because the State databases 
must be interconnected, the lack of standards would mean that the 
weakest plan implemented by any State would put all States at risk. DHS 
should require clear, strong, and verifiable minimum security measures. 
An association said that DHS was ignoring the threat posed by insiders, 
employees and contractors. According to this association, the rule 
should recognize the threat and the importance of training to mitigate 
those risks.
    Response: The final rule specifies what must be addressed in a 
security plan, including: Physical security of the buildings used to 
produce driver's licenses and identification cards, storage areas for 
card stock and other materials used in card production; security of 
personally identifiable information including reasonable 
administrative, technical, and physical safeguards, a privacy policy, 
and limits on disclosure; document and physical security features for 
the face of the driver's license or ID card, including a description of 
the State's use of biometrics and the technical standards utilized (if 
any); access control, including employee identification and 
credentialing, employee background checks, and controlled access 
systems; periodic training requirements in fraudulent document 
recognition for covered employees; emergency/incident response plan; 
internal audit controls; and affirmation that the State possesses both 
the authority and the means to produce, revise, expunge and protect the 
confidentiality of REAL ID driver's licenses and identification cards 
issued in support of Federal, State or local criminal justice agencies 
or similar programs that require the safeguard of a person's identity 
in the performance of their official duties. Such requirements shall 
also apply to contractors involved in the manufacture or issuance of 
REAL ID-compliant driver's licenses and identification cards.
3. Background Checks for Covered Employees
    Comment: Generally, States did not support the proposed background 
check provisions. A few States objected to these provisions as too 
broad and impractical. AAMVA stated that these requirements are a 
Federal intervention into State personnel rules and one commenter 
stated that these provisions are a particularly invasive intrusion on 
State autonomy to decide the qualifications and conditions of persons 
within its employ, which is a fundamental attribute of State 
sovereignty. States also objected to Sec.  37.45(c), the provision 
instructing the States to notify persons of unfavorable checks and 
provide them appeal rights, and claimed that this provision may grant 
rights nonexistent in State law.
    Numerous States said that background checks and the standards 
applied should be at the discretion of the State and not required. 
AAMVA and several

[[Page 5310]]

States suggested that existing employees should be grandfathered in to 
allow States to determine whether they want to do complete background 
checks on such employees.
    Response: DHS disagrees that it cannot require background checks of 
covered employees. Such checks are a necessary step to protect against 
insider fraud, one of many vulnerabilities to a secure licensing 
system. DHS also disagrees with the concept of ``grandfathering'' 
existing personnel since there is no way to know in most States whether 
employees who have not been subject to a background check would satisfy 
this important requirement. Further, Sec.  202(d)(8) expressly directs 
States to ``[s]ubject all persons authorized to manufacture or produce 
driver's licenses and identification cards to appropriate security 
clearance requirements.'' The background checks required under this 
final rule are authorized by and consistent with that statutory 
mandate. The statute does not provide for an exemption for personnel 
employed by a State DMV before the effective date of the Act or this 
final rule and thus DHS cannot include a grandfather clause in this 
rule.
    Comment: Some States believed that DHS has exceeded the authority 
granted by the Act on background check provisions because of its 
expansive definition of ``covered employees.'' These States asserted 
that DHS is without authority to extend the background check 
requirements beyond employees who ``manufacture or produce'' cards. 
Similarly, one State asked that employees at branch offices who are not 
involved in the production and manufacture of driver's licenses or 
identification cards be exempt from the background check requirements. 
One State noted that the rule attempts to subject ``covered 
employees,'' ``prospective employees,'' and ``applicants'' to the 
criminal history record check, yet only defines the term ``covered 
employee.''
    Response: DHS disagrees that its definition of a covered employee 
is too expansive. DHS, the agency charged with interpreting and 
enforcing the Act, interprets ``persons authorized to manufacture or 
produce'' REAL ID cards to include those individuals who collect and 
verify required source documents and information from applicants as 
such information is a necessary part of the production of a REAL ID 
card. It would be illogical to cover only those DMV employees and 
contractors who carry out only the physical act of cutting or printing 
a license while exempting those individuals who interact with the 
public and may be most able to introduce fraudulent information into 
the system and thus thwart the intent of the Act.
    Comment: Commenters wrote that States currently only undertake 
background investigations at the time of hiring, and that since 
existing employees are not applicants, it is entirely reasonable for 
labor organizations and permanent State employees not covered by 
collective bargaining agreements to argue that non-probationary 
employees fall outside the scope of the background check provisions. 
Some commenters claimed that the requirement that all designated 
employees, including those who are already employed, undergo background 
investigations is contrary to many State labor contracts and personnel 
practices. Numerous employees were hired under terms and conditions not 
requiring a security clearance. Should these employees be disqualified 
under the new regulations, States may be obligated to provide them with 
alternative employment or severance.
    Response: As noted above, DHS believes that it would be a 
significant security vulnerability to exempt current DMV employees from 
a background check.
    Comment: One commenter claimed that the use of the phrases 
``applicant'' and ``application'' in the rule governing interim 
disqualifying criminal offenses poses a practical problem, since the 
time periods are defined in terms of the date of the application. 
Existing employees would have been considered applicants on the date 
they filed the application for the position in which they are currently 
employed, which may be well outside the time period that applies to 
interim disqualifying offenses (five years from the date of 
application). Thus, commenters argued, the time period for interim 
disqualifications should start from the date of employment, not 
application. With regard to the proposed list of disqualifiers, AAMVA 
and some States wrote that States should determine their own 
disqualifying crimes and could outline those disqualifiers in the DHS 
certification package. Several States objected to the disqualification 
of people who have not been convicted on the grounds that such person 
should be considered innocent until found guilty.
    Response: DHS agrees that the time period for interim 
disqualifications for existing employees should start at the date of 
employment, not application. DHS agrees that States may supplement the 
list of disqualifying offenses with their own lists, but those lists 
cannot replace the Federal list. Finally, DHS agrees that States may 
make different decisions about whether to move an individual from a 
covered to a non-covered position even though the individual has not 
been convicted, and can exercise his or her waiver authority for this 
purpose under Sec.  37.45(b)(1)(v).
    Comment: A few States argued that States should have the option to 
give employees provisional clearance pending background check results, 
and that States could outline the procedures for provisional clearance 
in their certification packages.
    Response: As discussed above, DHS believes that it would be a 
significant security vulnerability to exempt current DMV employees from 
a background check. DHS has included language that substantially 
similar background checks (i.e., those that use a fingerprint-based 
CHRC check and have applied the same disqualifiers as this rule; that 
include an employment eligibility determination; and that include a 
reference check) conducted on current employees on or after May 11, 
2006, need not be re-conducted.
    Comment: One commenter wrote that, of the twenty-nine States that 
currently carry out some level of employee background checks, only two 
conduct credit checks. AAMVA and many States objected to the credit 
check as costly and in conflict with State personnel rules. One State 
noted that the Equal Employment Opportunity Commission (EEOC) has 
determined that unless justified by business necessity, it is unlawful 
to reject candidates based on poor credit ratings.
    One State asserted that this requirement is a Federal encroachment 
into an area historically reserved to States. Some States questioned 
the link between an employee's financial history and the propensity to 
commit a crime and posited that implementing this provision as written 
would cause many union-related issues affecting existing and future 
employees. Other States pointed out that many law enforcement personnel 
are not subject to this level of checking. Another commenter objected 
to the financial check as an invasion of privacy that would not provide 
useful information, and if DHS requires a financial history check, it 
should provide standards on how the results of that check should be 
used by the States.
    Response: DHS agrees that it would be difficult to make conclusive 
judgments about an employee or prospective employee's vulnerability to 
bribery based on a financial history check alone. Since the financial 
history check would not be determinative, DHS is eliminating the 
requirement for a

[[Page 5311]]

financial history check from the final rule.
    Comment: AAMVA said that lawful status checks are unnecessary and 
excessive because States already conduct such checks as part of the 
hiring process. One State noted that the requirement differs from 
current Federal requirements for completion of the Form 1-9. Other 
States pointed out that SAVE only covers immigrants, not native born 
Americans. AAMVA and several States noted that lawful status checks are 
often addressed in union bargaining contracts, and are covered by State 
personnel laws.
    Response: In response to these comments and further consideration 
of this matter DHS has revised the final rule. Employment eligibility 
verification using Form I-9 procedures is required for all employees 
(whether U.S. citizens or aliens) hired for employment at DMVs (or any 
other U.S. employer) on or after November 7, 1986. REAL ID defines 
lawful status in a way that is not synonymous with employment 
eligibility under the INA. Thus, the final rule now cross-references 
current Form I-9 requirements under section 274A of the INA rather than 
requiring employees to be checked through SAVE. As part of its 
background check process, the State must ensure that it has fully 
complied with Form I-9 requirements with respect to covered employees 
(including reverification in the case of expired employment 
authorization), but additional status checks are not required. Nothing 
in this rule in any way modifies any Form I-9 requirement; rather, the 
background check, if done at a later time than the initial hire, 
provides another opportunity for the State to check its previous 
compliance and correct any deficiencies. Form I-9 completion is, of 
course, required no later than three days subsequent to the first day 
of employment for all employees.
    USCIS operates, in partnership with the Social Security 
Administration (SSA), an electronic employment eligibility verification 
program called E-Verify (formerly known as the Basic Pilot program). 
Participants in E-Verify can query SSA and DHS databases to verify the 
documentation provided by new employees when completing the Form I-9. 
States are strongly encouraged to enroll in this program, but, 
consistent with the voluntary nature of the E-Verify program as 
provided by the statutory provisions authorizing the program, it is not 
required by the final rule.
    Comment: One commenter stated that background check processes are 
flawed, misidentifying people five percent of the time. According to 
this commenter, in half the States, forty percent of the arrest records 
have not been updated in five years to indicate disposition of the 
case. Another State wrote that it would be easier to run checks if they 
could interface with the FBI database. One State wrote that States 
should not have to repeat FBI checks if done within the past five 
years. One commenter asked that the FBI not charge States for accessing 
their systems.
    Response: DHS believes that a fingerprint-based background check is 
the most efficient way to determine if an individual is subject to a 
disqualifying offense. FBI checks conducted on or after May 11, 2006 
would not need to be conducted again.
    Comment: One commenter said that workers subject to a background 
check deserve a clear and quick process to clear their names and win 
their jobs back with full restitution of any lost wages. Another 
commenter suggested that TSA should incorporate provisions from the 
HAZMAT rules which provide instructions for applicants on how to clear 
criminal records into the REAL ID rule.
    Response: DHS believes that an individual denied employment based 
on the results of a background check should have the ability to 
challenge the accuracy of those records. States should make 
instructions available on how best to contest any inaccurate records or 
results.

N. State Certification Process; Compliance Determinations

1. Certification Process
    Comment: Several commenters requested that DHS receive input and 
collaborate with States and other organizations on certification 
guidance and standards. One commenter requested that DHS provide 
certification packets outlining specific requirements as well as a 
clear definition of ``until all requirements are met.'' AAMVA and 
several States recommended that States work with DHS in the development 
of a streamlined self-certification process to meet the requirements of 
the Act. One commenter suggested that risk assessment and mitigation 
plans be included in States' self-certification, and that States 
participating in the Driver's License Agreement should be able to 
substitute their compliance review process for DHS audit requirements. 
One commenter recommended that DHS establish a committee composed of 
Federal and State officials and representatives of groups which face 
unique challenges with respect to the REAL ID Act to recommend proposed 
content for the guidance documents on certification. Some States asked 
DHS to clarify the requirement for States to provide DHS with any 
changes to the information requiring certification. Regarding guidance 
requests, a few States requested a template for the certification 
document and the security declaration as well as a quarterly reporting 
standardized format.
    Response: DHS has streamlined the certification process, and 
includes a compliance checklist with this rule. The Material Compliance 
Checklist will document State progress toward meeting DHS security 
benchmarks and will serve as the basis for DHS approval of additional 
extensions until no later than May 10, 2011.
    Comment: Several States argued that the certification requirements 
are too burdensome, citing staffing issues as well as the need for 
ample preparation time and flexibility to comply with regulations. 
Similarly, many States argued that the frequency of certification 
reporting is too burdensome and questioned the need for quarterly 
certification reporting. One State recommended a triennial review. 
Other States thought the requirement to track all exceptions and to 
notify DHS 30 days before program changes were over-reaching and not 
authorized by statute. One State recommended that the DHS establish a 
system of measuring performance instead of recertification.
    Response: As documented above, DHS has simplified the certification 
process.
    Comment: Some States suggested allowing States whose DMVs fall 
under a jurisdiction other than the Governor the ability for the 
relevant public official to certify compliance. AAMVA and one State 
argued that the rule should provide that certification be signed by the 
highest-ranking State official overseeing the DMV, including the DMV 
Administrator, and not require additional certification from the 
Attorney General.
    Response: DHS agrees that requiring the Governor of each State to 
personally certify State compliance is too burdensome and has amended 
the requirement to allow either the Governor or the highest-ranking 
executive official with oversight responsibility over the operations of 
the DMV to certify State compliance.
2. Compliance Determination
    Comment: One State argued that unless and until a State loses a 
judicial review, it should be considered in compliance. Another State 
recommended that DHS recognize States that have implemented a number of

[[Page 5312]]

requirements and plan to continue making substantial progress as 
compliant. A State asked DHS to allow for the Governor to indicate that 
the State will remain in compliance until it withdraws from the 
program. Some States argued that a phased approach was the only viable 
means to bring States into compliance. One State recommended that DHS 
convene a working group with AAMVA to develop a phasing plan for 
compliance.
    Response: As documented above, DHS has adopted a compliance process 
that significantly lessens the burden of REAL ID implementation on the 
States.
    Comment: Various State and non-State commenters addressed 
noncompliance issues. One State asked how licenses issued during a 
compliant period would be treated if a State later fell out of 
compliance. Another State requested that DHS provide written 
notification of preliminary non-compliance determination and notice of 
final determination of noncompliance which would not be effective for 
30 business days following receipt. A State indicated it would not 
agree with non-compliance issues until the standards are clearly 
identified and agreed upon. One commenter opposed DHS's ability to 
withdraw a State's certification to issue REAL ID driver's licenses and 
identification cards on short notice, noting that decertification would 
negatively impact truck driver communities, government facilities, and 
the overall economy of the State.
    Response: REAL ID driver's licenses and identification cards issued 
when a State was in compliance with REAL ID will remain acceptable for 
official purposes until they expire, even if the State subsequently 
becomes non-compliant. The REAL ID certification process will provide a 
standardized means of measuring and monitoring the DMVs' compliance 
with REAL ID requirements. DHS will not withdraw a State's compliance 
on short notice, as certification reporting dates will be established 
in advance.
    Comment: A commenter requested that DHS provide written statements 
of notice prior to inspections, interviews, or any noncompliance 
determinations. Some States asked for flexibility and reasonable prior 
notice when scheduling site visits and REAL ID compliance audits, in 
order to have appropriately trained staff available to answer questions 
and to prevent audit overlaps. Commenters believed that States should 
have ample opportunity for review and appeal of decisions regarding 
self-certification.
    Response: DHS agrees with these comments. Language has been added 
to Sec.  37.59(a) to indicate that DHS will provide written notice of 
inspections, interviews and audit visits. States will be provided with 
a sufficient opportunity for review and appeal of decisions regarding 
their self-certification.
    Comment: Commenters addressed various training issues. One 
recommended that DHS allow the current AAMVA fraudulent document 
recognition training program to be used to meet the REAL ID Act's 
requirements. This program has been used by States and ``is widely 
recognized as comprehensive, directly related to and easily 
comprehended by DMV staff.'' One commenter objected to the requirement 
for DHS approval of fraudulent document training. Another commenter 
emphasized the need for ongoing evaluator/authenticator training. 
Without specific requirements for the training, States lack notice as 
to whether or not the training will comply with the regulations and 
will be subject to the unfettered discretion of DHS.
    Response: DHS agrees that AAMVA's training program on fraudulent 
document recognition will be acceptable to meet the requirement of the 
Act and the final rule. The majority of States currently utilize 
AAMVA's program.
    Comment: One commenter requested a definition of ``expedited 
consideration'' of a request for an extension. Other States requested 
opportunity for input, justification, and consulting in the extension 
process and assistance with development of the quarterly and annual 
reports. One non-State commenter requested standards for the issue of 
redress, and another suggested that DHS develop standards and plans to 
audit States' security plans.
    Response: The final rule spells out a simple and straightforward 
process for States to request an extension to the REAL ID 
implementation deadline. DHS will also allow States to receive an 
additional extension based on achievement of certain benchmarks 
established by DHS until no later than May 10, 2011. DHS will notify a 
State of its determination on a request for extension no later than 45 
days of receipt of the request. DHS will work with States and 
territories throughout the implementation process to assist as 
required.
    The input DHS receives from its stakeholders has been of tremendous 
value in crafting a final rule that the States may implement and that 
achieves a greater level of security and confidence in the State-issued 
driver's licenses and identification cards. DHS will continue engaging 
its valued stakeholders to shape the exceptions processes as well as 
other requirements of the rule.

O. Driver's License and Identification Cards That Do Not Meet the 
Standards of the REAL ID Act

    Comment: One commenter did not agree with DHS that foreign 
nationals denied REAL ID licenses, even though they are lawfully 
present but do not yet have the documentation required to demonstrate 
such status, can simply obtain a non-REAL ID alternative. The commenter 
wrote that a driver's license increasingly has become a ticket to daily 
living, and a non-REAL ID license will unfairly and improperly tag the 
holder as ``illegal'' and result in discrimination. One commenter wrote 
that it is not a valid assumption that most States will issue some 
other kind of license for immigrants who cannot obtain a REAL ID 
license. Another commenter wrote that marking non-REAL ID cards would 
divide the country into two groups and that those with other cards 
would instantly be suspect and subject to delay, harassment, and 
discrimination.
    One commenter noted that many people such as the elderly or 
disabled will not need a REAL ID and asked that the State be able to 
issue a non-compliant identification card to them. By excluding them 
from the REAL ID process, it will be easier for the State to process 
those who do need a REAL ID within the time allowed.
    AAMVA stated that although DHS has argued that States do not have 
to comply with the Act, the Act and DHS still impose requirements on 
States for the issuance of noncompliant licenses. AAMVA wrote that this 
requirement forces States to be in compliance and that the rulemaking 
goes well beyond Congressional intent in prescriptively outlining State 
requirements for ``non-compliant'' REAL ID cards. One State and one 
individual commenter noted that requiring States to follow these 
standards imposes a cost on States that choose not to comply, a 
violation of the 10th Amendment. Another State said that the Federal 
government cannot require a redesign of documents if the State is not 
complying. The Federal government should acknowledge the sovereignty of 
States' rights and respect the traditional State function of licensing 
drivers.
    Response: DHS does not agree that an individual carrying a non-
compliant driver's license or identification card from a State issuing 
REAL ID-compliant driver's licenses or identification cards would be 
subject to discrimination. States will make their own business and 
policy decisions about whether to issue

[[Page 5313]]

noncompliant cards under 202(d)11 of the Act.
    DHS has clarified in the rule that it interprets Sec.  202(d)(11) 
of the REAL ID Act, which provides requirements for the issuance of 
driver's licenses and identification cards that will not be accepted by 
Federal agencies for official purposes, as applying only to States 
participating in the Act that choose to also make these types of 
documents available. This might apply, for example, to individuals with 
a religious objection to having their photos taken. DHS does not 
interpret this section to apply to States that choose not to 
participate in the Act.

P. Section 7209 of the Intelligence Reform and Terrorism Prevention Act 
of 2004

    Comment: AAMVA, some States, and several additional commenters 
support the development of REAL ID cards that are WHTI-compliant. AAMVA 
stated that this is an important direction to ensure the free flow of 
commerce and travel between the United States and Canada. Some States 
said that they already collected citizenship data and adding this to 
REAL ID cards will have little to no additional cost impact.
    Several States argued against development of a WHTI-compliant/REAL 
ID-compliant card. One State said that citizenship is the purview of 
the Federal government and not that of States, and making a State DMV 
responsible for verifying citizenship places State employees in a 
Federal role. This State also noted that citizens with no desire to 
cross the border will derive no additional benefit from obtaining a 
REAL ID card that also denotes citizenship. A few States made similar 
arguments that very few of their residents would find it useful to have 
a WHTI-compliant REAL ID card. These States also argued that the 
expense to implement a WHTI-compliant solution would be cost 
prohibitive.
    One commenter emphasized that REAL ID cards must not include 
citizenship information because of the potential of discrimination 
against those who choose not to carry a national identification card. 
Another commenter said that the creation of a dual-use driver's license 
should be a decision that is made by individuals, after they are fully 
informed of the benefits, risk, costs, and other details of the 
programs consistent with the Fair Information Principles.
    A few commenters stated that they did not support States listing 
citizenship information on the REAL ID card or using a REAL ID card as 
an immigration/border document. These individuals believed that that 
WHTI-compliant REAL IDs would be significantly more useful to criminals 
and terrorists and therefore targeted for theft, counterfeiting, and 
fraud. One individual suggested that DHS could mitigate some concerns 
that the Department is trying to create a Federal ID by not requiring 
DMV to denote citizenship on REAL ID cards.
    All of the organizations that responded to the question on where 
citizenship should be listed on the card stated that it should be on 
the machine-readable zone (MRZ) portion of the card. There were no 
supporters for listing the citizenship information on the face of the 
card. These organizations all claimed that placing citizenship 
information on the face of the card could result in discrimination 
against the bearer of the card; placing it on the MRZ portion of the 
card could prevent this from happening.
    One commenter described in great detail the need to develop two 
encrypted MRZs on the card; one zone that can only be accessed and used 
by DMV and law enforcement officials, and another zone that can only be 
accessed and used by border and immigration officials. A few 
organizations commented that placing the WHTI information on a card may 
be challenging without increasing the size of the card itself. However, 
increasing the size of the card would be extremely costly.
    Response: DHS welcomes the various helpful comments submitted in 
response to DHS's questions in the NPRM relating to WHTI. In June 2007, 
DHS published a NPRM to implement the land and sea phases of WHTI. 
While DHS acknowledges the desire of some, but not all, States and 
other commenters to use a REAL ID-compliant driver's license or 
identification card as a WHTI-compliant border crossing document, DHS 
did not propose that a REAL ID-compliant driver's license or 
identification card serve as a WHTI-compliant document in that NPRM and 
does not propose such in this rulemaking. While the proposed REAL ID 
requirements include proof of legal status in the U.S., the EDL will 
require that the cardholder be a U.S. citizen. In addition, EDLs will 
include technologies that facilitate electronic verification and 
legitimate movement of travelers through land and sea ports-of-entry.
    Comment: A few commenters provided suggestions on the types of 
business processes and procedures that a State DMV could adopt to 
create a REAL ID that is also WHTI-compliant. One group suggested that 
citizens who desire to have a REAL ID that allows for WHTI border entry 
should be vetted by the State Department in the same manner as a person 
applying for a passport. The State Department would verify that the 
individual is eligible to receive WHTI identification and inform the 
appropriate State DMV that the individual has been approved to obtain a 
WHTI-compliant REAL ID. The State DMV should create the license/ID card 
as it normally would and then send it to the State Department to add 
the WHTI MRZ. There should be two machine-readable zones; one zone 
would only be able to be used and accessed by law enforcement and DMVs, 
and another MRZ that would only be able to be accessed and used by 
immigration/border officials.
    One organization commented that State DMVs will need to be able to 
utilize the State Department's citizenship adjudication process or 
create a similar process for adjudicating citizenship.
    One State opposed storing citizenship data on the MRZ, preferring 
to store this information centrally and access it via electronic means.
    Response: DHS welcomes the comments submitted concerning potential 
business practices a DMV could follow to issue both a REAL ID and WHTI-
compliant driver's license or identification card, including issues 
surrounding the adjudication of citizenship for WHTI purposes. As noted 
above, DHS published a NPRM to implement the land and sea phases of 
WHTI. At this time, DHS has decided not to incorporate requirements 
necessary for a WHTI-compliant document into the REAL ID rulemaking.
    Comment: Many commenters said that RFID technology, the proposed 
technology for WHTI documents, should not be used on REAL IDs. Because 
RFID can be read from up to thirty feet away there are significant 
privacy and security risks. A few commenters noted that the DHS Data 
Privacy and Integrity Advisory Committee and the Government 
Accountability Office both advised against using RFID technology. One 
organization felt strongly that the use of RFID technology without the 
use of Basic Access Control and other safeguards would contravene the 
basic security features that the Department of State has included in 
new U.S. passports.
    Another group believed that States can leverage the same 
infrastructure that they will need to purchase for REAL ID to 
incorporate MRZ, proximity chips, and vicinity chip technology onto a 
driver's license. The only difference

[[Page 5314]]

would be the cardstock and the quality assurance processes to ensure 
that electronics within the card are functioning properly. Another 
organization suggested that its product can turn the wireless function 
on or off as needed.
    One State suggested that DHS not identify a specific technology to 
be used, but leave it up to the States to decide.
    Response: The use of RFID is essential to the WHTI program in order 
to ensure facilitation at crowded U.S. land and sea crossing points. 
Similar concerns are not implicated by REAL ID, which is one of the 
factors that led DHS to select the 2D bar code as the common machine 
readable technology on driver's licenses and identification cards. DHS 
encourages States to explore alternative technologies on their driver's 
licenses and identification cards in order to promote security and 
technology advances as well as e-government initiatives a State may 
wish to explore.
    Comment: There were several other comments related to the issue of 
creating WHTI-compliant REAL ID cards. One commenter requested 
clarification on why REAL IDs themselves would not be sufficient 
documentation to re-enter the United States. The commenter noted that 
REAL ID issuance standards require proof of lawful residence status 
within the United States, and the overall higher standards will make 
the cards more resistant to tampering and counterfeiting. Therefore, 
the commenters argued, it may be presumed that a holder of a REAL ID 
license has the right to re-enter the United States. Another commenter 
requested clarification on whether ``enhanced'' driver's license (EDLs) 
and ID cards that are issued through pilot programs will also have to 
be REAL ID-compliant. The commenter also requested clarification on how 
DHS will respond to States, like Washington State, that have passed 
legislation refusing to comply with the REAL ID Act unless the Federal 
government fully funds the State's implementation of the Act.
    One commenter requested that DHS consult with tribal governments on 
how to best implement the REAL ID Act and that DHS consult with tribal 
leaders on the development of an Indigenous Identification Card for 
international border crossing.
    One individual urged DHS to allow Canadians who are residents of 
the United States to be allowed to obtain REAL ID/WHTI-compliant 
driver's licenses or ID cards, as these individuals make up a 
significant portion of individuals who cross the border frequently.
    Response: DHS acknowledges the desire of some, but not all, States 
and other commenters to use a REAL ID-compliant driver's license or 
identification card as a WHTI-compliant border crossing document. In 
the WHTI NPRM, DHS included a specific discussion of its ongoing 
efforts with Washington State regarding the issuance and use of an EDL 
as a WHTI-compliant document. EDLs can only be issued to U.S. citizens 
since the EDL would serve as the functional equivalent of a passport or 
passport card at land and sea border crossings. In addition, EDLs must 
also incorporate the technology specified by DHS to facilitate the 
legitimate movement of travelers through land and sea ports of entry. 
With respect to other holders of REAL ID-compliant driver's licenses or 
identification cards, any assumption that lawful status as defined for 
REAL ID purposes equates to a right to reenter the United States is 
incorrect. For example, applicants for adjustment of status typically 
must obtain advance parole in order to depart the United States and 
lawfully return. DHS has decided not to incorporate requirements 
necessary for a WHTI-compliant document into the REAL ID rulemaking at 
this time.

Q. Responses to Specific Solicitation of Comments

    Question 1: Whether the list of documents acceptable for 
establishing identity should be expanded. Commenters who believe the 
list should be expanded should include reasons for the expansion and 
how DMVs will be able to verify electronically with issuing agencies 
the authenticity and validity of these documents.
    Comment: Several commenters did not think the list of documents 
acceptable for establishing identity needed to be expanded, at least 
for U.S. citizens, and they were concerned that expanding the list 
would place a burden on State DMVs. One State did not know of any 
additional documents that would be electronically verifiable. Another 
State recommended that the list should not be included in the rule, so 
that future changes can be easily made. One commenter favored the use 
of the ``acceptable verifiable resource list'' of identity documents 
approved by AAMVA. Another State suggested that the rule should only 
specify criteria and procedures rather than a list of specific 
documents for establishing identity.
    Response: As noted above, DHS has decided not to alter the list of 
acceptable documents proposed and discussed in the NPRM.
    Comment: One commenter thought that Sec.  37.11 should require non-
citizen applicants to provide their alien registration documents so 
that State officials can compare it to the name on other documents. 
Various commenters pointed out that foreign applicants would have 
documents that are not on the list but may have been issued by DHS or 
the courts to prove immigration status. Some commenters supported other 
immigration forms, such as Form I-94 (which may indicate lawful status 
in the United States) and I-797 (which may be evidence of a pending 
application). Refugees and asylees are more likely to have these 
documents before they receive a Form I-766 Employment Authorization 
Document (EAD). Canadians present in the United States might have these 
forms rather than a visa. Two States suggested that any document that 
can be electronically verified through SAVE should be acceptable. 
Others argued for refugee status paperwork, expired foreign passports 
if USCIS documentation is current, as well as passports with expired 
visas and Immigration Court documents. One group recommended that DHS 
expand the list of acceptable documentation to include family members 
in the United States on derivative visas. Another group suggested that 
USCIS consider issuing a temporary refugee photo ID card that could be 
used to apply for a REAL ID.
    Response: State DMVs will use the SAVE system to verify whether an 
applicant for a driver's license or identification card is lawfully 
present in the United States. Part of the information required in order 
to query SAVE is the name of the individual, which can be confirmed 
through one of the source documents for proving identity. Applicants 
are free to use any other documentation available, including an I-94 or 
an I-797, in order to demonstrate lawful status and assist the State in 
making a SAVE check. DHS also agrees with the commenters who suggested 
that any document that can be electronically verified through SAVE 
should be acceptable, since the purpose of providing that document is 
to prove lawful status, not identity. Neither the I-94 nor the I-797, 
for example, is sufficient to prove identity. DHS believes that 
refugees and asylees are issued EADs within a reasonable amount of time 
such that they are able to obtain REAL ID driver's licenses and 
identification cards, and so there is no reason to include other 
refugee or asylee paperwork or documentation to the list of documents 
used to establish identity.

[[Page 5315]]

Applicants who need an immediate driver's license can obtain a non-REAL 
ID document from States issuing such cards.
    Canadians, however, will need to use their Canadian passport or 
obtain a U.S.-issued document in order to establish identity for a REAL 
ID license, as neither DHS nor the States can verify in a timely way 
that the document has been issued by the issuing agency (a foreign 
government in this case) as the statute requires. Canadians, however, 
can typically drive using their Canadian driver's license in the United 
States and can also obtain a non-REAL ID driver's license from States 
issuing such cards.
    Comment: Some commenters had specific thoughts about the proposed 
provisions on birth certificates. A State agency suggested that a 
delayed birth certificate should be specifically named as an acceptable 
document. Other commenters argued for acceptance of hospital records or 
baptismal certificates within a year of birth and adoption papers. 
Another State noted that many births in rural areas are not recorded, 
and suggested that States should be able to use other documents. Many 
commenters wrote that the proposed requirement for a certified copy 
would place a hardship on poor persons and the homeless.
    Response: If State law permits the use of a delayed birth 
certificate, that document can be used by a State. Hospital and 
baptismal records are not acceptable documents to establish identity, 
though, in appropriate circumstances, can be used in a State's 
exceptions process to establish date of birth or lawful status in the 
United States.
    Comment: Two commenters recommended that current State-issued non-
compliant driver's licenses and identification cards and bank-issued 
credit cards be included on the list of documents acceptable to prove 
identity because technology exists to verify and authenticate these 
documents. Commenters were divided on the acceptance of Native American 
Tribal Documents, with a few commenters, some Tribes, AAMVA, and two 
States supporting acceptance of the documents (particularly for birth 
records), and a few States opposing acceptance of these documents.
    Response: DHS does not believe that non-compliant driver's licenses 
or credit cards are acceptable documents to establish identity. No 
identity verification has taken place with respect to these documents. 
Tribal documents are addressed elsewhere in the responses to comments.
    Question 2: Whether the data elements currently proposed for 
inclusion in the machine readable zone of the driver's license should 
be reduced or expanded; whether the data in the machine-readable 
portion of the card should be encrypted for privacy reasons to protect 
the data from being harvested by third parties; and whether encryption 
would have any effect on law enforcement's ability to quickly read the 
data and identify the individual interdicted. What would it cost to 
build and manage the necessary information technology infrastructure 
for State and Federal law enforcement agencies to be able to access the 
information on the machine readable zone if the data were encrypted?
    See full discussion of comments and responses to this question in 
section I.
    Question 3: Whether individuals born before 1935 who have 
established histories with a State should be wholly exempt from the 
birth certificate verification requirements of this regulation, or 
whether, as proposed, such cases should be handled under each State's 
exceptions process.
    Comment: Numerous commenters favored the premise that individuals 
born before 1935 with established histories should be exempt from the 
birth certificate verification requirements. Some States added that 
States should be allowed to establish alternative documents acceptable 
for ID verification in this circumstance. AAMVA and some States 
acknowledged that many in this age group may not be able to obtain a 
birth certificate or related documents. AAMVA also said that citizens 
born before 1951 with ten or more years of history with the State DMV 
and who have passed State-approved verifications should be exempt. 
Several States said that electronic verification would likely be 
incomplete and non-electronic verification would be too burdensome for 
persons born before 1935. Another commenter said jurisdictions should 
be allowed to segregate the population by risk assessment to enable a 
managed approach to enrollment in REAL ID. One commenter added that it 
explicitly proposes using the term ``American citizens born before 
1935'' rather than the term ``individuals.'' A couple of States 
suggested granting an exemption based on the age of the applicant 
instead of an exemption based on a fixed date, with one suggesting 62 
years of age, based on eligibility to receive social security benefits, 
for those persons with established histories with the State.
    Response: DHS has determined that it will not allow a broad birth 
certificate exemption for those persons born before 1935, and allows 
States to accommodate such persons as necessary in their exceptions 
process.
    Comment: States requested clarification regarding ``established 
histories with a State'' i.e., whether this means individuals who 
already have a license or identification card in the State where they 
are seeking a product. One commenter suggested a history with the State 
for a minimum period of time, such as twenty to thirty years. This 
exemption should be part of each State's security plan so risks can be 
further mitigated through the overall REAL ID plan at the 
jurisdictional level. A couple of States also said that individuals 
without established histories should be handled through the State 
exceptions process, enabling qualified drivers to obtain a compliant 
license or identification card. A number of organizations said that 
these cases should be handled under the State exceptions process. One 
commenter wrote that DHS should establish a standard to which all 
States should conform in issuance of birth certificates. Another wrote 
that the process should be thoroughly documented, reviewed, and updated 
on an on-going basis. One commenter wrote that the process should 
substitute some form of identity verification that precludes imposter 
fraud. Another commenter wrote that this elaborate process is itself 
another argument in favor of restricting the Federal role in licensing 
altogether.
    Response: DHS has taken a different approach to reducing the number 
of people that a State DMV must process. DHS consulted with 
intelligence analysts and experts about how best to target preventive 
efforts against an individual attempting to fraudulently obtain an 
identification document to gain access to a Federal facility, nuclear 
facility, or commercial aircraft.
    DHS has determined that, based on information it has reviewed, 
there is a higher risk that individuals under age 50 will obtain 
fraudulent identification. As a result, the rule requires States to 
focus enrollment first on individuals born on or after May 11, 1965 
when issuing REAL ID cards. DHS has further determined that there is an 
acceptable level of risk in deferring the REAL ID enrollment 
requirements until December 1, 2017 for those individuals who are older 
than age 50 as of December 1, 2014.
    Comment: Two States said that customers born before 1935 should 
make every attempt to comply with REAL ID rather than being granted a 
blanket exemption. If compliance is not possible, exceptions procedures 
(along

[[Page 5316]]

with other documents to reasonably prove identity) should be the next 
step.
    Response: DHS agrees with these comments and has decided not to 
adopt an exemption for individuals born before 1935, as discussed 
above.
    Comment: AAMVA and several States said that individuals born before 
1935 should not only be exempted from the birth certificate 
requirements, but also wholly exempt from the entire enrollment process 
since these individuals do not pose any potential threat. However, one 
State said it lacks the expertise to opine on the risk of terrorism 
this exemption would pose.
    Response: As noted above, DHS is not proposing to exempt any 
individuals from the REAL ID enrollment process.
    Comment: Other commenters suggested the following exemptions from 
reenrollment: individuals for whom proof of identity, residency, lawful 
status and SSN can be proven electronically, and citizens who are 
elderly, disabled, in nursing homes or mental institutions and who will 
not be getting on an airplane or entering a Federal facility.
    Response: As noted above, DHS is not proposing to exempt any 
individuals from the REAL ID enrollment process. DHS urges States to 
make appropriate accommodations for handling the elderly, disabled, and 
those in nursing homes or mental institutions. Section 202(d)(11) of 
the Act gives States the opportunity to issue non-compliant licenses 
that are not accepted for official purposes and may not necessarily 
require an in-person enrollment, depending on the State's issuance 
process.
    Question 4: If a State chooses to produce driver's licenses and 
identification cards that are WHTI-compliant, whether citizenship could 
be denoted either on the face or machine-readable portion of the 
driver's license or identification card, and more generally on the 
procedures and business processes a State DMV could adopt in order to 
issue a REAL ID driver's license or identification card that also 
included citizenship information for WHTI compliance. DHS also invites 
comments on how States would or could incorporate a separate WHTI-
compliant technology, such as an RFID-enabled vicinity chip technology, 
in addition to the REAL ID PDF417 barcode requirement.
    See full discussion of comments and responses to this question in 
section P.
    Question 5: How DHS can tailor the address of principal residence 
requirement to provide for the security of classes of individuals such 
as Federal judges and law enforcement officers.
    See full discussion of comments and responses to this question in 
section I.
    Question 6: What benchmarks are appropriate for measuring progress 
toward implementing the requirements of this rule and what schedule and 
resource constraints will impact meeting these benchmarks.
    Comment: AAMVA listed ten criteria for measuring a State's progress 
towards implementation of the REAL ID requirements--procurement 
practices, process changes, contractual arrangements, funding, 
legislative authority, personnel, facilities, computer systems, new 
verification systems, and existing verification systems. Some States 
suggested variations on these themes, proposing that a set of 
standardized benchmarks was not realistic. Rather, each State should be 
able to determine appropriate benchmarks depending on what they had to 
do to implement REAL ID. Progress could be measured against 
implementation plans States submitted to DHS and should be based on a 
phased approach. One State suggested that DHS create a matrix that 
could be used to show progress for the major components of REAL ID. 
Another State argued that it is difficult to establish benchmarks 
before all regulatory requirements have been finalized. One State 
recommended a ``strategic'' rather than ``prescriptive'' implementation 
approach.
    One privacy group stated that the final rule must include robust 
security standards for national querying systems. A vendor association 
provided detailed recommendations on access control and authentication 
practices. One State made very detailed recommendations on privacy 
standards including a pre-defined audit requirement. A vendor 
association recommended strong sanctions for violations of procedures 
to deter the insider threat and notification of anyone whose 
information is breached.
    Response: The final rule specifies the elements necessary to be 
REAL ID-compliant, and DHS has proposed a checklist process for States 
to demonstrate completion of certain compliance benchmarks, and full 
compliance with the Act and these regulations.
    Question 7: Adoption of a performance standard for the physical 
security of DMV facility, including whether DHS should adopt the ANSI/
NASPO ``Security Assurance Standards for the Document and Product 
Security Industries,'' ANSI/NASPO-SA-v3.OP-2005, Level II as the 
preferred standard.
    See comments and responses to this question in section M.
    Question 8: How DHS can better integrate American Samoa and the 
Commonwealth of the Northern Marianas into the REAL ID framework.
    Comment: Several States indicated that individuals from American 
Samoa and the Commonwealth of the Northern Marianas should be issued a 
REAL ID if they provided acceptable documents like birth certificates, 
valid passports, unexpired driver's license, or U.S. issued immigration 
documents.
    In addition, a few States supported an exception process for these 
territories. One State said that without Federal funds, it would be 
difficult if not impossible for both territories to comply due to 
complexity, cost and timing issues. Some States questioned whether 
American Samoa would be able to issue driver's licenses and 
identification cards under the REAL ID Act and regulations. Other 
States claimed that without evidence of U.S. citizenship, Northern 
Marianas residents would not be able to obtain a license or card. One 
State recommended that DHS accept the Northern Mariana Card (I-873) to 
establish identity and residency. Customers without this card could be 
assisted under current State exceptions processes. Another State also 
suggested acceptance of the Re-entry Permit/Refugee Travel Document (I-
327, I-571).
    AAMVA and some States requested clarification as to the specific 
issue caused by these groups of applicants.
    Response: DHS believes that American Samoa and the Commonwealth of 
the Northern Marianas will be capable of complying with the REAL ID 
requirements in the same time frame as other States and Territories.
    Question 9: Whether the physical security standards proposed in 
this rule are the most appropriate approach for deterring the 
production of counterfeit or fraudulent documents, and what contractual 
issues, if any, the States will face in satisfying the document 
security requirements proposed in this rule.
    Comment: See comments and responses to this question in section I. 
Also, AAMVA commented that States will face significant contractual 
conflicts if the document security standards in this NPRM remain in the 
final rule. States are using the AAMVA Driver Licensing and 
Identification Card Design Specification as the model to prepare bid 
packages for new contracts or renewals. Contract periods for card 
vendors vary by State and are driven by procurement rules. One State, 
for example, has a contract in place for the next seven years. Most 
States have at least five year contracts. AAMVA

[[Page 5317]]

recommended that DHS use the AAMVA Driver Licensing and Identification 
Card Design Specification as the minimum card security standard, 
allowing States to build on its provisions. States should not be 
expected to break or amend existing contracts and should not be 
expected to implement any changes to card security until their existing 
contracts expire.
    Response: See comments and responses to this question in Section I.
    Question 10: The Federalism aspects of the rule, particularly those 
arising from the background check requirements proposed herein.
    Comment: Several commenters said that REAL ID was beyond Congress's 
enumerated powers because the States have a valid immunity claim. 
Another commenter wrote that REAL ID usurped States' traditional 
authority. One commenter wrote that it is a violation of the tribal-
Federal relationship to require a tribal government official to go to a 
State government official in order to obtain proof of identification in 
order to travel and conduct official tribal-Federal government 
business. One commenter said that State DMVs cannot revoke licenses or 
identification cards issued by another State. One State found no 
Federalism issues as States are able to control the design, and, 
potentially, the security features of its cards. However, other States 
voiced a number of Federalism concerns.
    One State presented a list of impacts flowing from the REAL ID 
program: Procurement practices, process changes, existing contractual 
arrangements that cannot be altered without significant penalty, fund 
appropriations, laws, facilities, computer systems, requirement of new 
verification systems. Similarly, some States argued that the REAL ID 
regulation could not survive a challenge brought under the 10th 
Amendment of the Constitution. It continued, ``Given an affidavit 
issued by the Governor of the Commonwealth, DHS would have universal, 
unfettered access to employees and systems that are dedicated to a 
traditionally State function.'' Another State wrote that DHS should not 
intrude into the traditional State function of licensing drivers and 
issuing identification cards by attempting to prescribe the processes 
for creating, issuing, and administering REAL ID cards, and that DHS 
should specify the security, performance, and quality characteristics 
that REAL ID participating jurisdictions must achieve. Some commenters 
believed that the REAL ID Act violates both the spirit and the letter 
of Federalism law. The commenters wrote that the REAL ID Act aims to 
conscript the States into creating a national ID system, and that it is 
``this kind of scheme'' that the Framers expected Federalism to guard 
against. Because of this, many States have passed anti-REAL-ID 
resolutions and legislation.
    Response: The REAL ID Act provides the Secretary of Homeland 
Security with authority to issue regulations. DHS understands that 
there is a balance between Executive discretion in interpreting the 
REAL ID Act through regulation, while also respecting the States' 
autonomy to govern an inherently State function--the driver's license 
and identification card issuance process. DHS has attempted to preserve 
State autonomy wherever possible, while remaining consistent with the 
Act, and believes these regulations represent a logical interpretation 
of the Act and Congressional intent.
    Comment: One commenter argued that States should have discretion to 
determine whether to conduct background checks on State employees. One 
State DMV said that because it conducts a fingerprint-based background 
check on its employee-applicants, implementing the REAL ID requirement 
would have ``minimal'' impact. In contrast, one State said that in 
requiring a background check for State employees, DHS is 
``overreaching.'' Because the requirement includes several checks, only 
one of which a DMV could use to disqualify an employee from performing 
certain REAL-ID-related activities, a State argued that the rule 
impacts both the individuals a State may hire and retain in certain 
positions. It also requires a collection of information for no stated 
reason. Another State DMV wrote that DHS goes beyond the statutory 
language in requiring a background check, and suggested that DHS strike 
the provision.
    With regard to the financial history check, one State noted that 
this aspect of the draft regulation would intrude into the relationship 
that State governments have with their employees. It argued that DHS 
could avoid Federalism issues by having its regulations ``express the 
security characteristics that a State would need to achieve rather than 
prescribe how State processes should operate.'' The Federal government, 
it said, should not regulate hiring practices for State employees. One 
State wrote that it has discontinued credit checks because it was not 
an adequate indicator of a person's behavior or ethics.
    Response: As noted above, DHS believes it has the authority to 
require background checks. Based on the comments received, DHS has 
decided to eliminate the financial history check of DMV covered 
employees and prospective employees.
    Comment: Although one State agreed that DHS has authority to review 
State compliance within the scope and criteria of the auditing granted 
by the statute, this State asserted that DHS exceeded the scope of its 
authority in promulgating Sec.  37.59(a), which lacks a check on 
seemingly unlimited Federal authority to inspect State processes.
    Response: DHS does not believe the language of Sec.  37.59(a) 
provides DHS with unfettered authority to oversee the actions of State 
government. Indeed, the section provides the opportunity for States to 
challenge a DHS determination of non-compliance, rather than a Federal 
authority with no right of appeal. DHS has also relaxed the reporting 
requirements in this final rule in response to comments that the 
reporting requirements in the NPRM were too burdensome.
    Comment: One State asserted that it is beyond DHS's authority to 
compel non-participating States to maintain a motor vehicle database 
with the minimum required REAL ID information and to share access to 
any such database with other States.
    Response: DHS is not compelling non-participating States to meet 
any of the requirements of these rules.
    Comment: A State objected to the requirement that a REAL ID 
cardholder's address change requires the person to report and document 
the change in person at a DMV office. The State says it is apprehensive 
that the proposed rules erode the important principles of Federalism, 
especially regarding managing elections. When a driver applies for 
voter registration, the State automatically checks to see whether the 
address given on that card is the same as the address on a State-issued 
driver's license or identification card. If there is a mismatch, State 
law requires automatically changing the license or identification card 
address to match that on the voter application form. This State 
requested that DHS give serious consideration to allowing this 
automatic updating practice to continue. Another commenter said DHS 
should ensure that the final regulations continue to provide States 
maximum flexibility to determine which employees are subject to the 
requirements of this section.
    Response: As noted elsewhere, the final rules do not require an 
individual to have an in-person transaction with the DMV to change 
their address.
    Comment: One commenter said that because direct regulation of the 
States would be unconstitutional, the REAL ID

[[Page 5318]]

Act inappropriately conditions Federal acceptance of State-issued 
identification cards and driver's licenses on their meeting certain 
Federal standards. The commenter was also concerned that DHS was using 
State machinery to implement a Federal program. However, the commenter 
asserted that it is within Federal power for DHS to condition 
acceptance of identification cards and driver's licenses on priorities 
closely related to national security, including meeting standards for 
privacy and data security.
    Response: Congress passed the REAL ID Act to implement a 
recommendation of the 9/11 Commission Report to increase the security, 
credibility and confidence in identification documents. Congress, in 
drafting the law, and understanding the Constitutional concern of 
directly regulating the States, made the law binding on Federal 
agencies in specifying that only REAL ID-compliant driver's licenses 
would be accepted by Federal agencies for official purposes after the 
law is implemented. DHS agrees with the commenter that the Federal 
government has the authority to condition acceptance of driver's 
licenses and identification cards on the meeting of certain standards 
and requirements as defined in the REAL ID Act and the implementing 
regulations.
    Comment: One commenter concluded that Congress and DHS could have 
supported meaningful Federalism by supporting States' pre-REAL ID 
initiatives to produce an interstate compact to achieve 
interoperability of State databases.
    Response: This comment is outside the scope of the rulemaking.
    Question 11: How the Federal government can better assist States in 
verifying information against Federal databases.
    Comment: Several States and other commenters had a number of 
suggestions including the following:

--Develop and test or enhance Federal databases to meet States' needs.
--Establish standards for system performance and connectivity.
--Ensure that matches can be made with as little manual intervention as 
possible.
--Establish standard naming conventions.
--Put security standards in place.
--Fund system development and assist States financially in performing 
verifications.

    Response: DHS is collaborating with its Federal partners, AAMVA and 
the States to design and implement verification systems to support the 
requirements of the REAL ID Act and regulations. DHS is working on 
improving the reliability, usability and accuracy of existing systems 
like SSOLV and SAVE to meet States' needs to minimize the manual 
intervention necessary.
    In addition, DHS will work with DOT, AAMVA and the States to 
reinforce the security and privacy features of this communications and 
systems architecture to include practices consistent with fair 
information and Federal Information Security Management Act principles. 
In partnership with DOT, AAMVA, and the States, DHS will issue best 
practices to guide future systems design, development and operation. 
DHS is also working with Federal, State, and nongovernmental 
organizations to identify and improve name formats and matching 
algorithms used by identify verification.
    Question 12: In addition to security benefits, what other ancillary 
benefits could REAL ID reasonably be expected to produce? For example, 
could REAL ID be expected to reduce instances of underage drinking 
through use of false/fraudulent identification. If so, please provide 
details about the expected benefit and how it would be achieved through 
REAL ID.
    Comment: Several commenters wrote that REAL ID will decrease 
identity theft. Several other commenters thought that a decrease in 
theft might not be attributed to REAL ID but be due to the fact that 
many States are implementing more stringent rules for obtaining a 
driver's license.
    A few commenters claimed that REAL ID will have little to no impact 
on identity theft. One commenter noted that most instances of identify 
theft are a result of a stolen social security numbers or credit cards, 
and that REAL ID does not address these types of thefts. Another 
organization stated that ``loopholes'' in the source documentation 
requirements for those without a permanent addresses or birth 
certificates take away any perceived REAL ID benefit.
    Most of the commenters thought that REAL ID would increase identity 
theft. Commenters wrote that the NPRM did not propose sufficient 
protection and security controls to ensure that the information being 
collected and stored will be immune to theft or misuse. Several 
commenters said that the databases storing digital images of social 
security numbers, bank statements, and birth certificates will be an 
identity-thief's dream target. These images, once in the hands of 
criminals, will be easy to counterfeit. If systems are linked, a single 
breach in security will potentially compromise 240 million individuals. 
Several commenters also highlighted that threat to this information may 
come from within DMVs. One organization quoted that over 100 million 
records of U.S. residents have been exposed due to security breaches.
    Response: DHS provided a detailed analysis on the ancillary 
benefits of the proposed rule on REAL ID. We noted, as the comments 
suggested, that the proposed rule may have only a small impact on 
reducing identity theft. REAL ID will only have the ability to impact 
those types of identity theft that require a drivers license for 
successful implementation and only to the extent that the rulemaking 
leads to incidental and required use of REAL ID documents in everyday 
transactions, which is an impact that also depends critically on 
decisions made by State and local governments and the private sector. 
With the current costs of identity theft being high, we believe that 
even if the ancillary benefits associated with identity theft are low, 
when these benefits are combined with other benefits of this 
rulemaking, that this rule is cost-beneficial.
    Many commenters believe that REAL ID would increase identity theft. 
We find, at the current time, that it would be difficult to draw any 
conclusions such as this since the effort or cost to individuals to 
obtain and use a passable fraudulent identification card is expected to 
be much higher than it is at present. Only those people who believe 
that they will reap substantial benefits would be willing to incur the 
cost of creating and using a fraudulent identification card.
    With regard to the general comment that REAL ID is expected to 
reduce instances of underage drinking through the use of false/
fraudulent identification, DHS believes that REAL ID may reduce on the 
margin the rate at which underage drinking occurs. The rate at which it 
does so partly depends on State and local authority and/or private 
employer decisions as to what form of identification is acceptable for 
particular purposes, and the effectiveness with which identification 
checks are implemented. DHS is not willing to quantify, at this time, 
the expected benefits that would be achieved from a reduction in 
underage drinking.
    Comment: Regarding the ancillary benefits of REAL ID, some States 
supported DHS's suggestion that REAL ID could reduce underage drinking 
and purchase of cigarettes by making it easier for vendors to identify 
fake identification cards. Other commenters wrote that REAL ID could 
also promote

[[Page 5319]]

highway safety by allowing law enforcement officers to process 
vehicular accidents and traffic citations faster and more accurately, 
and potentially aid other law enforcement efforts.
    Several commenters noted that one of the possible ancillary effects 
of a REAL ID is that commercial entities will be able to market to 
individuals without the individual's permission. The MRZ and the 2-D 
barcode technology discussed in the NPRM makes it easier for third 
parties to obtain sensitive information about the holder of the cards. 
Several commenters gave examples of how commercial entities will make 
REAL ID the default document for everyday transactions and thus will be 
able to obtain, store, and track individual's age, address, and 
purchases.
    Three organizations noted that State transactions, such as the 
issuance of professional/occupational licenses (for example, licensing 
for doctors, lawyers, nurses, real estate brokers) and hunting and 
fishing licenses, could be done with a higher level of assurance that 
the license is being given to the right person. Two other organizations 
also said that health-related and financial companies would also 
receive security benefits associated with more trust in the validity of 
the identification cards. One commenter stated that all employers would 
benefit because they would be better able to determine employment 
eligibility.
    Response: DHS believes that the potential ancillary benefits of 
this rulemaking would be in many areas. Should acceptance of REAL ID 
cards become widespread, such ancillary benefits may include reduction 
in fraudulent access to public subsidies and benefits programs, illegal 
immigration, unlawful employment, unlawful access to firearms, voter 
fraud, underage drinking, and underage smoking. DHS believes that REAL 
ID may reduce on the margin, the rate at which these fraudulent 
activities take place. The degree to which they do so will partly 
depend on State and local authority and/or private employer decisions 
as to what form of identification is acceptable for particular 
purposes, and the effectiveness with which identification checks are 
implemented. DHS cannot, at this time, measure these benefits 
quantitatively.
    With regards to organizations, businesses, etc., DHS is not 
preventing the use of REAL ID in State transactions and the individual 
who is having the document presented to him can place any level of 
trust he/she wants in the REAL ID document.
    Question 13: The potential environmental impacts of the physical 
security standards and other requirements proposed under this rule.
    Comment: A State recommended that DHS seek out U.S. EPA or a 
similar group to evaluate the potential environmental impacts. One 
State DMV wrote that the environmental impacts of the rule would be 
minimal. States may have to perform the required environmental impact 
analysis if changes to issuance facilities are necessary. AAMVA 
suggested that environmental impacts associated with retrofitting the 
facilities to meet physical security standards will result in some 
environmental risks such as asbestos removal.
    One State asserted that the increased visits by individuals to 
renew their licenses and corresponding activities associated with 
creating a license (for example, increased usage of electricity, 
scanners, copiers, printers, and paper) will impact air, ground, and 
water quality, and result in unnecessary waste disposal and consumption 
of natural resources, electricity, and other fuels and add to traffic 
congestion. This State recommended that DHS revise the rule to employ a 
phased approach which could allow States to certify and renew on 
schedules that will not adversely impact the normally occurring renewal 
cycle.
    One commenter suggested that the durability provided by longer life 
driver's licenses and identification cards could result in less 
material going into the waste stream resulting in an environmental 
benefit.
    Response: DHS carefully evaluated those comments along with other 
potential environmental impacts of this rule. The comments show that, 
if the States choose to create a REAL ID process, any potential 
environmental impacts which might be significant, can be mitigated. DHS 
concludes that the rule's potential impacts are minimal and notes that 
the rule does not force an immediate action but only lays the 
foundation for subsequent action. If States seek follow-on DHS grant 
funding, approval, or other activity for implementation of the rule, 
then the potential environmental impacts associated with the follow on 
activity must be reviewed.
    Question 14: Whether other Federal activities should be included in 
the scope of ``official purpose.''
    See comment and response to this question in section B.
    Question 15: How the REAL ID Act can be leveraged to promote the 
concept of ``one driver, one record, one record of jurisdiction'' and 
prevent the issuance of multiple driver's licenses.
    Comment: Most commenters supported the ``one driver, one record 
concept,'' and most States said Federal funding for an ``all drivers'' 
system would promote the concept. A couple of States specifically 
endorsed DRIVerS (Driver Record Information Verification System). Many 
States joined AAMVA in endorsing a State's initiative to enter into a 
Driver License Agreement to develop ``a nationwide pointer system with 
the driver record and driver history transferred to a `change State 
record' when the driver moves to a new State.'' AAMVA and many States 
also endorsed basing any such pointer system on the Commercial Driver 
License Information System (CDLIS).
    One State said that any ``all drivers'' verification system must 
include ``reciprocity rules'' so that an individual who is required to 
move frequently across States need not undergo a complete REAL ID check 
every time. However, one commenter said a CDLIS-type system is a 
concern because it is a ``one person one license (or ID card) one 
record system'' with no regulatory or statutory limitations on who can 
access information and for what purpose. To protect privacy and ensure 
driver safety across States, the commenter said the existing Problem 
Driver Pointer System/National Driver Register is better.
    A few commenters also joined AAMVA in endorsing the AAMVA/National 
Highway Traffic Safety Administration joint initiative to develop a 
digital image exchange project to identify multiple State license 
holders. Some States echoed a comment from AAMVA that because a 
driver's license applicant must surrender his or her current license 
from another State as a condition of receiving a new license, the 
States already follow a policy of one driver, one license. Another 
State said that States should require a driver's license applicant to 
self-declare the existence of a prior compliant or non-compliant 
license or card and require confiscation and notification to cancel 
before the new State issues a document. Several commenters endorsed 
using the Driver License Agreement compact as an extant system for 
promoting ``one driver, one record.''
    Other process recommendations included the suggestion that a 
national business process standard be developed to let jurisdictions 
know of the theft or loss of a REAL ID card and forming an agreement 
similar to the DLA that both REAL ID and non-REAL ID States can use to 
ensure cross-checking before a jurisdiction issues any driver's 
license.

[[Page 5320]]

 Requiring ``cleaning'' of existing databases and comparing legacy 
databases used to issue a REAL-ID compliant card was also recommended.
    One commenter said that having only one license for multiple 
purposes would better promote the concept than having non-REAL ID and 
REAL ID driver's licenses. It also said that the United States must 
accept standards nationwide to be used with confidence of driver's 
license exchange to move across boundaries and should encourage/mandate 
reciprocity of like licenses.
    Some commenters noted problems with implementing the ``one driver, 
one record'' concept, stating that, without participation by all 
States, the system is fundamentally flawed in that a person could hold 
multiple non-REAL ID driver licenses and a REAL ID-compliant card. One 
State said that DHS lacked authority to compel a non-REAL ID State to 
participate in systems that promote the concept. It suggested that the 
``one driver, one record concept'' should only apply to the REAL ID-
compliant system.
    Other States said the rules should allow a person to hold both a 
REAL ID-compliant card and a non-REAL ID card in any combination ``with 
the limitation that a driver has no more than one license and one card 
at a time.'' One State suggested that a person not hold more than two 
REAL ID-compliant cards at a time: a driver's license and an 
identification card. This commenter said a person might wish to carry a 
REAL ID-compliant card and keep another at home. One State said that it 
issues identification cards to individuals who may hold a license in 
another State.
    Some States said that DHS's proposal and the REAL ID Act impede 
``one driver, one record.'' That would happen, these commenters said, 
where these authorities require ``a State DMV to take measures to 
confirm that an applicant has terminated or has taken steps to 
terminate a REAL ID driver's license or identification card issued in 
another State.'' One State proposed that DHS change Sec.  37.33(c) to 
state that a person who applies for a REAL ID in his or her State of 
residence has ``taken steps to terminate the prior card.'' One State 
wanted to know how DHS would define ``terminate.''
    One State said that because there is no system through which a 
State could check whether a person already holds a REAL ID driver's 
license or identification card in another jurisdiction, DHS should 
eliminate the requirement that States must make such a check. Another 
State asserts that such a capability should exist now across all fifty 
States.
    Several commenters remarked on the use of technology to promote the 
``one driver, one record'' concept. One commenter endorsed smart card-
enabled REAL ID documents requiring a one-to-one match. A consulting 
group described a biometric identifier as the only known manner to 
prevent one individual from procuring more than one license or 
identification document. This commenter said DHS should identify and 
standardize a suitable biometric property and create a privacy-
sensitive solution for performing the necessary biometric comparisons.
    One commenter said that DHS should have presented and analyzed in 
detail different architecture models (other than CDLIS) for the system 
States can use to check whether a REAL ID applicant already holds a 
REAL ID card issued by another jurisdiction. Noting that a system 
promoting ``one driver, one record'' must promote privacy, security, 
and accuracy, another commenter said CDLIS is not a federated query 
system, but a national database. It commented that simply scaling up 
this system will not establish a federated query service, but will 
create a national ID.
    One commenter wrote that it is concerned about DHS's failure to 
articulate what defines a person's unique driver's license or 
identification card number; the proposed rule is silent on the form 
this unique number will take and does not specify whether the number 
will be unique nationally or solely within a single State.
    Response: Section 202(d) of the REAL ID Act prohibits States from 
issuing REAL ID cards to a person who holds a driver's license in 
another State without confirmation that the person has terminated, or 
is taking steps to terminate, the other license. We have amended this 
final rule to clarify this statutory requirement. See Sec.  37.33. DHS 
supports the concept of one driver, one license. DHS is not, however, 
authorized under the REAL ID Act to use this final rule to prohibit 
States from issuing non-REAL ID driver's licenses to persons who hold 
licenses in other States or to find that a State is not in compliance 
with the minimum standards of the REAL ID Act if such State issues 
driver's licenses to persons holding licenses in other States. DHS is 
limited under its authority in the REAL ID Act to prohibiting States 
from issuing REAL ID cards to persons who hold licenses in other States 
or who hold another REAL ID card.
    Question 16: Whether DHS should standardize the unique design or 
color required for non-REAL ID under the REAL ID Act for ease of 
nationwide recognition, and whether DHS should also implement a 
standardized design or color for REAL ID licenses.
    Comment: A few States said that although a REAL ID should be 
recognizable as such, a standardized appearance would facilitate 
counterfeiting. Another State suggested that States should only have to 
mark REAL ID-compliant cards, not mark non-compliant cards. Other 
commenters supported the use of an identifier for non-compliant 
licenses and cards, as DHS would need a mechanism to tell if a license 
issued before the Act was compliant. NGA recommended placing a 
restriction code on the front of the license with text on the back to 
denote whether the license was REAL ID-compliant. AAMVA, several 
States, and another commenter all argued against standardizing a unique 
design or color for the non-Real ID cards. Some commenters wrote that 
DHS had no authority to require States to adopt a standard design or 
color for the non-REAL ID cards, citing Federalism. One commenter wrote 
that mandating distinct designs or colors for both REAL ID and regular 
license and ID cards and requiring non-REAL ID driver's licenses to 
have an ``invalid for Federal purposes'' designation turns the 
voluntary card into a mandatory national ID. Several also expressed 
concern that standardization would make counterfeiting of the cards 
easier, since counterfeiters would only have to focus on one document. 
The consequences of successful counterfeiting would be more severe, 
they said, since the whole system would be compromised and all States 
would then have to change their cards. Some commenters said that 
diversity in security features, as long as they met a common 
performance standard, would be best. Commenters said that a 
standardized design would increase the perception that a national 
identification system was being created.
    Response: While cards that do not satisfy the requirements of the 
Act must clearly state on their face that they are not acceptable for 
official purposes, DHS is not mandating a specific design or color for 
such cards. DHS agrees with States that recommended marking compliant 
cards and as such, requires compliant cards to be marked with a DHS-
approved security marking.
    Comment: Many commenters opposed a REAL ID standard design. One 
commenter wrote that requiring a single standard configuration will 
limit the ability of jurisdictions to adapt to changing threats in 
their particular environment and could drive up costs

[[Page 5321]]

unnecessarily. Many States expressed concern about increasing the 
threat and consequences of counterfeiting. Several States said they 
should be allowed to continue to use unique designs for their driver's 
licenses and ID cards (one noting it held great value for State 
identity), while others argued that States should be allowed to 
maintain control of the design of their licenses to the greatest extent 
possible. AAMVA noted that its current Card Design Specification does 
not require a similar color for all States, although it standardizes 
security features. AAMVA recommended that ``branding'' be applied to 
the REAL ID, but it also recognized that this would lead some 
individuals to believe this was a step toward a national ID card. State 
commenters wrote that a benefit of a standard color would be to ease 
training of screeners and help ensure that screeners could easily 
identify a compliant REAL ID-compliant card.
    One commenter wrote that REAL ID should mandate a standardized 
color or design. However, other commenters wrote that DHS should not 
mandate a standard design or color, that a standard design is not 
authorized by the REAL ID Act, that a standardized design is strictly 
prohibited by the Intelligence Reform and Terrorism Prevention Act of 
2004, Public Law 108-458, and that a uniform REAL ID design would be an 
``enormous'' security risk.
    Response: DHS is not mandating a single design or color for REAL 
ID-compliant driver's licenses or identification cards, and recognizes 
a State's right to have a unique design. However, in response to 
several commenters, DHS is requiring that cards issued in compliance 
with REAL ID be marked with a DHS-approved security marking.

V. Regulatory Analyses

A. Paperwork Reduction Act

    The Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.) 
requires that DHS consider the impact of paperwork and other 
information collection burdens imposed on the public and, under the 
provisions of PRA section 3507(d), obtain approval from the Office of 
Management and Budget (OMB) for each collection of information it 
conducts, sponsors, or requires through regulations.
    This rule contains the following new information collection 
requirements. Accordingly, DHS submitted a copy of these sections to 
OMB for its review. OMB has not yet approved the collection of this 
information.
    This final rule will require States participating in the REAL ID 
program to meet certain standards in the issuance of driver's licenses 
and identification cards, including security plans and background 
checks for certain persons who are involved in the manufacture or 
production of driver's licenses and identification cards, or who have 
the ability to affect the identity information that appears on the 
license (covered employees). This rule will support the information 
needs of: (a) The Department of Homeland Security, in its efforts to 
oversee security measures implemented by States issuing REAL ID 
driver's licenses and identification cards; and (b) other Federal and 
State authorities conducting or assisting with necessary background and 
immigration checks for covered employees.
    The likely respondents to this proposed information requirement are 
States (including the District of Columbia, Puerto Rico, the Virgin 
Islands, Guam, American Samoa, and the Commonwealth of the Northern 
Mariana Islands) and State agencies (such as Departments of Motor 
Vehicles).
    DHS estimates that each State will submit a certification of 
compliance or request for extension, together with a security plan. 
Subsequently, each State will be required to re-certify its compliance 
with the REAL ID Act every three years on a rolling basis. As part of 
the certification package, States will be required to submit (1) A copy 
of their security plan; (2) their documented exceptions and waivers 
procedures; and (3) a written report on card security and integrity 
(which must be updated whenever a security feature is modified, added 
or deleted). DHS estimates that States will spend approximately 42,000 
burden hours in the first year to complete the certification 
requirements. DHS projects that the burden hours will rise to 56,000 
hours annually in subsequent years. DHS estimates the cost to the 
States will be $1.11 million in the first year and $1.48 million every 
year thereafter, for an annualized cost estimate (over three years) of 
$1.35 million.
    States must subject covered employees to a background check, which 
includes a name-based and fingerprint-based criminal history records 
check (CHRC). DHS estimates States will incur costs for employee 
background checks of $1.44 million in the first year, $0.61 million in 
the second year, and $0.37 million in the third year, for an annualized 
cost estimate of $0.80 million.
    Finally, States must maintain photographs of applicants and records 
of certain source documents. DHS estimates that States will incur 
2,275,000 hours for information technology (IT) in the first year, and 
348,000 hours in subsequent years, for an annualized hour burden 
estimate (over three years) of 990,333. DHS estimates that ten percent 
of all IT costs is related to the recordkeeping requirements. Thus, DHS 
estimates that out of a total one time cost of $601.9 million for all 
State systems, ten percent, or $60.2 million, will be incurred in the 
first year, and $9.3 million in the second and third years as a result 
of this collection of information, for an annualized cost of $26.26 
million.
    DHS received no comments directed to the information collection 
burden.
    As protection provided by the Paperwork Reduction Act, as amended, 
an agency may not conduct or sponsor, and a person is not required to 
respond to, a collection of information unless it displays a currently 
valid OMB control number.

B. Economic Impact Analyses

Regulatory Evaluation Summary
    Changes to Federal regulations must undergo several economic 
analyses. First, Executive Order 12866, Regulatory Planning and Review 
(58 FR 51735, October 4, 1993), directs each Federal agency to propose 
or adopt a regulation only upon a reasoned determination that the 
benefits of the intended regulation justify its costs. Second, the 
Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq., as amended by 
the Small Business Regulatory Enforcement Fairness Act (SBREFA) of 
1996) requires agencies to analyze the economic impact of regulatory 
changes on small entities. Third, the Trade Agreements Act (19 U.S.C. 
2531-2533) prohibits agencies from setting standards that create 
unnecessary obstacles to the foreign commerce of the United States. 
Fourth, the Unfunded Mandates Reform Act of 1995 (UMRA, 2 U.S.C. 1531-
1538) requires agencies to prepare a written assessment of the costs, 
benefits, and other effects of proposed or final rules that include a 
Federal mandate likely to result in the expenditure by State, local, or 
tribal governments, in the aggregate, or by the private sector, of $100 
million or more annually (adjusted for inflation).
    Although Congress recognized that States will have to expend monies 
in order to comply with REAL ID, it explicitly stated that the REAL ID 
Act is binding on the Federal government, and not the States. Moreover, 
by its terms, UMRA does not apply to regulations ``necessary for the 
national security''

[[Page 5322]]

and those which impose requirements ``specifically set forth in law.'' 
Thus, as a matter of law, the UMRA requirements do not apply to this 
final rulemaking even though States will be expending resources. 
However, the analyses that would otherwise be required are similar to 
those required under Executive Order 12866, which have been completed 
and may be found in the detailed Regulatory Evaluation placed in the 
public docket.
Executive Order 12866 Assessment
    DHS has determined that this rule will have an impact of over $100 
million and that it raises novel or complex policy issues. Accordingly, 
this rule is economically significant under Section 3(f)(1) of 
Executive Order 12866 and therefore has been reviewed by the Office of 
Management and Budget.
    DHS has assessed the costs, benefits and alternatives of the 
requirements finalized by this rule. A complete regulatory impact 
assessment, as required under Executive Order 12866 and OMB Circular A-
4, will be set forth in a separate document in the docket for this 
regulatory action at http://www.regulations.gov at Docket Number DHS-
2006-0030. The details of the estimated costs and benefits, including 
potential ancillary benefits realized by the requirements set forth in 
this rule, follow the A-4 Accounting Statement. The uncertainty 
analyses are being recomputed and will be published in the forthcoming 
final regulatory impact assessment.
    The Department of Homeland Security (DHS) is conducting a 
Regulatory Evaluation of the benefits and costs of the final minimum 
standards for State-issued driver's licenses and non-driver 
identification cards pursuant to the REAL ID Act of 2005. These 
standards will impact the lives of approximately 240 million people and 
the operations of all 56 State and territorial jurisdictions.
Assumptions
    This Regulatory Evaluation covers the eleven-year costs of REAL ID 
Program deployment and operations. This includes:
     Years One through Four--the three and one-half year period 
from January 2008 to May 11, 2011 during which States will have time to 
make the business process changes and investments to meet the standards 
of REAL ID. In addition, States meeting the interim standards of 
Material Compliance with the rule must begin enrolling their 
populations in REAL ID beginning no later than January 1, 2010.
     Years Four through Eleven--the seven year period during 
which States will continue and complete enrollment of their populations 
in REAL ID. States will begin issuing fully compliant REAL ID licenses 
no later than May 11, 2011. Moreover, DHS has adopted an age-based 
approach to REAL ID enrollment. By December 1, 2014 all individuals 
born on or after December 1, 1964 (that is, 50 years of age or under) 
will be required to present a REAL ID if they use a State-issued 
document for official purposes. Thus, individuals born on or after 
December 1, 1964 will have a minimum of four years to obtain a REAL ID. 
Individuals born before December 1, 1964 will have an additional three 
years to enroll before the final enforcement deadline of December 1, 
2017.
    The final rule incorporates significant changes to the Notice of 
Proposed Rulemaking. As a result, we have revised some of the 
assumptions upon which the original Regulatory Evaluation was based. 
The revised assumptions are detailed below:
(1) That All States Will Comply in Accordance With the Revised Timeline
    DHS recognizes that most, if not all States will be unable to 
comply by May 2008 and will file requests for extensions that will 
result in compliance implementation schedules that could mitigate some 
of the startup costs examined below. Hence, the costs allocated to the 
period prior to May 2008 will be redistributed to subsequent years.
(2) That 75 Percent of the Nation's DL/ID Holders Will Seek a REAL ID 
Credential
    The original NPRM assumed that 100% of the candidate population 
would seek to obtain REAL IDs. This assumption was combined with two 
additional assumptions, namely that:
    1. States will not require all individuals to obtain a REAL ID;
    2. Some States will continue to issue non-compliant licenses along 
with REAL IDs.
    The Department has reviewed the 100% assumption and concluded that 
it is unrealistic in light of the latter two assumptions. If States do 
not require all applicants to obtain REAL IDs, it is highly improbable 
that 100% of the population will apply. It is difficult to cite any 
example of a truly voluntary course of action that results in 100% 
compliance. If States offer a choice of either compliant or non-
compliant licenses to applicants, some portion of the population will 
choose to receive a non-compliant license because:
    1. They do not need a REAL ID for Federal official purposes.
    2. They already possess a substitute document--for example, a U.S. 
passport--that will serve the same purpose as a REAL ID.
    Thus, the Department has reconsidered and eliminated the assumption 
that every individual 16 or older will seek to obtain a REAL ID within 
the timeframe of this analysis.
    The difficult question, therefore, is what level of participation 
in REAL ID can be realistically expected? What should be the primary 
estimate for participation by the American public in REAL ID?
    The Regulatory Evaluation utilizes a primary estimate of 75% based 
upon the following analysis:
    1. A significant number of States will not require that all 
residents seeking driver's licenses or identification card obtain a 
REAL ID. Eight states currently issue licenses to individuals who 
cannot demonstrate lawful states and a significant number of States are 
likely to make REAL IDs an option.
    2. 25% of the population already holds a valid passport and the 
Department of State anticipates that this figure will increase to 
approximately 33% in the next few years.\3\ Individuals with valid 
passports do not need to obtain a REAL ID as passports are likely to 
also be accepted for the same official purposes (i.e., boarding 
commercial aircraft) as a REAL ID.
---------------------------------------------------------------------------

    \3\ Testimony of Maura Harty, Assistant Secretary of State for 
Consular Affairs, before the Senate Foreign Relations Committee, 
International Operations and Organizations Subcommittee, June 19, 
2007, at http://travel.state.gov/law/legal/testimony/testimony_806.html.
---------------------------------------------------------------------------

    3. 20% of the population has never flown on a commercial airplane 
and 47% flies ``rarely or never.'' \4\ This second group is unlikely to 
need a REAL ID and members of this group are highly unlikely to belong 
to the group of valid passport holders.
---------------------------------------------------------------------------

    \4\ Statistics reported in The Airline Handbook, issued by the 
Air Transport Association and located at http://members.airlines.org/about/d.aspx?nid=7954 and by the Gallup 
Organization at http://www.gallup.com/poll/1579/Airlines.aspx.
---------------------------------------------------------------------------

    4. These two groups, combining to constitute a group of at least 
40% of the population, should not need to obtain a REAL ID as 
acceptance of identification for official purposes. Assuming that a 
large proportion of this group will seek to obtain a REAL ID regardless 
of imminent need, we believe that 25% of the candidate population will 
not seek to obtain a REAL ID.
(3) States Will Issue Both REAL IDs and Non-REAL IDs
    DHS anticipates that States will offer an alternative DL/ID (not 
acceptable for official purposes) to those who are

[[Page 5323]]

unwilling or unable to obtain a compliant one. A number of States issue 
or plan to issue licenses to individuals that cannot document lawful 
status. Other States are expected to allow individuals to hold both a 
driver's license and identification card. Finally, a number of States 
have evaluated or expressed interest in offering REAL IDs as an 
additional, voluntary license. This Regulatory Evaluation assumes that 
States will deploy a two-tier or multi-tier licensing system. States 
instead may choose to issue only REAL ID-compliant driver's licenses 
and identification cards, thereby reducing their operational and system 
costs.\5\
---------------------------------------------------------------------------

    \5\ Eight states currently issue licenses to undocumented 
immigrants and will--most likely--continue to do so. These States 
are: Michigan, Maryland, Hawaii, New Mexico, Oregon, Utah, 
Washington, and Maine.
---------------------------------------------------------------------------

(4) That All IT Systems Will Be Functional by May 11, 2011
    The NPRM assumed that all IT systems would be functional by May 11, 
2008. DHS now recognizes that this assumption was overly optimistic. 
Therefore, DHS has extended the deadline for compliance with the rule 
until May 11, 2011 to give the States, Federal agencies, and non-
governmental organizations like AAMVA the time to complete the 
communications and IT infrastructure needed to implement REAL ID. 
Therefore, DHS has recalculated the costs assuming that all required 
verification data systems be operational and fully populated by May 11, 
2011, the deadline for full compliance by States. DHS is working to 
bring these systems on-line and up to standards as soon as possible and 
will work with the States to develop alternative procedures.
(5) That State Impact Is Not Uniform Due to Progress Already Made in 
Some States
    States that have already invested in improving the security of 
their licenses will have to invest far less per capita than States with 
less secure licenses and issuance processes. Those States that are more 
advanced will incur lower compliance costs than other States.
(6) The Typical Validity Period of Driver's Licenses in a Given State 
is the Validity Period for All DL/IDs in That State
    DHS is aware that within a State DL/IDs often have varying validity 
periods but was unable to determine how many people held each of these 
varying types of credentials and when they were issued. (For more 
details, see the discussion of Validity Periods in the Status Quo 
section.) Also, the final regulation creates a one-year license for 
certain aliens. DHS was able to determine that some people already hold 
such licenses, but not how many people hold them. DHS was also unable 
to determine how many people will hold them under the REAL ID rule. 
While this methodology has limitations, using the typical validity 
period of DL/IDs was the most reliable method available to estimate 
future issuances.
(7) Those Drivers Who Would Be Required To Comply Later in the Issuance 
Cycle Will Take Advantage of This Delayed Compliance
    DHS has computed the costs for the over age 50 drivers by moving 
that segment of renewals towards the 2017 deadline. DHS assumes the 
distribution over time for renewals is similar to the rest of the 
population. Therefore these license renewals are not bunched up but 
entered as the same distribution as other drivers but with the last of 
the pool completing in 2017.
(8) The Cost of Lost/Stolen DLs/IDs and Central Issuance Is Included in 
the Cost of This Final Rule
    The regulatory evaluation for the proposed rule assigned the cost 
of having to replace a lost or stolen legacy ID with a REAL ID as being 
a regulatory compliance cost. This means that if an individual loses 
his/her legacy license, the burden of replacing it with a REAL ID 
requiring an in-person visit was attributed to this rulemaking. The 
regulatory evaluation for the final rule employs the assumption that 
individuals who replace their lost or stolen legacy license will choose 
to obtain a REAL ID and pay the additional opportunity costs of an in-
person visit to the DMV with the required source documents. After 
careful consideration, we believe that this assumption may be 
conservative based upon the revised requirements of the final rule. The 
enrollment periods of REAL ID have been designed to enable DMVs to 
enroll individuals with REAL IDs on their normal renewal cycles to the 
maximum extent possible. Individuals simply replacing a lost or stolen 
license are likely to want a replacement license as quickly as possible 
and delay the process of obtaining a REAL ID until their scheduled 
renewals. However, we maintain the original assumption in this economic 
analysis because we cannot estimate the different rate at which lost or 
stolen licenses will be replaced with REAL IDs. Therefore, we assume 
the rate to be 75% or the same as that for renewals.
    The regulatory evaluation still assumes that States will move to 
central issuance because of the high cost of printing equipment for 
REAL ID cards. However, the final rule provides added flexibility and 
therefore States may not have to do this. We are not adjusting this 
regulatory evaluation to account for this due to uncertainties in 
States' behavior under the revised provisions of this final rule, and 
because there are remaining requirements in this final rule that may 
still make central issuance the most efficient response.
(9) The Cost of Security Markings on REAL ID Cards
    Based on discussions with State driver's license card vendors, we 
have estimated the cost for a security marking for compliant cards to 
be $0.25 per card, and have included this cost estimate in the card 
production analysis later in this document.
    The final rule also requires that if a State issues a license that 
is not in compliance with REAL ID, the State must by statute and 
regulation indicate on the document that it is not valid for official 
Federal purposes. According to U.S. license vendors contacted by DHS, 
\6\ there is typically an upfront one time set up fee for the State, 
which may include license redesign, system reconfiguration, and other 
related costs. Based on our analysis of information received from 
vendors and States, DHS estimates that the added cost would be about 
$10,000 per State, or $.01 per document. The actual cost will vary 
depending on the State, vendor and any existing contractual agreement 
they may have concerning design changes. DHS believes that the added 
cost of no more than $0.01 per document will be indirectly incurred by 
those individuals who will be acquiring REAL IDs.
---------------------------------------------------------------------------

    \6\ Based upon conversations between the REAL ID program office 
and U.S. license vendors, December, 2007.
---------------------------------------------------------------------------

Summary of Major Differences Between the Final Rule and NPRM
    Based upon the many comments received, the Final Rule incorporates 
major changes from the NPRM. The major changes impacting the economic 
analysis include:
(1) Extension of Deadlines
    In the NPRM, DHS proposed that States that would not be able to 
comply by May 11, 2008, should request an extension of the compliance 
date no later than February 10, 2008, and encouraged States to submit 
requests for extension as early as October 1, 2007. During the public 
comment period, DHS

[[Page 5324]]

received numerous comments from States and Territories, State 
associations, and others, noting that almost all States would be unable 
to meet the May 2008 compliance deadline. Accordingly, to allow more 
time for States to implement the provisions of the rule in general and 
verification systems in particular, DHS is also providing in the final 
rule the opportunity for States to request extensions of the compliance 
date beyond the initial extension of December 31, 2009. To obtain a 
second extension, States must file a Material Compliance Checklist by 
October 11, 2009. This checklist will document State progress in 
meeting certain benchmarks toward full compliance with the requirements 
of this rule. States meeting the benchmarks shall be granted a second 
extension until no later than May 10, 2011. This would give States 
making significant progress additional time to meet all of the 
requirements of this rule.
(2) Extended Enrollment Periods and Risk-Based Enrollment
    The NPRM proposed that States determined by DHS to be in full 
compliance with the REAL ID Act and these implementing regulations by 
May 11, 2008, would have a five-year phase-in period--until May 11, 
2013--to replace all licenses intended for use for official purposes 
with REAL ID cards.
    During the public comment period, a number of States and State 
associations commented that States obtaining an initial extension of 
the compliance date until December 31, 2009, would still be required to 
enroll their existing driver population (estimated to be approximately 
240 million) by May 11, 2013--essentially halving the phase-in period. 
Several commenters suggested that DHS employ a risk-based approach that 
would permit States and DMVs to focus first on perceived higher-risk 
individuals while deferring lower-risk individuals to a date beyond May 
11, 2013.
    DHS agrees with both these comments. Accordingly, in this final 
rule, DHS is extending the deadline for enforcing the provisions of the 
Act for all driver's licenses and identification cards until no later 
than December 1, 2017, but requiring REAL ID-compliant driver's 
licenses and identification cards for individuals 50 years of age or 
under (that is, individuals born on or after December 1, 1964) when 
used for official purposes beginning on December 1, 2014. This will 
effectively give States an eight-year enrollment period beginning in 
January 1, 2010 when Materially Compliant States can begin the 
enrollment process, thus avoiding an unnecessary operational burden on 
State DMVs from a crush of applicants on or before the original May 11, 
2013 compliance date.
(3) Physical Card Security
    DHS has modified the proposed card security requirements in 
response to comments which stated that the requirements were too 
prescriptive and placed an undue burden on the States. Instead, DHS has 
proposed a performance-based approach that provides the flexibility for 
States to implement solutions using a well-designed balanced set of 
security features for cards that, when effectively combined, provide 
maximum resistance to counterfeiting, alteration, substitution, and the 
creation of fraudulent documents from legitimate documents.
(4) Marking of Compliant REAL ID Documents
    Based on an analysis of feedback from several commenters, DHS has 
determined that it would be in the best interest of the nation's 
security for States to place a security marking on driver's licenses 
and identification cards that are issued in compliance with the REAL ID 
Act. Such a marking would facilitate the verification of the 
authenticity of such documents by Federal agencies requiring 
identification for official purposes.
(5) Certification and Security Plan Documentation
    Based on feedback from commenters, DHS has eased the reporting and 
documentation requirements placed upon States by circumscribing the 
scope of security plans and requiring submission of updated plans and 
certification packages on a rolling, triennial basis.
(6) Address Change and Documentation Requirements
    Based on numerous responses, DHS has removed the requirement that 
an address change must be accomplished through an in-person visit to 
the DMV. Additionally, there is no requirement in the final rule for 
States to issue a new card when notified of an address change. 
Moreover, DHS now allows States fuller discretion over the acceptance 
of address documents by removing specific requirements that documents 
used to demonstrate address of principal residence be issued 
``monthly'' and ``annually.''
(7) Financial Check
    DHS agreed with comments that the financial history check would not 
be determinative. Therefore, DHS has eliminated the requirement for a 
financial history check from the final rule.
Costs and Benefits
    This Regulatory Evaluation attempts to quantify or monetize the 
economic benefits of REAL ID. In spite of the difficulty, most everyone 
understands the benefits of secure and trusted identification. The 
final minimum standards seek to improve the security and 
trustworthiness of a key enabler of public and commercial life--State-
issued driver's licenses and identification cards. As detailed below, 
these standards will impose additional burdens on individuals, States, 
and even the Federal government. These costs, however, have been 
weighed against the quantifiable and nonquantifiable but no less real 
benefits to both public and commercial activities achieved by secure 
and trustworthy identification.
Economic Costs
    Implementing the REAL ID Act will impact all 56 jurisdictions, more 
than 240 million applicants for and holders of State DL/IDs, private 
sector organizations, and Federal government agencies.
    Figure 1: summarizes the estimated marginal economic costs of the 
final rule over an eleven year period.
    Figure 1: Estimated marginal economic cost of REAL ID final rule.

----------------------------------------------------------------------------------------------------------------
                                                 $ million        $ million     $ million (2006   Percent total
                                             ----------------------------------     dollars)    ----------------
         Estimated costs (11 years)                                            -----------------
                                               7% discounted    3% discounted     Undiscounted     Undiscounted
----------------------------------------------------------------------------------------------------------------
Costs to States.............................            2,879            3,413            3,965             39.9
    Customer Services.......................              636              804              970              9.8
    Card production.........................              690              822              953              9.6
    Data Systems & IT.......................            1,171            1,352            1,529             15.4

[[Page 5325]]

 
    Security & Information Awareness........              365              415              490              4.9
    Data Verification.......................                5                7                8              0.1
    Certification process...................               11               13               16              0.2
Costs to Individuals........................            3,808            4,814            5,792             58.3
Opportunity Costs...........................            3,429            4,327            5,215             52.5
    Application Preparation (125.8 million              2,186            2,759            3,327             33.5
     hours).................................
    Obtain Birth Certificate (20.1 million                348              440              530              5.3
     hours).................................
    Obtain Social Security Card (1.6 million               31               37               44              0.4
     hours).................................
    DMV visits (49.8 million hours).........              864            1,091            1,315             13.2
Expenditures: Obtain Birth Certificate......              379              479              577              5.8
Cost to Private Sector......................                8                9                9              0.1
Costs to Federal Government.................              128              150              171              1.7
    Social Security card issuance...........               36               43               50              0.5
    Data Verification--SAVE.................                9               11               14              0.1
    Data Systems & IT.......................               65               74               82              0.8
    Certification & training................               17               21               25              0.3
                                             -------------------------------------------------------------------
        Total Costs.........................            6,853            8,406            9,939            100.0
----------------------------------------------------------------------------------------------------------------

    Figure 1 shows the primary estimates calculated in both 
undiscounted 2006 dollars and discounted dollars at both the 3% and the 
7% discounted rates. The total, undiscounted eleven-year cost of the 
final rule is $9.9 billion. Based on a total of 477.1 million issuances 
over the 11-years of the analysis, the average marginal cost per 
issuance for States is $8.30. Individuals will incur the largest share 
of the costs as shown in Figure ES-2. More than 58 percent of the costs 
(discounted or undiscounted) are associated with preparing 
applications, obtaining necessary documents, or visiting motor vehicle 
offices.
    The costs shown in Figure ES-2 show a substantial decrease in those 
reported in the NPRM. In particular, the costs for States are 27% of 
those estimated for the NPRM. This substantial decrease in costs can be 
attributed to a number of factors, including a revised assumption that 
only 75% of DL/ID holders will apply for a REAL ID as well as a less 
prescriptive, performance-based, and balanced approach to REAL ID 
implementation. As many commenters suggested, providing additional time 
for implementation and enrollment of DL/ID holders will allow States to 
accommodate the enrollment process without disrupting their normal 
renewal cycles, resulting in a decrease in total REAL ID issuances from 
813 million to 477 million issuances. In addition, the undiscounted 
estimates for card production costs have decreased substantially from 
$5.8 billion in the NPRM to $953 million in the final rule based on the 
performance-based approach to card security standards recommended by 
numerous commenters.
    DHS recognizes that many States have made significant progress in 
improving the integrity of their licenses. DHS also recognizes that the 
prescriptive technology standards included in the NPRM, compared to the 
final rule, provided relatively few additional security benefits at 
great cost to States. Moreover, the estimated opportunity costs to 
individuals have been reduced from $7.1 to $5.8 billion in undiscounted 
dollars primarily as a result of the changed assumption that only 75% 
of DL/ID holders will seek REAL IDs. Individuals will still have to 
obtain source documents and visit their DMVs under this analysis. 
Finally, the undiscounted costs to States for data systems and IT have 
actually increased from $1.4 billion in the NPRM to $1.5 billion in the 
final rule. This slight increase reflects the critical role of 
information technology and verification systems in reducing identity 
theft and identity fraud in the issuance of DL/IDs.
    The four largest cost areas, in descending order (in undiscounted 
dollars) are:
     Opportunity costs to individuals ($5.2 billion),
     Maintaining the necessary data and interconnectivity 
systems ($1.5 billion),
     Customer service ($970 million), and
     Card production and issuance ($953 million)
    The largest impact category is the cost to individuals of obtaining 
source documents, preparing applications, and visiting DMVs. The 
magnitude of this category is driven largely by the fact that all 
applicants for a REAL ID will need to complete an application process 
similar to those of a first-time driver or a driver moving from one 
State to another.
    The second largest impact category is the creation and maintenance 
of necessary data and interconnectivity systems. These systems will 
require substantial up-front effort to create but are likely to require 
smaller marginal increases in maintenance costs.
    The third largest impact is customer service. While the extension 
of the enrollment period in the final rule will minimize marginal 
increases in the number or flow of transactions, the rule accounts for 
costs that increased transaction and wait times will produce. REAL ID 
should not substantially accelerate the rate of transactions, but the 
per transaction costs to States will increase.
    The fourth largest impact is the production and issuance of the 
REAL IDs themselves. The final minimum standards are intended to make 
counterfeit production, tampering and other fraud more difficult. While 
some State cards may already meet the standards of the final rule, many 
States may have to upgrade their cards and production processes in 
response to the rule. These upgrades will also require a substantial 
up-front effort followed by smaller marginal costs for subsequent 
years.
Estimated Benefits
    The final REAL ID regulation will strengthen the security of 
personal identification. Though difficult to quantify, nearly all 
people understand the benefits of secure and trusted identification and 
the economic, social, and personal costs of stolen or fictitious 
identities. The REAL ID final rule seeks to improve the security and 
trustworthiness of a key enabler of public and commercial life--State-

[[Page 5326]]

issued driver's licenses and identification cards.
    The primary benefit of REAL ID is to improve the security and 
lessen the vulnerability of federal buildings, nuclear facilities, and 
aircraft to terrorist attack. The rule gives States, local governments, 
or private sector entities an option to choose to require the use of 
REAL IDs for activities beyond the official purposes defined in this 
regulation. To the extent that States, local governments, and private 
sector entities make this choice, the rule may facilitate processes 
which depend on licenses and cards for identification and may benefit 
from the enhanced security procedures and characteristics put in place 
as a result of this final rule.
    DHS provides a ``break-even'' analysis based on the rule having an 
impact on the annual probability of the United States experiencing a 9/
11 type attack in the 11 years following the issuance of the rule. It 
is exceedingly difficult to predict the probability and consequences of 
a hypothetical terrorist attack. DHS believes that those factors cannot 
be determined for purposes of this benefit analysis. However, for the 
purposes of this analysis, it is not necessary to assume that there is 
a probability of being attacked in any particular year.
    By making some generalized but conservative assumptions about the 
costs of attack consequences, DHS determined the reduction in 
probability of attack that REAL ID will need to bring about so that the 
expected cost of REAL ID equals its anticipated security benefits. DHS 
posed the following question: what impact would this rule have to have 
on the annual probability of experiencing a 9/11 type attack in order 
for the rule to have positive quantified net benefits? This analysis 
does not assume that the United States will necessarily experience this 
type of attack, but rather is attempting to provide the best available 
information to the public on the impacts of the rule.
    DHS also developed an analysis based on the discounted cost of a 
single terrorist attack comparable to the 9/11 attacks on New York City 
and Washington, DC taking place sometime over an eleven-year span. The 
agency determined at what point the final rule would be cost-beneficial 
given the likelihood of an attack and the effectiveness of preventing 
the attack.
    The final rule on REAL ID is likely to produce potential ancillary 
benefits as well. It will be more difficult to fraudulently obtain a 
legitimate license and more costly to create a false license, which 
could reduce identity theft, unqualified driving, and fraudulent 
activities facilitated by less secure driver's licenses such as 
fraudulent access to government subsidies and welfare programs, illegal 
immigration, unlawful employment, unlawful access to firearms, voter 
fraud and possibly underage drinking and smoking. DHS assumes that REAL 
ID will bring about changes on the margin that will potentially 
increase security and reduce illegal behavior. Because the size of the 
economic costs that REAL ID serves to reduce on the margin are so 
large, however, a relatively small impact of REAL ID may lead to 
significant benefits.
Regulatory Flexibility Act Assessment
    The Regulatory Flexibility Act of 1980 \7\ (RFA), as amended, was 
enacted by Congress to ensure that small entities (small businesses, 
small not-for-profit organizations, and small governmental 
jurisdictions) are not unnecessarily or disproportionately burdened by 
Federal regulations. The RFA requires agencies to review rules to 
determine if they have ``a significant economic impact on a substantial 
number of small entities.'' The following analysis suggests that the 
rule will not have a significant economic impact on a substantial 
number of small entities.
---------------------------------------------------------------------------

    \7\ Regulatory Flexibility Act, Pub. L. 96-354, 94 Stat. 1164 
(codified at 5 U.S.C. Sec.  601).
---------------------------------------------------------------------------

    The Department is implementing the regulations in order to enact 
the requirements outlined in the REAL ID Act.\8\ This rule establishes 
minimum standards for the issuance of State-issued driver's licenses 
and non-driver identification cards (DL/IDs). These minimum standards 
will:
---------------------------------------------------------------------------

    \8\ REAL ID Act of 2005. Pub. L. 13, 109th Cong., 1st Sess. (May 
11, 2005), 201, 202.
---------------------------------------------------------------------------

     Enhance the security features of DL/IDs, rendering them 
more difficult to counterfeit, tamper with, or cannibalize;
     Ensure that holders of unexpired REAL IDs are lawfully 
present in the United States;
     Enhance physical security of materials and production 
locations to reduce the likelihood of theft of materials and 
infiltration of DMVs by nefarious individuals;
     Enhance identity source document requirements and 
verifications to reduce the number of DL/IDs issued by DMVs to persons 
committing identity fraud; and,
     Ensure that a REAL ID driver's license holder is licensed 
in only one State.
    In short, these standards are designed to ensure that holders of 
unexpired REAL IDs are who they say they are and that they are lawfully 
present in the United States.
    DHS did not receive any public comments on the Initial Regulatory 
Flexibility Analysis that was issued in support of the NPRM during the 
public comment period. All public comments are available for the public 
to view at the Federal Docket Management System: http://www.regulations.gov.
    As part of this rulemaking effort, DHS has summarized and responded 
to all public comments relating to the Regulatory Evaluation issued 
with the NPRM. Comment summaries and responses are located in the 
preamble to the final rule, which is also available at http://www.regulations.gov and in the Federal Register.
    The rule directly regulates States, which by definition are not 
small entities. The rule indirectly regulates entities that accept 
State-issued DL/IDs for official purposes. The rule defines those 
purposes as accessing Federal facilities, entering nuclear power plants 
and boarding federally regulated commercial aircraft. The entities that 
accept DL/IDs for those purposes include the Federal Government, 
operators of nuclear power plants and entities examining personal 
identity documents of people boarding federally regulated commercial 
aircraft. The rule does not require action from any of these three 
entities. However, these entities are likely to engage in some activity 
to ensure that they comply with the Act. The remainder of this section 
estimates the number of small entities that are affected in this 
indirect way.
    The Federal Government is not a small entity. Therefore, no small 
entities are affected by the prohibition on accepting State-issued DL/
IDs that are not REAL IDs to access Federal facilities.

[[Page 5327]]

    Nuclear power plants, though not directly regulated, may experience 
indirect impacts from this regulation. A nuclear power plant qualifies 
as a small entity if ``including its affiliates, it is primarily 
engaged in the generation, transmission, and/or distribution of 
electric energy for sale and its total electric output for the 
preceding fiscal year did not exceed 4 million megawatt hours.'' \9\ 
With only three exceptions, every nuclear power plant in the United 
States produced more than 4 million megawatt hours in fiscal year 
2005.\10\ However, companies producing more than 12 million megawatt 
hours own each of those three plants.\11\ None of the nuclear power 
plants qualifies as small businesses using the SBA definition. 
Therefore, no small entities are affected by the prohibition on 
accepting State-issued DL/IDs that are not REAL IDs to enter nuclear 
power plants.
---------------------------------------------------------------------------

    \9\ Small Business Administration. Small Business Size Standards 
Matched to North American Industrial Classification System. Footnote 
1. Available at http://www.sba.gov/size/sizetable2002.html#fn1. Accessed July 14, 2006.
    \10\ Calculations based on data from the Energy Information 
Administration. U.S. Department of Energy. Monthly Nuclear Utility 
Generation by State and Reactor, 2004 and Monthly Nuclear Utility 
Generation by State and Reactor, 2005. Available at http://www.eia.doe.gov/cneaf/nuclear/page/nuc_generation/gensum.html. 
Accessed July 14, 2006.
    \11\ Conclusion based on an Internet search conducted on July 
14, 2006 of the three specific power plants and the companies that 
own and operate them.
---------------------------------------------------------------------------

    Entities examining identity documents of people who are boarding 
federally regulated commercial aircraft will not be directly regulated 
by the rulemaking. However, they may experience indirect effects. 
Different types of entities examine personal identity documents of 
people boarding federally regulated commercial aircraft. Currently, 
this responsibility falls on the entity with whom passengers check 
their luggage, the entity examining boarding passes and IDs immediately 
in front of TSA screening checkpoints, and, when completed to fulfill 
federal requirements, the entities examining IDs directly before 
allowing passengers to board aircraft. The easiest group of entities to 
identify in this category is the airlines that enplane from and/or 
deplane into the sterile area of an airport.\12\ The Small Business 
Administration considers companies operating either scheduled or non-
scheduled chartered passenger air transportation to be small entities 
if they have fewer than 1,500 employees.\13\ Using these criteria, DHS 
has identified 24 specific small entities that offer scheduled or non-
scheduled air passenger transportation and that enplane from or deplane 
into an airport sterile area. Other federally regulated commercial 
aircraft include charter flights, air taxis, scenic air tours and other 
similar operations where the transportation of passengers for 
compensation comprises the majority of their revenues. Many of these 
entities would qualify as small entities under the SBA definition. SBA 
data show that, overall, 2,719 of the 2,877 firms engaged in air 
transportation (NAICS 481) had fewer than 500 employees in 2004.\14\ 
Nearly all firms in the air transportation industry fall well below the 
1,500-employee size standard to qualify as a small entity. (Note that 
the federal requirements may not require all of these firms to examine 
passenger identity documents prior to boarding.)
---------------------------------------------------------------------------

    \12\ ``Sterile area'' is defined in 49 CFR 1540.5 and generally 
means an area with access limited to persons who have undergone 
security screening by TSA. Therefore, only TSA-regulated airports 
have sterile areas.
    \13\ U.S. Small Business Administration. Small Business Size 
Standards Matched to North American Industrial Classification 
System. NAICS 481111 and 481211. Available at http://www.sba.gov/size/sizetable2002.html. Accessed July 14, 2006.
    \14\ U.S. Small Business Administration. U.S. Data Classified by 
Employment Size of Firm: All industries, 2003-2004. Available at 
http://www.sba.gov/advo/research/data.html. Accessed 4 Oct 2006.
---------------------------------------------------------------------------

    DHS estimates that each employee accepting DL/IDs for official 
purposes will require two hours of training. This training will assist 
personnel in identifying the differences between REAL IDs and other 
State-issued DL/IDs. The training will also inform personnel about 
which States are or are not compliant during the enrollment period. In 
order to assess the cost of this training, DHS calculated the fully 
loaded wage rate of $22.95 per hour for airline ticket counter agents 
and $22.50 per hour for airport checkpoint staff. Multiplying the wage 
rates by the estimated two hours to complete the training yields 
estimates of $45.90 and $45.01 per-employee for ticket counter agents 
and checkpoint staff, respectively. The next step to determine if 
firms' action will have a significant impact is to divide the summed 
products of wage rates and trained employees by firm revenue. Doing so 
yields the impact on the firm as a percent of their total receipts. 
However, data on how many employees firms will train do not exist on an 
industry level, much less at the firm level throughout the industry. 
Alternatively, a threshold analysis can determine at what point the 
revenue to trained employee ratio would constitute a one or three 
percent impact for a firm.
    The Department has determined threshold levels that will cause an 
indirect impact equal to or less than one percent and equal to or 
greater than three percent of an entity's total revenue. If a firm's 
ratio is higher than the one percent threshold, the economic impact for 
that firm is not significant. If the ratio is lower than the three 
percent threshold, the economic impact will be larger than three 
percent of the firm's revenue. The threshold values are measured as the 
ratio of total revenue to the number of employees to be trained 
regarding REAL ID. If the amount of a firm's revenue per trained 
counter agent is more than $4,590, then the effect is less than one 
percent of total revenue. If one percent requires revenue per agent of 
$4,590, then the three percent threshold revenue per agent lies at 
$1,530. If a firm's revenue per counter agent is less than $1,530, then 
the effect will be greater than three percent. The same approach can be 
applied to airport checkpoint staff yielding $4,501 at one percent and 
$1,500 at three percent. (See Figure 2)

[[Page 5328]]

[GRAPHIC] [TIFF OMITTED] TR29JA08.001

    Applying the one percent threshold--the most stringent--to the 24 
scheduled service firms specifically identified as small entities 
suggests that training employees regarding REAL ID will not impose a 
significant economic impact on a substantial number of small entities. 
Dividing a firm's total 2005 revenue by $4,590 yields an estimate of 
how many employees would need to be trained before the indirect impact 
reaches the one percent of total revenue threshold. Comparing that 
estimate to the number of employees at each firm in 2005 reveals that 
companies would need to train anywhere from 6 to 56 times their total 
number of employees, including those who will not examine 
identification documents.\15\
    The aggregated nature of industry-wide data does not allow for a 
firm-by firm analysis of the more than 2,719 small firms involved in 
air transportation. However, analysis of firms grouped by receipts in 
2002 provides insight into the likelihood that entities will experience 
a significant indirect impact. Dividing receipts by the one percent 
threshold of $4,590 for each group estimates the number of employees 
that would result in a one percent impact on each group. The ratio of 
actual reported employees to threshold employees reveals that every 
group for which data is available would need to train multiple times 
more employees regarding REAL ID than they actually employ. The 
smallest ratio (largest impact) is for scheduled passenger air 
transportation (NAICS 48111) that earned less than $100,000, implying 
that they would need to train more than 11 times the number of people 
than they employed before the impact would reach one percent of their 
receipts.\16\ The largest ratio (smallest impact in terms of percent of 
revenues) would fall on nonscheduled chartered passenger firms (NAICS 
481211) earning more than $100 million. These firms would need to train 
more than 85 times the size of their workforce to reach the one percent 
impact threshold.
    The combination of the firm specific analysis and the analysis of 
aggregated firms within receipt categories suggests that the indirect 
impact of training agents regarding REAL ID for the official purpose of 
boarding federally regulated commercial aircraft will not constitute a 
significant economic impact on a substantial number of small entities.
---------------------------------------------------------------------------

    \15\ Data from BTS (Form 41, Schedule P10); Duns and Bradstreet; 
Yahoo! Finance, and; Hoovers.com.
    \16\ Data from U.S. Small Business Administration. U.S. All 
Industries by Receipt Size: 2002. Available online at http://www.sba.gov/advo/research/data.html. Accessed 4 Oct 2006.
---------------------------------------------------------------------------

    The above analyses show that it is unlikely that the prohibition on 
accepting State-issued DL/IDs unless they are REAL IDs will have a 
significant economic impact on a substantial number of small entities. 
Further, the only directly regulated entities are States, which by 
definition are not small entities. Therefore, the Department concludes 
that this rule will not have a significant economic impact on a 
substantial number of small entities.
International Trade Impact Assessment
    The Trade Agreement Act of 1979 prohibits Federal agencies from 
engaging in any standards or related activities that create unnecessary 
obstacles to the foreign commerce of the United States. Legitimate 
domestic objectives, such as safety, are not considered unnecessary 
obstacles. The statute also requires consideration of international 
standards and, where appropriate, that they be the basis for U.S. 
standards. There is no international standard for State-issued driver 
licenses or non-driver identification cards. DHS has determined that 
this rule will not have an impact on trade.
Unfunded Mandates Assessment
    Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) 
requires Federal agencies to prepare a written assessment of the costs, 
benefits, and other effects of proposed or final rules that include a 
Federal mandate likely to result in the expenditure by State, local, or 
tribal governments, in the aggregate, or by the private sector, of more 
than $100 million in any one year (adjusted for inflation with base 
year of 1995). Before promulgating a rule for which a written statement 
is needed, section 205 of the UMRA generally requires agencies to 
identify and consider a reasonable number of regulatory alternatives 
and adopt the least costly, most cost-effective, or least burdensome 
alternative that achieves the objective of the rule. Agencies are also 
required to seek input from the States in the preparation of such 
rules.
    The provisions of section 205 do not apply when they are 
inconsistent with applicable law. Moreover, section 205 allows DHS to 
adopt an alternative other than the least costly, most cost-effective, 
or least burdensome alternative if the agency publishes with the final 
rule an explanation why that alternative was not adopted.
    As set forth in section 202(a)(1) of the REAL ID Act, the law is 
binding on Federal agencies--not on the States.

[[Page 5329]]

Indeed, in the Conference Report, Congress specifically stated that the 
``application of the law is indirect, and hence States need not comply 
with the listed standards.'' Conf. Rep. at 177.
    Moreover, as indicated above, UMRA excludes from its scope, 
regulations which are required for national security reasons. National 
security was a primary motivator for the REAL ID Act; indeed, the Act 
itself is an effort to implement recommendations of the 9/11 
Commission, and Congress took pains to explain the connection between 
REAL ID and national security, with over a dozen references to 
``terrorists'' or ``terrorism'' in the Conference Report. See 9/11 
Commission Public Report, Chapter 12.4; Conf. Rep., 179--183.
    Notwithstanding the voluntary nature of the REAL ID Act, DHS 
assumes that States will willingly comply with the regulation to 
maintain the conveniences enjoyed by their residents when using their 
State-issued driver's licenses and non-driver identity cards for 
official purposes, particularly as it pertains to domestic air travel. 
While, for the reasons set forth above, DHS believes that the REAL ID 
Act does not constitute an unfunded mandate, DHS nevertheless believes 
that many States may find noncompliance an unattractive option.
    Based on that knowledge, DHS has taken steps to comply with the 
requirements of UMRA. Specifically, DHS has analyzed the estimated cost 
to States and considered appropriate alternatives to, and benefits 
derived from, the final regulation. Moreover, DHS has solicited input 
from State and local governments in the preparation of this final rule.

C. Executive Order 13132, Federalism

    Executive Order 13132 requires each Federal agency to develop a 
process to ensure ``meaningful and timely input by State and local 
officials in the development of regulatory policies that have 
Federalism implications.'' The phrase ``policies that have Federalism 
implications'' is defined in the Executive Order to include regulations 
that have ``substantial direct effects on the States, on the 
relationship between the national government and the States, or on the 
distribution of power and responsibilities among the various levels of 
government.''
    Executive Order 13132 lists as a ``Fundamental Federalism 
Principle'' that ``[f]ederalism is rooted in the belief that issues 
that are not national in scope or significance are most appropriately 
addressed by the level of government closest to the people.'' The issue 
covered by this final rule is, without question, national in scope and 
significance. It is also one in which the States have significant 
equities.
    While driver's licenses and identification cards are issued by 
States, they are also the most widely-used identification documents. 
Not surprisingly, they are very frequently used by individuals to 
establish their identities in the course of their interactions with the 
Federal Government (e.g., when entering secure Federal facilities or 
passing through Federally-regulated security procedures at U.S. 
airports). The fact that the use of driver's licenses as identity 
documents is an issue that is ``national in scope'' is illustrated by 
the events of September 11, 2001. A number of the terrorists who 
hijacked U.S. aircraft on that day had, through unlawful means, 
obtained genuine driver's licenses; these documents were used to 
facilitate the terrorists' operations against the United States.\17\
---------------------------------------------------------------------------

    \17\ See 9/11 Commission Report, Chapter 12.4.
---------------------------------------------------------------------------

1. DHS has Considered the Federalism Implications of the REAL ID Rule
    Section 3 of the Executive Order sets forth certain ``Federalism 
Policymaking Criteria.'' In formulating or implementing policies with 
``Federalism implications,'' agencies are required, to the extent 
permitted by law, to adhere to certain criteria. DHS has considered 
this action in light of the criteria set forth in Executive Order 13132 
Sec.  3(a)-(d) and submits the following:
(a) Constitutional Principles and Maximizing the Policymaking 
Discretion of the States
    The rule is being promulgated in strict adherence to constitutional 
principles, and the limits of DHS's constitutional and statutory 
authority have been carefully considered. Congress, through the REAL ID 
Act, has mandated that Federal agencies refuse to accept for official 
purpose, State-issued driver's licenses or identification cards unless 
DHS has determined that the issuing State is in compliance with the 
statutorily-mandated minimum standards for such identification 
documents. Notwithstanding the clear statutory mandate directing this 
rulemaking action, DHS has taken steps, in consultation with the 
States, to maximize policymaking discretion at the State level wherever 
possible. For example, States may establish an exceptions process that 
would allow each State participating in REAL ID to exercise maximum 
discretion in responding to exigencies arising in the course of 
verifying an individual's identity.
    DHS also recognizes that each State's unique situation mandates 
that the maximum possible latitude be allowed to States in fulfilling 
the statutory mandate that certain employees undergo background 
investigations. The final rule provides parameters for use by the 
States in determining which employees are ``covered employees'' and 
thus subject to the statutory background check requirements, but allows 
the individual States to determine which employees fall into categories 
deemed to be covered as defined under this final rule (e.g. DMV 
``employees or contractors who are involved in the manufacture or 
production of REAL ID driver's licenses and identification cards, or 
who have the ability to affect the identity information that appears on 
the driver's license or identification card.'').
    States are also given the discretion to find the best way to 
determine an individual driver's license or identification card 
applicant's address of principal residence, and provides greater 
latitude in accepting alternatives or making exceptions based on State 
practices.
    In other aspects of the regulation DHS has prescribed baseline 
requirements while allowing States the discretion to impose more 
stringent standards, the greatest example of which is in the area of 
protecting personally identifiable information collected for REAL ID 
purposes. Most significantly, each State retains the discretion to opt 
out of REAL ID in its entirety.
(b) Action Limiting the Policymaking Discretion of the States
    As indicated above, the final rule strives to maximize State 
policymaking discretion on two levels: First, because a State's 
participation in REAL ID is optional; and second, because of the 
policymaking discretion incorporated into the regulation for States 
that do choose to participate. DHS believes that it has incorporated 
the maximum possible State discretion consistent with the purposes of 
the statute into this action.
(c) Avoiding Intrusive Federal Oversight
    Consistent with Congress' vision for REAL ID (see Sec.  202(a)(2) 
of the Act), States that choose to participate in the program will be 
responsible for monitoring their own compliance. Under the Act and the 
final regulations, the Secretary of Homeland Security will determine 
whether a State is meeting the requirements of the Act based on 
certifications made by the State and

[[Page 5330]]

DHS has adopted a certification process similar to that used by DOT in 
its regulations governing State administration of commercial driver's 
licenses. States receiving adverse determinations will have the 
opportunity for an internal appeals process as well as judicial review.
(d) Formulation of Policies With Federalism Implications
    DHS recognizes both the important national interest in secure 
identity documents and the Federalism implications of the policies 
which underpin this rule. Accordingly, DHS has welcomed and encouraged 
State participation in this process and has sought, where possible, to 
draft this regulation in such a way as to maximize State discretion.
    Where the exigencies of national security and the need to prevent 
identity fraud have militated in favor of a uniform national standard 
(e.g., baseline security features on identity cards and background 
check requirements), DHS has, as reflected above, consulted with States 
in order to ensure that the uniform standards prescribed could be 
attained by the States and would reflect the accumulated security 
experience of State motor vehicles administrations.
2. The REAL ID Final Rule Complies With the Regulatory Provisions of 
Executive Order 13132
    Under Sec.  6 of Executive Order 13132, an agency may not issue a 
regulation that has Federalism implications, that imposes substantial 
direct compliance costs, and that is not required by statute, unless 
the Federal Government provides the funds necessary to pay the direct 
compliance costs incurred by State and local governments, or consults 
with State and local officials early in the process of developing the 
proposed regulation. Moreover, an agency may not issue a regulation 
that has Federalism implications and that preempts State law, unless 
the Agency consults with State and local officials early in the process 
of developing the regulation.
(a) The Final Rule Does Not Preempt State Law
    As detailed elsewhere in this document, the REAL ID Act is binding 
on Federal agencies, rather than on States. The rule would not formally 
compel any State to issue driver's licenses or identification cards 
that will be acceptable for Federal purposes. Importantly, under this 
scheme, ``[a]ny burden caused by a State's refusal to regulate will 
fall on those [citizens who need to acquire and utilize alternative 
documents for Federal purposes], rather than on the State as a 
sovereign.'' \18\ In other words, the citizens of a given State--not 
Congress--ultimately will decide whether the State complies with this 
regulation and the underlying statute. DHS has concluded that the rule 
is consistent with the Tenth Amendment to the U.S. Constitution and 
does not constitute an impermissible usurpation of State sovereignty. 
Rather, it is a permissible ``program of cooperative Federalism'' in 
which the Federal and State governments have acted voluntarily in 
tandem to achieve a common policy objective.\19\
---------------------------------------------------------------------------

    \18\ New York v. U.S., 505 U.S. 144, 173 (1992).
    \19\ See id. at 167.
---------------------------------------------------------------------------

(b) DHS Has Engaged in Extensive Consultations With the States
    The statutory mandate and the lack of preemption both satisfy the 
requirements of Executive Order 13132. Nevertheless, in the spirit of 
Federalism, and consistent with Sec.  205(a) of the REAL ID Act, DHS 
has engaged in extensive consultations with the States prior to issuing 
this final rule. As set forth earlier in this preamble of this rule, 
DHS held meetings and solicited input from various States and such 
stakeholders as the National Governors Association and the National 
Conference of State Legislatures.
    In particular, during the comment period, DHS hosted sessions that 
were available via webcast across the country to engage State 
Governors' chiefs of staff, homeland security directors in the States, 
and motor vehicles administrators, as well as a separate session with 
State legislators. DHS also convened the various stakeholder 
representatives that were identified as participants in the negotiated 
rulemaking group established under section 7212 of the Intelligence 
Reform and Terrorism Prevention Act. Further, DHS held a public meeting 
in Sacramento, California that was available nationwide via webcast and 
received comments from the public on a variety of topics, including 
consumer and personal impacts, privacy/security, electronic 
verification systems, funding/implementation, and law enforcement.
(c) DHS Recognizes the Burdens Inherent in Complying With the 
Regulations
    Notwithstanding both the statutory mandate and the Federal (rather 
than State) focus of the REAL ID Act, DHS recognizes that, as a 
practical matter, States may view noncompliance with the requirements 
of REAL ID as an unattractive alternative. DHS also recognizes that 
compliance with the rule carries with it significant costs and 
logistical burdens, for which Federal funds are generally not 
available. The costs (to the States, the public and the Federal 
Government) of implementing this rule are by no means inconsiderable 
and have been detailed in the regulatory evaluation accompanying this 
rule.
    As indicated above, Executive Order 13132 prohibits any agency from 
implementing a regulation with Federalism implications which imposes 
substantial direct compliance costs on State and local governments 
unless the regulation is required by statute, the Federal Government 
will provide funds to pay for the direct costs, or the agency has 
consulted with State and local officials. In such a case, the agency 
must also incorporate a Federalism statement into the preamble of the 
regulation and make available to the Office of Management and Budget 
any written communications from State and local officials. See 
Executive Order 13132, section 6(b).
    This rule is required by the REAL ID Act. DHS has (as detailed 
above) consulted extensively with State and local officials in the 
course of preparing this regulation. Finally, DHS has incorporated this 
Federalism Statement into the preamble to assess the Federalism impact 
of its REAL ID regulation.
3. REAL ID and Federalism
    The issuance of driver's licenses has traditionally been the 
province of State governments; DHS believes that, to the extent 
practicable, it should continue as such. However, given the threat to 
both national security and the economy presented by identity fraud, DHS 
believes that certain uniform standards should be adopted for the most 
basic identity document in use in this country. DHS has, in this final 
rule, attempted to balance State prerogatives with the national 
interests at stake.

D. Environmental Impact Analysis

    At the time of the proposed rule, DHS sought and received comment 
on the potential environmental impact of the physical standards and 
other proposed requirements under this rule. DHS carefully considered 
those comments in its evaluation of the potential environmental impacts 
of the rule. DHS concludes that the rule's potential impacts are 
minimal and this rule is a part of a category of actions that do not 
individually or cumulatively have a significant impact on the human 
environment and do not require a more

[[Page 5331]]

extensive evaluation under the requirements of the National 
Environmental Policy Act of 1969 (NEPA), 42 U.S.C. 4321 et seq. and 
Council on Environmental Quality (CEQ) regulations, 40 CFR parts 1501-
1508. DHS Categorical Exclusion A3 (Table 1 Management Directive 
5100.1). Categorical Exclusion A3 applies to the promulgation of this 
rule, since it is of an administrative and procedural nature that does 
not force an immediate action but only lays the foundation for 
subsequent action. The categorical exclusion applies only to the 
promulgation of the REAL ID rule. Environmental impacts that may be 
associated with any follow-on DHS activity, such as approval of grant 
funding, must be reviewed if and when the subsequent program actions 
create the potential for environmental impact.

E. Energy Impact Analysis

    The energy impact of this rule has been assessed in accordance with 
the Energy Policy and Conservation Act (EPCA), Public Law 94-163, as 
amended (42 U.S.C. 6362). We have determined that this rulemaking is 
not a major regulatory action under the provisions of the EPCA.

F. Executive Order 13175 (Tribal Consultation)

    DHS has analyzed this final rule under Executive Order 13175 
(entitled ``Consultation and Coordination with Indian Tribal 
Governments'', issued November 6, 2000). Executive Order 13175 states 
that no agency shall promulgate regulations that have tribal 
implications, that impose substantial direct compliance costs on Indian 
tribal governments, or that are not required by statute unless the 
agency first consults with tribal officials and prepares a tribal 
summary impact statement.
    DHS has determined that this final rule will not have a substantial 
direct effect on one or more Indian tribes and will not impose 
substantial direct compliance costs on Indian tribal governments. This 
rule also does not seek to preempt any tribal laws. This final rule 
does not satisfy the tribal implications requirement in that it is a 
rule of general applicability that establishes minimum standards for 
State-issued driver's licenses and identification cards that Federal 
agencies will accept for official purposes on or after May 11, 2008, a 
statutory mandate under the REAL ID Act of 2005. Therefore, tribal 
consultation and a tribal summary impact statement are not required.

List of Subjects in 6 CFR Part 37

    Document security, driver's licenses, identification cards, 
incorporation by reference, motor vehicle administrations, physical 
security.

The Amendments

0
For the reasons set forth above, the Department of Homeland Security 
amends 6 CFR Chapter I by adding a new Part 37 as follows:



TITLE 6--HOMELAND SECURITY

CHAPTER I--DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY

PART 37--REAL ID DRIVER'S LICENSES AND IDENTIFICATION CARDS

Subpart A--General

Sec.
37.1 Applicability.
37.3 Definitions.
37.5 Validity periods and deadlines for REAL ID driver's licenses 
and identification cards.
Subpart B--Minimum Documentation, Verification, and Card Issuance 
Requirements
37.11 Application and documents the applicant must provide.
37.13 Document verification requirements.
37.15 Physical security features for the driver's license or 
identification card.
37.17 Requirements for the surface of the driver's license or 
identification card.
37.19 Machine readable technology on the driver's license or 
identification card.
37.21 Temporary or limited-term driver's licenses and identification 
cards.
37.23 Reissued REAL ID driver's licenses and identification cards.
37.25 Renewal of REAL ID driver's licenses and identification cards.
37.27 Driver's licenses and identification cards issued during the 
age-based enrollment period.
37.29 Prohibition against holding more than one REAL ID card or more 
than one driver's license.
Subpart C--Other Requirements
37.31 Source document retention.
37.33 DMV databases.
Subpart D--Security at DMVs and Driver's License and Identification 
Card Production Facilities
37.41 Security plan.
37.43 Physical security of DMV production facilities.
37.45 Background checks for covered employees.
Subpart E--Procedures for Determining State Compliance
37.51 Compliance--general requirements.
37.55 State certification documentation.
37.59 DHS reviews of State compliance.
37.61 Results of compliance determination.
37.63 Extension of deadline.
37.65 Effect of failure to comply with this Part.
Subpart F--Driver's Licenses and Identification Cards Issued Under 
Section 202(d)(11) of the REAL ID Act
37.71 Driver's licenses and identification cards issued under 
section 202(d)(11) of the REAL ID Act.

    Authority: 49 U.S.C. 30301 note; 6 U.S.C. 111, 112.

PART 37--REAL ID DRIVER'S LICENSES AND IDENTIFICATION CARDS

Subpart A--General


Sec.  37.1  Applicability.

    (a) Subparts A through E of this part apply to States and U.S. 
territories that choose to issue driver's licenses and identification 
cards that can be accepted by Federal agencies for official purposes.
    (b) Subpart F establishes certain standards for State-issued 
driver's licenses and identification cards issued by States that 
participate in REAL ID, but that are not intended to be accepted by 
Federal agencies for official purpose under section 202(d)(11) of the 
REAL ID Act.


Sec.  37.3  Definitions.

    For purposes of this part:
    Birth certificate means the record related to a birth that is 
permanently stored either electronically or physically at the State 
Office of Vital Statistics or equivalent agency in a registrant's State 
of birth.
    Card means either a driver's license or identification card issued 
by the State Department of Motor Vehicles (DMV) or equivalent State 
office.
    Certification means an assertion by the State to the Department of 
Homeland Security that the State has met the requirements of this Part.
    Certified copy of a birth certificate means a copy of the whole or 
part of a birth certificate registered with the State that the State 
considers to be the same as the original birth certificate on file with 
the State Office of Vital Statistics or equivalent agency in a 
registrant's State of birth.
    Covered employees means Department of Motor Vehicles employees or 
contractors who are involved in the manufacture or production of REAL 
ID driver's licenses and identification cards, or who have the ability 
to affect the identity information that appears on the driver's license 
or identification card.

[[Page 5332]]

    Data verification means checking the validity of data contained in 
source documents presented under this regulation.
    DHS means the U.S. Department of Homeland Security.
    DMV means the Department of Motor Vehicles or any State Government 
entity that issues driver's licenses and identification cards, or an 
office with equivalent function for issuing driver's licenses and 
identification cards.
    Determination means a decision by the Department of Homeland 
Security that a State has or has not met the requirements of this Part 
and that Federal agencies may or may not accept the driver's licenses 
and identification cards issued by the State for official purposes.
    Digital photograph means a digital image of the face of the holder 
of the driver's license or identification card.
    Document authentication means determining that the source document 
presented under these regulations is genuine and has not been altered.
    Domestic violence and dating violence have the meanings given the 
terms in section 3, Universal definitions and grant provisions, of the 
Violence Against Women and Department of Justice Reauthorization Act of 
2005 (Pub. L. 109-162, 119 Stat. 2960, 2964, Jan. 5, 2006); codified at 
section 40002, Definitions and grant provisions, 42 U.S.C. 13925, or 
State laws addressing domestic and dating violence.
    Driver's license means a motor vehicle operator's license, as 
defined in 49 U.S.C. 30301.
    Duplicate means a driver's license or identification card issued 
subsequent to the original document that bears the same information and 
expiration date as the original document and that is reissued at the 
request of the holder when the original is lost, stolen, or damaged and 
there has been no material change in information since prior issuance.
    Federal agency means all executive agencies including Executive 
departments, a Government corporation, and an independent establishment 
as defined in 5 U.S.C. 105.
    Federally-regulated commercial aircraft means a commercial aircraft 
regulated by the Transportation Security Administration (TSA).
    Full compliance means that the Secretary or his designate(s) has 
determined that a State has met all the requirements of Subparts A 
through E.
    Full legal name means an individual's first name, middle name(s), 
and last name or surname, without use of initials or nicknames.
    IAFIS means the Integrated Automated Fingerprint Identification 
System, a national fingerprint and criminal history system maintained 
by the Federal Bureau of Investigation (FBI) that provides automated 
fingerprint search capabilities.
    Identification card means a document made or issued by or under the 
authority of a State Department of Motor Vehicles or State office with 
equivalent function which, when completed with information concerning a 
particular individual, is of a type intended or commonly accepted for 
the purpose of identification of individuals.
    INS means the former-Immigration and Naturalization Service of the 
U.S. Department of Justice.
    Lawful status: A person in lawful status is a citizen or national 
of the United States; or an alien: lawfully admitted for permanent or 
temporary residence in the United States; with conditional permanent 
resident status in the United States; who has an approved application 
for asylum in the United States or has entered into the United States 
in refugee status; who has a valid nonimmigrant status in the United 
States; who has a pending application for asylum in the United States; 
who has a pending or approved application for temporary protected 
status (TPS) in the United States; who has approved deferred action 
status; or who has a pending application for lawful permanent residence 
(LPR) or conditional permanent resident status. This definition does 
not affect other definitions or requirements that may be contained in 
the Immigration and Nationality Act or other laws.
    Material change means any change to the personally identifiable 
information of an individual as defined under this part. 
Notwithstanding the definition of personally identifiable information 
below, a change of address of principal residence does not constitute a 
material change.
    Material compliance means a determination by DHS that a State has 
met the benchmarks contained in the Material Compliance Checklist.
    NCIC means the National Crime Information Center, a computerized 
index of criminal justice information maintained by the Federal Bureau 
of Investigation (FBI) that is available to Federal, State, and local 
law enforcement and other criminal justice agencies.
    Official purpose means accessing Federal facilities, boarding 
Federally-regulated commercial aircraft, and entering nuclear power 
plants.
    Passport means a passport booklet or card issued by the U.S. 
Department of State that can be used as a travel document to gain entry 
into the United States and that denotes identity and citizenship as 
determined by the U.S. Department of State.
    Personally identifiable information means any information which can 
be used to distinguish or trace an individual's identity, such as their 
name; driver's license or identification card number; social security 
number; biometric record, including a digital photograph or signature; 
alone, or when combined with other personal or identifying information, 
which is linked or linkable to a specific individual, such as a date 
and place of birth or address, whether it is stored in a database, on a 
driver's license or identification card, or in the machine readable 
technology on a license or identification card.
    Principal residence means the location where a person currently 
resides (i.e., presently resides even if at a temporary address) in 
conformance with the residency requirements of the State issuing the 
driver's license or identification card, if such requirements exist.
    REAL ID Driver's License or Identification Card means a driver's 
license or identification card that has been issued by a State that has 
been certified by DHS to be in compliance with the requirements of the 
REAL ID Act and which meets the standards of subparts A through D of 
this part, including temporary or limited-term driver's licenses or 
identification cards issued under Sec.  37.21.
    Reissued card means a card that a State DMV issues to replace a 
card that has been lost, stolen or damaged, or to replace a card that 
includes outdated information. A card may not be reissued remotely when 
there is a material change to the personally identifiable information 
as defined by the Rule.
    Renewed card means a driver's license or identification card that a 
State DMV issues to replace a renewable driver's license or 
identification card.
    SAVE means the DHS Systematic Alien Verification for Entitlements 
system, or such successor or alternate verification system at the 
Secretary's discretion.
    Secretary means the Secretary of Homeland Security.
    Sexual assault and stalking have the meanings given the terms in 
section 3, universal definitions and grant provisions, of the Violence 
Against Women and Department of Justice Reauthorization Act of 2005 
(Pub. L. 109-162, 119 Stat. 2960, 2964, Jan. 5, 2006); codified at 
section 40002, Definitions and grant provisions, 42

[[Page 5333]]

U.S.C. 13925, or State laws addressing sexual assault and stalking.
    Source document(s) means original or certified copies (where 
applicable) of documents presented by an applicant as required under 
these regulations to the Department of Motor Vehicles to apply for a 
driver's license or identification card.
    State means a State of the United States, the District of Columbia, 
Puerto Rico, the Virgin Islands, Guam, American Samoa, and the 
Commonwealth of the Northern Mariana Islands.
    State address confidentiality program means any State-authorized or 
State-administered program that--
    (1) Allows victims of domestic violence, dating violence, sexual 
assault, stalking, or a severe form of trafficking to keep, obtain, and 
use alternative addresses; or
    (2) Provides confidential record-keeping regarding the addresses of 
such victims or other categories of persons.
    Temporary lawful status: A person in temporary lawful status is a 
person who: has a valid nonimmigrant status in the United States; has a 
pending application for asylum in the United States; has a pending or 
approved application for temporary protected status (TPS) in the United 
States; has approved deferred action status; or has a pending 
application for LPR or conditional permanent resident status.
    Verify means procedures to ensure that:
    (1) The source document is genuine and has not been altered (i.e., 
``document authentication''); and
    (2) The identity data contained on the document is valid (``data 
verification'').


Sec.  37.5  Validity periods and deadlines for REAL ID driver's 
licenses and identification cards.

    (a) Driver's licenses and identification cards issued under this 
part, that are not temporary or limited-term driver's licenses and 
identification cards, are valid for a period not to exceed eight years. 
A card may be valid for a shorter period based on other State or 
Federal requirements.
    (b) On or after December 1, 2014, Federal agencies shall not accept 
a driver's license or identification card for official purposes from 
individuals born after December 1, 1964, unless such license or card is 
a REAL ID-compliant driver's license or identification card issued by a 
State that has been determined by DHS to be in full compliance as 
defined under this subpart.
    (c) On or after December 1, 2017, Federal agencies shall not accept 
a driver's license or identification card for official purposes from 
any individual unless such license or card is a REAL ID-compliant 
driver's license or identification card issued by a State that has been 
determined by DHS to be in full compliance as defined under this 
subpart.
    (d) Federal agencies cannot accept for official purpose driver's 
licenses and identification cards issued under Sec.  37.71 of this 
rule.

Subpart B--Minimum Documentation, Verification, and Card Issuance 
Requirements


Sec.  37.11  Application and documents the applicant must provide.

    (a) The State must subject each person applying for a REAL ID 
driver's license or identification card to a mandatory facial image 
capture, and shall maintain photographs of individuals even if no card 
is issued. The photographs must be stored in a format in accordance 
with Sec.  37.31 as follows:
    (1) If no card is issued, for a minimum period of five years.
    (2) If a card is issued, for a period of at least two years beyond 
the expiration date of the card.
    (b) Declaration. Each applicant must sign a declaration under 
penalty of perjury that the information presented on the application is 
true and correct, and the State must retain this declaration. An 
applicant must sign a new declaration when presenting new source 
documents to the DMV on subsequent visits.
    (c) Identity. (1) To establish identity, the applicant must present 
at least one of the following source documents:
    (i) Valid, unexpired U.S. passport.
    (ii) Certified copy of a birth certificate filed with a State 
Office of Vital Statistics or equivalent agency in the individual's 
State of birth.
    (iii) Consular Report of Birth Abroad (CRBA) issued by the U.S. 
Department of State, Form FS-240, DS-1350 or FS-545.
    (iv) Valid, unexpired Permanent Resident Card (Form I-551) issued 
by DHS or INS.
    (v) Unexpired employment authorization document (EAD) issued by 
DHS, Form I-766 or Form I-688B.
    (vi) Unexpired foreign passport with a valid, unexpired U.S. visa 
affixed accompanied by the approved I-94 form documenting the 
applicant's most recent admittance into the United States.
    (vii) Certificate of Naturalization issued by DHS, Form N-550 or 
Form N-570.
    (viii) Certificate of Citizenship, Form N-560 or Form N-561, issued 
by DHS.
    (ix) REAL ID driver's license or identification card issued in 
compliance with the standards established by this part.
    (x) Such other documents as DHS may designate by notice published 
in the Federal Register.
    (2) Where a State permits an applicant to establish a name other 
than the name that appears on a source document (for example, through 
marriage, adoption, court order, or other mechanism permitted by State 
law or regulation), the State shall require evidence of the name change 
through the presentation of documents issued by a court, governmental 
body or other entity as determined by the State. The State shall 
maintain copies of the documentation presented pursuant to Sec.  37.31, 
and maintain a record of both the recorded name and the name on the 
source documents in a manner to be determined by the State and in 
conformity with Sec.  37.31.
    (d) Date of birth. To establish date of birth, an individual must 
present at least one document included in paragraph (c) of this 
section.
    (e) Social security number (SSN). (1) Except as provided in 
paragraph (e)(3) of this section, individuals presenting the identity 
documents listed in Sec.  37.11(c)(1) and (2) must present his or her 
Social Security Administration account number card; or, if a Social 
Security Administration account card is not available, the person may 
present any of the following documents bearing the applicant's SSN:
    (i) A W-2 form,
    (ii) A SSA-1099 form,
    (iii) A non-SSA-1099 form, or
    (iv) A pay stub with the applicant's name and SSN on it.
    (2) The State DMV must verify the SSN pursuant to Sec.  37.13(b)(2) 
of this subpart.
    (3) Individuals presenting the identity document listed in Sec.  
37.11(c)(1)(vi) must present an SSN or demonstrate non-work authorized 
status.
    (f) Documents demonstrating address of principal residence. To 
document the address of principal residence, a person must present at 
least two documents of the State's choice that include the individual's 
name and principal residence. A street address is required except as 
provided in Sec.  37.17(f) of this part.
    (g) Evidence of lawful status in the United States. A DMV may issue 
a REAL ID driver's license or identification card only to a person who 
has presented satisfactory evidence of lawful status.
    (1) If the applicant presents one of the documents listed under 
paragraphs

[[Page 5334]]

(c)(1)(i), (c)(1)(ii), (c)(1)(iii), (c)(1)(iv), (c)(1)(vii) or 
(c)(1)(viii) of this section, the issuing State's verification of the 
applicant's identity in the manner prescribed in Sec.  37.13 will also 
provide satisfactory evidence of lawful status.
    (2) If the applicant presents one of the identity documents listed 
under paragraphs (c)(1)(v) or (c)(1)(vi), or (c)(1)(ix) of this 
section, the issuing State's verification of the identity document(s) 
does not provide satisfactory evidence of lawful status. The applicant 
must also present a second document from Sec.  37.11(g)(1) or 
documentation issued by DHS or other Federal agencies demonstrating 
lawful status as determined by USCIS. All documents shall be verified 
in the manner prescribed in Sec.  37.13.
    (h) Exceptions Process. A State DMV may choose to establish a 
written, defined exceptions process for persons who, for reasons beyond 
their control, are unable to present all necessary documents and must 
rely on alternate documents to establish identity or date of birth. 
Alternative documents to demonstrate lawful status will only be allowed 
to demonstrate U.S. citizenship.
    (1) Each State establishing an exceptions process must make 
reasonable efforts to establish the authenticity of alternate documents 
each time they are presented and indicate that an exceptions process 
was used in the applicant's record.
    (2) The State shall retain copies or images of the alternate 
documents accepted pursuant to Sec.  37.31 of this part.
    (3) The State shall conduct a review of the use of the exceptions 
process, and pursuant to subpart E of this part, prepare and submit a 
report with a copy of the exceptions process as part of the 
certification documentation detailed in Sec.  37.55.
    (i) States are not required to comply with these requirements when 
issuing REAL ID driver's licenses or identification cards in support of 
Federal, State, or local criminal justice agencies or other programs 
that require special licensing or identification to safeguard persons 
or in support of their other official duties. As directed by 
appropriate officials of these Federal, State, or local agencies, 
States should take sufficient steps to safeguard the identities of such 
persons. Driver's licenses and identification cards issued in support 
of Federal, State, or local criminal justice agencies or programs that 
require special licensing or identification to safeguard persons or in 
support of their other official duties shall not be distinguishable 
from other REAL ID licenses or identification cards issued by the 
State.


Sec.  37.13  Document verification requirements.

    (a) States shall make reasonable efforts to ensure that the 
applicant does not have more than one driver's license or 
identification card already issued by that State under a different 
identity. In States where an individual is permitted to hold both a 
driver's license and identification card, the State shall ensure that 
the individual has not been issued identification documents in multiple 
or different names. States shall also comply with the provisions of 
Sec.  37.29 before issuing a driver's license or identification card.
    (b) States must verify the documents and information required under 
Sec.  37.11 with the issuer of the document. States shall use systems 
for electronic validation of document and identity data as they become 
available or use alternative methods approved by DHS.
    (1) States shall verify any document described in Sec.  37.11(c) or 
(g) and issued by DHS (including, but not limited to, the I-94 form 
described in Sec.  37.11(c)(vi)) through the Systematic Alien 
Verification for Entitlements (SAVE) system or alternate methods 
approved by DHS, except that if two DHS-issued documents are presented, 
a SAVE verification of one document that confirms lawful status does 
not need to be repeated for the second document. In the event of a non-
match, the DMV must not issue a REAL ID driver's license or 
identification card to an applicant, and must refer the individual to 
U.S. Citizenship and Immigration Services for resolution.
    (2) States must verify SSNs with the Social Security Administration 
(SSA) or through another method approved by DHS. In the event of a non-
match with SSA, a State may use existing procedures to resolve non-
matches. If the State is unable to resolve the non-match, and the use 
of an exceptions process is not warranted in the situation, the DMV 
must not issue a REAL ID driver's license or identification card to an 
applicant until the information verifies with SSA.
    (3) States must verify birth certificates presented by applicants. 
States should use the Electronic Verification of Vital Events (EVVE) 
system or other electronic systems whenever the records are available. 
If the document does not appear authentic upon inspection or the data 
does not match and the use of an exceptions process is not warranted in 
the situation, the State must not issue a REAL ID driver's license or 
identification card to the applicant until the information verifies, 
and should refer the individual to the issuing office for resolution.
    (4) States shall verify documents issued by the Department of State 
with the Department of State or through methods approved by DHS.
    (5) States must verify REAL ID driver's licenses and identification 
cards with the State of issuance.
    (6) Nothing in this section precludes a State from issuing an 
interim license or a license issued under Sec.  37.71 that will not be 
accepted for official purposes to allow the individual to resolve any 
non-match.


Sec.  37.15  Physical security features for the driver's license or 
identification card.

    (a) General. States must include document security features on REAL 
ID driver's licenses and identification cards designed to deter forgery 
and counterfeiting, promote an adequate level of confidence in the 
authenticity of cards, and facilitate detection of fraudulent cards in 
accordance with this section.
    (1) These features must not be capable of being reproduced using 
technologies that are commonly used and made available to the general 
public.
    (2) The proposed card solution must contain a well-designed, 
balanced set of features that are effectively combined and provide 
multiple layers of security. States must describe these document 
security features in their security plans pursuant to Sec.  37.41.
    (b) Integrated security features. REAL ID driver's licenses and 
identification cards must contain at least three levels of integrated 
security features that provide the maximum resistance to persons' 
efforts to--
    (1) Counterfeit, alter, simulate, or reproduce a genuine document;
    (2) Alter, delete, modify, mask, or tamper with data concerning the 
original or lawful card holder;
    (3) Substitute or alter the original or lawful card holder's 
photograph and/or signature by any means; and
    (4) Create a fraudulent document using components from legitimate 
driver's licenses or identification cards.
    (c) Security features to detect false cards. States must employ 
security features to detect false cards for each of the following three 
levels:
    (1) Level 1. Cursory examination, without tools or aids involving 
easily identifiable visual or tactile features, for rapid inspection at 
point of usage.
    (2) Level 2. Examination by trained inspectors with simple 
equipment.
    (3) Level 3. Inspection by forensic specialists.
    (d) Document security and integrity. States must conduct a review 
of their card design and submit a report to DHS with their 
certification that indicates the

[[Page 5335]]

ability of the design to resist compromise and document fraud attempts. 
The report required by this paragraph is SSI and must be handled and 
protected in accordance with 49 CFR part 1520. Reports must be updated 
and submitted to DHS whenever a security feature is modified, added, or 
deleted. After reviewing the report, DHS may require a State to provide 
DHS with examination results from a recognized independent laboratory 
experienced with adversarial analysis of identification documents 
concerning one or more areas relating to the card's security.


Sec.  37.17  Requirements for the surface of the driver's license or 
identification card.

    To be accepted by a Federal agency for official purposes, REAL ID 
driver's licenses and identification cards must include on the front of 
the card (unless otherwise specified below) the following information:
    (a) Full legal name. Except as permitted in Sec.  37.11(c)(2), the 
name on the face of the license or card must be the same as the name on 
the source document presented by the applicant to establish identity. 
Where the individual has only one name, that name should be entered in 
the last name or family name field, and the first and middle name 
fields should be left blank. Place holders such as NFN, NMN, and NA 
should not be used.
    (b) Date of birth.
    (c) Gender, as determined by the State.
    (d) Unique Driver's license or identification card number. This 
cannot be the individual's SSN, and must be unique across driver's 
license or identification cards within the State.
    (e) Full facial digital photograph. A full facial photograph must 
be taken pursuant to the standards set forth below:
    (1) States shall follow specifically ISO/IEC 19794-5:2005(E) 
Information technology--Biometric Data Interchange Formats--Part 5: 
Face Image Data. The Director of the Federal Register approves this 
incorporation by reference in accordance with 5 U.S.C. 552(a) and 1 CFR 
part 51. You may obtain a copy of these incorporated standards from 
http://www.ansi.org, or by contacting ANSI at ANSI, 25 West 43rd 
Street, 4th Floor, New York, New York 10036. You may inspect a copy of 
the incorporated standard at the Department of Homeland Security, 1621 
Kent Street, 9th Floor, Rosslyn, VA (please call 703-235-0709 to make 
an appointment) or at the National Archives and Records Administration 
(NARA). For information on the availability of material at NARA, call 
202-741-6030, or go to www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html.
    These standards include:
    (i) Lighting shall be equally distributed on the face.
    (ii) The face from crown to the base of the chin, and from ear-to-
ear, shall be clearly visible and free of shadows.
    (iii) Veils, scarves or headdresses must not obscure any facial 
features and not generate shadow. The person may not wear eyewear that 
obstructs the iris or pupil of the eyes and must not take any action to 
obstruct a photograph of their facial features.
    (iv) Where possible, there must be no dark shadows in the eye-
sockets due to the brow. The iris and pupil of the eyes shall be 
clearly visible.
    (v) Care shall be taken to avoid ``hot spots'' (bright areas of 
light shining on the face).
    (2) Photographs may be in black and white or color.
    (f) Address of principal residence, except an alternative address 
may be displayed for:
    (1) Individuals for whom a State law, regulation, or DMV procedure 
permits display of an alternative address, or
    (2) Individuals who satisfy any of the following:
    (i) If the individual is enrolled in a State address 
confidentiality program which allows victims of domestic violence, 
dating violence, sexual assault, stalking, or a severe form of 
trafficking, to keep, obtain, and use alternative addresses; and 
provides that the addresses of such persons must be kept confidential, 
or other similar program;
    (ii) If the individual's address is entitled to be suppressed under 
State or Federal law or suppressed by a court order including an 
administrative order issued by a State or Federal court; or
    (iii) If the individual is protected from disclosure of information 
pursuant to section 384 of the Illegal Immigration Reform and Immigrant 
Responsibility Act of 1996.
    (3) In areas where a number and street name has not been assigned 
for U.S. mail delivery, an address convention used by the U.S. Postal 
Service is acceptable.
    (g) Signature. (1) The card must include the signature of the card 
holder. The signature must meet the requirements of the March 2005 
American Association of Motor Vehicle Administrators (AAMVA) standards 
for the 2005 AAMVA Driver's License/Identification Card Design 
Specifications, Annex A, section A.7.7.2. This standard includes 
requirements for size, scaling, cropping, color, borders, and 
resolution. The Director of the Federal Register approves this 
incorporation by reference in accordance with 5 U.S.C. 552(a) and 1 CFR 
part 51. You may obtain a copy of these standards from AAMVA on-line at 
http://www.aamva.org, or by contacting AAMVA at 4301 Wilson Boulevard, 
Suite 400, Arlington, VA 22203. You may inspect a copy of these 
incorporated standards at the Department of Homeland Security, 1621 
Kent Street, 9th Floor, Rosslyn, VA (please call 703-235-0709 to make 
an appointment) or at the National Archives and Records Administration 
(NARA). For information on the availability of material at NARA, call 
202-741-6030, or go to http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html.
    (2) The State shall establish alternative procedures for 
individuals unable to sign their name.
    (h) Physical security features, pursuant to Sec.  37.15 of this 
subpart.
    (i) Machine-readable technology on the back of the card, pursuant 
to Sec.  37.19 of this subpart.
    (j) Date of transaction.
    (k) Expiration date.
    (l) State or territory of issuance.
    (m) Printed information. The name, date of birth, gender, card 
number, issue date, expiration date, and address on the face of the 
card must be in Latin alpha-numeric characters. The name must contain a 
field of no less than a total of 39 characters, and longer names shall 
be truncated following the standard established by International Civil 
Aviation Organization (ICAO) 9303, ``Machine Readable Travel 
Documents,'' Volume 1, Part 1, Sixth Edition, 2006. The Director of the 
Federal Register approves this incorporation by reference in accordance 
with 5 U.S.C. 552(a) and 1 CFR part 51. You may obtain a copy of ICAO 
9303 from the ICAO, Document Sales Unit, 999 University Street, 
Montreal, Quebec, Canada H3C 5H7, e-mail: [email protected]. You may 
inspect a copy of the incorporated standard at the Department of 
Homeland Security, 1621 Kent Street, 9th Floor, Rosslyn, VA (please 
call 703-235-0709 to make an appointment) or at the National Archives 
and Records Administration (NARA). For information on the availability 
of material at NARA, call 202-741-6030, or go to http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html.
    (n) The card shall bear a DHS-approved security marking on each

[[Page 5336]]

driver's license or identification card that is issued reflecting the 
card's level of compliance as set forth in Sec.  37.51 of this Rule.


Sec.  37.19  Machine readable technology on the driver's license or 
identification card.

    For the machine readable portion of the REAL ID driver's license or 
identification card, States must use the ISO/IEC 15438:2006(E) 
Information Technology--Automatic identification and data capture 
techniques--PDF417 symbology specification. The Director of the Federal 
Register approves this incorporation by reference in accordance with 5 
U.S.C. 552(a) and 1 CFR part 51. You may obtain a copy of these 
incorporated standards at http://www.ansi.org, or by contacting ANSI at 
ANSI, 25 West 43rd Street, 4th Floor, New York, New York 10036. You may 
inspect a copy of the incorporated standard at the Department of 
Homeland Security, 1621 Kent Street, 9th Floor, Rosslyn, VA (please 
call 703-235-0709 to make an appointment) or at the National Archives 
and Records Administration (NARA). For information on the availability 
of material at NARA, call 202-741-6030, or go to http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html. The PDF417 bar code standard must have the following 
defined minimum data elements:
    (a) Expiration date.
    (b) Full legal name, unless the State permits an applicant to 
establish a name other than the name that appears on a source document, 
pursuant to Sec.  37.11(c)(2).
    (c) Date of transaction.
    (d) Date of birth.
    (e) Gender.
    (f) Address as listed on the card pursuant to Sec.  37.17(f).
    (g) Unique driver's license or identification card number.
    (h) Card design revision date, indicating the most recent change or 
modification to the visible format of the driver's license or 
identification card.
    (i) Inventory control number of the physical document.
    (j) State or territory of issuance.


Sec.  37.21  Temporary or limited-term driver's licenses and 
identification cards.

    States may only issue a temporary or limited-term REAL ID driver's 
license or identification card to an individual who has temporary 
lawful status in the United States.
    (a) States must require, before issuing a temporary or limited-term 
driver's license or identification card to a person, valid documentary 
evidence, verifiable through SAVE or other DHS-approved means, that the 
person has lawful status in the United States.
    (b) States shall not issue a temporary or limited-term driver's 
license or identification card pursuant to this section:
    (1) For a time period longer than the expiration of the applicant's 
authorized stay in the United States, or, if there is no expiration 
date, for a period longer than one year; and
    (2) For longer than the State's maximum driver's license or 
identification card term.
    (c) States shall renew a temporary or limited-term driver's license 
or identification card pursuant to this section and Sec.  37.25(b)(2), 
only if:
    (1) the individual presents valid documentary evidence that the 
status by which the applicant qualified for the temporary or limited-
term driver's license or identification card is still in effect, or
    (2) the individual presents valid documentary evidence that he or 
she continues to qualify for lawful status under paragraph (a) of this 
section.
    (d) States must verify the information presented to establish 
lawful status through SAVE, or another method approved by DHS.
    (e) Temporary or limited-term driver's licenses and identification 
cards must clearly indicate on the face of the license and in the 
machine readable zone that the license or card is a temporary or 
limited-term driver's license or identification card.


Sec.  37.23  Reissued REAL ID driver's licenses and identification 
cards.

    (a) State procedure. States must establish an effective procedure 
to confirm or verify an applicant's identity each time a REAL ID 
driver's license or identification card is reissued, to ensure that the 
individual receiving the reissued REAL ID driver's license or 
identification card is the same individual to whom the driver's license 
or identification card was originally issued.
    (b) Remote/Non-in-person reissuance. Except as provided in 
paragraph (c) of this section a State may conduct a non-in-person 
(remote) reissuance if State procedures permit the reissuance to be 
conducted remotely. Except for the reissuance of duplicate driver's 
licenses and identification cards as defined in this rule, the State 
must reverify pursuant to Sec.  37.13, the applicant's SSN and lawful 
status prior to reissuing the driver's license or identification card.
    (c) In-person reissuance. The State may not remotely reissue a 
driver's license or identification card where there has been a material 
change in any personally identifiable information since prior issuance. 
All material changes must be established through an applicant's 
presentation of an original source document as provided in this 
subpart, and must be verified as specified in Sec.  37.13.


Sec.  37.25  Renewal of REAL ID driver's licenses and identification 
cards.

    (a) In-person renewals. States must require holders of REAL ID 
driver's licenses and identification cards to renew their driver's 
licenses and identification cards with the State DMV in person, no less 
frequently than every sixteen years.
    (1) The State DMV shall take an updated photograph of the 
applicant, no less frequently than every sixteen years.
    (2) The State must reverify the renewal applicant's SSN and lawful 
status through SSOLV and SAVE, respectively (or other DHS-approved 
means) as applicable prior to renewing the driver's license or 
identification card. The State must also verify electronically 
information that it was not able to verify at a previous issuance or 
renewal if the systems or processes exist to do so.
    (3) Holders of temporary or limited-term REAL ID driver's licenses 
and identification cards must present evidence of continued lawful 
status via SAVE or other method approved by DHS when renewing their 
driver's license or identification card.
    (b) Remote/Non-in-person renewal. Except as provided in (b)(2) a 
State may conduct a non-in-person (remote) renewal if State procedures 
permit the renewal to be conducted remotely.
    (1) The State must reverify the applicant's SSN and lawful status 
pursuant to Sec.  37.13 prior to renewing the driver's license or 
identification card.
    (2) The State may not remotely renew a REAL ID driver's license or 
identification card where there has been a material change in any 
personally identifiable information since prior issuance. All material 
changes must be established through the applicant's presentation of an 
original source document as provided in Subpart B, and must be verified 
as specified in Sec.  37.13.


Sec.  37.27  Driver's licenses and identification cards issued during 
the age-based enrollment period.

    Driver's licenses and identification cards issued to individuals 
prior to a DHS determination that the State is materially compliant may 
be renewed or reissued pursuant to current State practices, and will be 
accepted for

[[Page 5337]]

official purposes until the validity dates described in Sec.  37.5. 
Effective December 1, 2014, Federal agencies will only accept REAL ID 
cards for official purpose from individuals under 50 as of December 1, 
2014. Individuals age 50 or older on December 1, 2014, must obtain and 
present REAL ID cards for official purposes by December 1, 2017.


Sec.  37.29  Prohibition against holding more than one REAL ID card or 
more than one driver's license.

    (a) An individual may hold only one REAL ID card. An individual 
cannot hold a REAL ID driver's license and a REAL ID identification 
card simultaneously. Nothing shall preclude an individual from holding 
a REAL ID card and a non-REAL ID card unless prohibited by his or her 
State.
    (b) Prior to issuing a REAL ID driver's license,
    (1) A State must check with all other States to determine if the 
applicant currently holds a driver's license or REAL ID identification 
card in another State.
    (2) If the State receives confirmation that the individual holds a 
driver's license in another State, or possesses a REAL ID 
identification card in another State, the receiving State must take 
measures to confirm that the person has terminated or is terminating 
the driver's license or REAL ID identification card issued by the prior 
State pursuant to State law, regulation or procedure.
    (c) Prior to issuing a REAL ID identification card,
    (1) A State must check with all other States to determine if the 
applicant currently holds a REAL ID driver's license or identification 
card in another State.
    (2) If the State receives confirmation that the individual holds a 
REAL ID card in another State the receiving State must take measures to 
confirm that the person has terminated or is terminating the REAL ID 
driver's license or identification card issued by the prior State 
pursuant to State law, regulation or procedure.

Subpart C--Other Requirements


Sec.  37.31  Source document retention.

    (a) States must retain copies of the application, declaration and 
source documents presented under Sec.  37.11 of this Part, including 
documents used to establish all names recorded by the DMV under Sec.  
37.11(c)(2). States shall take measures to protect any personally 
identifiable information collected pursuant to the REAL ID Act as 
described in their security plan under Sec.  37.41(b)(2).
    (1) States that choose to keep paper copies of source documents 
must retain the copies for a minimum of seven years.
    (2) States that choose to transfer information from paper copies to 
microfiche must retain the microfiche for a minimum of ten years.
    (3) States that choose to keep digital images of source documents 
must retain the images for a minimum of ten years.
    (4) States are not required to retain the declaration with 
application and source documents, but must retain the declaration 
consistent with applicable State document retention requirements and 
retention periods.
    (b) States using digital imaging to retain source documents must 
store the images as follows:
    (1) Photo images must be stored in the Joint Photographic Experts 
Group (JPEG) 2000 standard for image compression, or a standard that is 
interoperable with the JPEG standard. Images must be stored in an open 
(consensus) format, without proprietary wrappers, to ensure States can 
effectively use the image captures of other States as needed.
    (2) Document and signature images must be stored in a compressed 
Tagged Image Format (TIF), or a standard that is interoperable with the 
TIF standard.
    (3) All images must be retrievable by the DMV if properly requested 
by law enforcement.
    (c) Upon request by an applicant, a State shall record and retain 
the applicant's name, date of birth, certificate numbers, date filed, 
and issuing agency in lieu of an image or copy of the applicant's birth 
certificate, where such procedures are required by State law.


Sec.  37.33  DMV databases.

    (a) States must maintain a State motor vehicle database that 
contains, at a minimum--
    (1) All data fields printed on driver's licenses and identification 
cards issued by the State, individual serial numbers of the card, and 
SSN;
    (2) A record of the full legal name and recorded name established 
under Sec.  37.11(c)(2) as applicable, without truncation;
    (3) All additional data fields included in the MRZ but not printed 
on the driver's license or identification card; and
    (4) Motor vehicle driver's histories, including motor vehicle 
violations, suspensions, and points on driver's licenses.
    (b) States must protect the security of personally identifiable 
information, collected pursuant to the REAL ID Act, in accordance with 
Sec.  37.41(b)(2) of this part.

Subpart D--Security at DMVs and Driver's License and Identification 
Card Production Facilities


Sec.  37.41  Security plan.

    (a) In General. States must have a security plan that addresses the 
provisions in paragraph (b) of this section and must submit the 
security plan as part of its REAL ID certification under Sec.  37.55.
    (b) Security plan contents. At a minimum, the security plan must 
address--
    (1) Physical security for the following:
    (i) Facilities used to produce driver's licenses and identification 
cards.
    (ii) Storage areas for card stock and other materials used in card 
production.
    (2) Security of personally identifiable information maintained at 
DMV locations involved in the enrollment, issuance, manufacture and/or 
production of cards issued under the REAL ID Act, including, but not 
limited to, providing the following protections:
    (i) Reasonable administrative, technical, and physical safeguards 
to protect the security, confidentiality, and integrity of the 
personally identifiable information collected, stored, and maintained 
in DMV records and information systems for purposes of complying with 
the REAL ID Act. These safeguards must include procedures to prevent 
unauthorized access, use, or dissemination of applicant information and 
images of source documents retained pursuant to the Act and standards 
and procedures for document retention and destruction.
    (ii) A privacy policy regarding the personally identifiable 
information collected and maintained by the DMV pursuant to the REAL ID 
Act.
    (iii) Any release or use of personal information collected and 
maintained by the DMV pursuant to the REAL ID Act must comply with the 
requirements of the Driver's Privacy Protection Act, 18 U.S.C. 2721 et 
seq. State plans may go beyond these minimum privacy requirements to 
provide greater protection, and such protections are not subject to 
review by DHS for purposes of determining compliance with this Part.
    (3) Document and physical security features for the card, 
consistent with the requirements of Sec.  37.15, including a 
description of the State's use of biometrics, and the technical 
standard utilized, if any;
    (4) Access control, including the following:
    (i) Employee identification and credentialing, including access 
badges.
    (ii) Employee background checks, in accordance with Sec.  37.45 of 
this part.

[[Page 5338]]

    (iii) Controlled access systems.
    (5) Periodic training requirements in--
    (i) Fraudulent document recognition training for all covered 
employees handling source documents or engaged in the issuance of 
driver's licenses and identification cards. The fraudulent document 
training program approved by AAMVA or other DHS approved method 
satisfies the requirement of this subsection.
    (ii) Security awareness training, including threat identification 
and handling of SSI as necessary.
    (6) Emergency/incident response plan;
    (7) Internal audit controls;
    (8) An affirmation that the State possesses both the authority and 
the means to produce, revise, expunge, and protect the confidentiality 
of REAL ID driver's licenses or identification cards issued in support 
of Federal, State, or local criminal justice agencies or similar 
programs that require special licensing or identification to safeguard 
persons or support their official duties. These procedures must be 
designed in coordination with the key requesting authorities to ensure 
that the procedures are effective and to prevent conflicting or 
inconsistent requests. In order to safeguard the identities of 
individuals, these procedures should not be discussed in the plan and 
States should make every effort to prevent disclosure to those without 
a need to know about either this confidential procedure or any 
substantive information that may compromise the confidentiality of 
these operations. The appropriate law enforcement official and United 
States Attorney should be notified of any action seeking information 
that could compromise Federal law enforcement interests.
    (c) Handling of Security Plan. The Security Plan required by this 
section contains Sensitive Security Information (SSI) and must be 
handled and protected in accordance with 49 CFR Part 1520.


Sec.  37.43  Physical security of DMV production facilities.

    (a) States must ensure the physical security of facilities where 
driver's licenses and identification cards are produced, and the 
security of document materials and papers from which driver's licenses 
and identification cards are produced or manufactured.
    (b) States must describe the security of DMV facilities as part of 
their security plan, in accordance with Sec.  37.41.


Sec.  37.45  Background checks for covered employees.

    (a) Scope. States are required to subject persons who are involved 
in the manufacture or production of REAL ID driver's licenses and 
identification cards, or who have the ability to affect the identity 
information that appears on the driver's license or identification 
card, or current employees who will be assigned to such positions 
(``covered employees'' or ``covered positions''), to a background 
check. The background check must include, at a minimum, the validation 
of references from prior employment, a name-based and fingerprint-based 
criminal history records check, and employment eligibility verification 
otherwise required by law. States shall describe their background check 
process as part of their security plan, in accordance with Sec.  
37.41(b)(4)(ii). This section also applies to contractors utilized in 
covered positions.
    (b) Background checks. States must ensure that any covered employee 
under paragraph (a) of this section is provided notice that he or she 
must undergo a background check and the contents of that check.
    (1) Criminal history records check. States must conduct a name-
based and fingerprint-based criminal history records check (CHRC) 
using, at a minimum, the FBI's National Crime Information Center (NCIC) 
and the Integrated Automated Fingerprint Identification (IAFIS) 
database and State repository records on each covered employee 
identified in paragraph (a) of this section, and determine if the 
covered employee has been convicted of any of the following 
disqualifying crimes:
    (i) Permanent disqualifying criminal offenses. A covered employee 
has a permanent disqualifying offense if convicted, or found not guilty 
by reason of insanity, in a civilian or military jurisdiction, of any 
of the felonies set forth in 49 CFR 1572.103(a).
    (ii) Interim disqualifying criminal offenses. The criminal offenses 
referenced in 49 CFR 1572.103(b) are disqualifying if the covered 
employee was either convicted of those offenses in a civilian or 
military jurisdiction, or admits having committed acts which constitute 
the essential elements of any of those criminal offenses within the 
seven years preceding the date of employment in the covered position; 
or the covered employee was released from incarceration for the crime 
within the five years preceding the date of employment in the covered 
position.
    (iii) Under want or warrant. A covered employee who is wanted or 
under indictment in any civilian or military jurisdiction for a felony 
referenced in this section is disqualified until the want or warrant is 
released.
    (iv) Determination of arrest status. When a fingerprint-based check 
discloses an arrest for a disqualifying crime referenced in this 
section without indicating a disposition, the State must determine the 
disposition of the arrest.
    (v) Waiver. The State may establish procedures to allow for a 
waiver of the requirements of paragraphs (b)(1)(ii) or (b)(1)(iv) of 
this section under circumstances determined by the State. These 
procedures can cover circumstances where the covered employee has been 
arrested, but no final disposition of the matter has been reached.
    (2) Employment eligibility status verification. The State shall 
ensure it is fully in compliance with the requirements of section 274A 
of the Immigration and Nationality Act (8 U.S.C. 1324a) and its 
implementing regulations (8 CFR part 274A) with respect to each covered 
employee. The State is encouraged to participate in the USCIS E-Verify 
program (or any successor program) for employment eligibility 
verification.
    (3) Reference check. Reference checks from prior employers are not 
required if the individual has been employed by the DMV for at least 
two consecutive years since May 11, 2006.
    (4) Disqualification. If results of the State's CHRC reveal a 
permanent disqualifying criminal offense under paragraph (b)(1)(i) or 
an interim disqualifying criminal offense under paragraph (b)(1)(ii), 
the covered employee may not be employed in a position described in 
paragraph (a) of this section. An employee whose employment eligibility 
has not been verified as required by section 274A of the Immigration 
and Nationality Act (8 U.S.C. 1324a) and its implementing regulations 
(8 CFR part 274A) may not be employed in any position.
    (c) Appeal. If a State determines that the results from the CHRC do 
not meet the standards of such check the State must so inform the 
employee of the determination to allow the individual an opportunity to 
appeal to the State or Federal government, as applicable.
    (d) Background checks substantially similar to the requirements of 
this section that were conducted on existing employees on or after May 
11, 2006 need not be re-conducted.

[[Page 5339]]

Subpart E--Procedures for Determining State Compliance


Sec.  37.51  Compliance--general requirements.

    (a) Full compliance. To be in full compliance with the REAL ID Act 
of 2005, 49 U.S.C. 30301 note, States must meet the standards of 
subparts A through D or have a REAL ID program that DHS has determined 
to be comparable to the standards of subparts A through D. States 
certifying compliance with the REAL ID Act must follow the 
certification requirements described in Sec.  37.55. States must be 
fully compliant with Subparts A through D on or before May 11, 2011. 
States must file the documentation required under Sec.  37.55 at least 
90 days prior to the effective date of full compliance.
    (b) Material compliance. States must be in material compliance by 
January 1, 2010 to receive an additional extension until no later than 
May 10, 2011 as described in Sec.  37.63. Benchmarks for material 
compliance are detailed in the Material Compliance Checklist found in 
DHS' Web site at http://www.dhs.gov.


Sec.  37.55  State certification documentation.

    (a) States seeking DHS's determination that its program for issuing 
REAL ID driver's licenses and identification cards is meeting the 
requirements of this part (full compliance), must provide DHS with the 
following documents:
    (1) A certification by the highest level Executive official in the 
State overseeing the DMV reading as follows:

    ``I, [name and title (name of certifying official), (position 
title) of the State (Commonwealth))] of --------, do hereby certify 
that the State (Commonwealth) has implemented a program for issuing 
driver's licenses and identification cards in compliance with the 
requirements of the REAL ID Act of 2005, as further defined in 6 CFR 
part 37, and intends to remain in compliance with these 
regulations.''

    (2) A letter from the Attorney General of the State confirming that 
the State has the legal authority to impose requirements necessary to 
meet the standards established by this part.
    (3) A description of the State's exceptions process under Sec.  
37.11(h), and the State's waiver processes under Sec.  37.45(b)(1)(v).
    (4) The State's Security Plan under Sec.  37.41.
    (b) After DHS's final compliance determination, States shall 
recertify compliance with this Part every three years on a rolling 
basis as determined by DHS.


Sec.  37.59  DHS reviews of State compliance.

    State REAL ID programs will be subject to DHS review to determine 
whether the State meets the requirements for compliance with this part.
    (a) General inspection authority. States must cooperate with DHS's 
review of the State's compliance at any time. In addition, the State 
must:
    (1) Provide any reasonable information pertinent to determining 
compliance with this part as requested by DHS;
    (2) Permit DHS to conduct inspections of any and all sites 
associated with the enrollment of applicants and the production, 
manufacture, personalization and issuance of driver's licenses or 
identification cards; and
    (3) Allow DHS to conduct interviews of the State's employees and 
contractors who are involved in the application and verification 
process, or the manufacture and production of driver's licenses or 
identification cards. DHS shall provide written notice to the State in 
advance of an inspection visit.
    (b) Preliminary DHS determination. DHS shall review forms, conduct 
audits of States as necessary, and make a preliminary determination on 
whether the State has satisfied the requirements of this part within 45 
days of receipt of the Material Compliance Checklist or State 
certification documentation of full compliance pursuant to Sec.  37.55.
    (1) If DHS determines that the State meets the benchmarks of the 
Material Compliance Checklist, DHS may grant the State an additional 
extension until no later than May 10, 2011.
    (2) If DHS determines that the State meets the full requirements of 
subparts A through E, the Secretary shall make a final determination 
that the State is in compliance with the REAL ID Act.
    (c) State reply. The State will have up to 30 calendar days to 
respond to the preliminary determination. The State's reply must 
explain what corrective action it either has implemented, or intends to 
implement, to correct any deficiencies cited in the preliminary 
determination or, alternatively, detail why the DHS preliminary 
determination is incorrect. Upon request by the State, an informal 
conference will be scheduled during this time.
    (d) Final DHS determination. DHS will notify States of its final 
determination of State compliance with this Part, within 45 days of 
receipt of a State reply.
    (e) State's right to judicial review. Any State aggrieved by an 
adverse decision under this section may seek judicial review under 5 
U.S.C. Chapter 7.


Sec.  37.61  Results of compliance determination.

    (a) A State shall be deemed in compliance with this part when DHS 
issues a determination that the State meets the requirements of this 
part.
    (b) The Secretary will determine that a State is not in compliance 
with this part when it--
    (1) Fails to submit a timely certification or request an extension 
as prescribed in this subpart; or
    (2) Does not meet one or more of the standards of this part, as 
established in a determination by DHS under Sec.  37.59.


Sec.  37.63  Extension of deadline.

    (a) A State may request an initial extension by filing a request 
with the Secretary no later than March 31, 2008. In the absence of 
extraordinary circumstances, such an extension request will be deemed 
justified for a period lasting until, but not beyond, December 31, 
2009. DHS shall notify a State of its acceptance of the State's request 
for initial extension within 45 days of receipt.
    (b) States granted an initial extension may file a request for an 
additional extension until no later than May 10, 2011, by submitting a 
Material Compliance Checklist demonstrating material compliance, per 
Sec.  37.51(b) with certain elements of subparts A through E as defined 
by DHS. Such additional extension request must be filed by October 11, 
2009. DHS shall notify a State whether an additional extension has been 
granted within 45 days of receipt of the request and documents 
described above.
    (c) Subsequent extensions, if any, will be at the discretion of the 
Secretary.


Sec.  37.65  Effect of failure to comply with this Part.

    (a) Any driver's license or identification card issued by a State 
that DHS determines is not in compliance with this part is not 
acceptable as identification by Federal agencies for official purposes.
    (b) Driver's licenses and identification cards issued by a State 
that has obtained an extension of the compliance date from DHS per 
Sec.  37.51 are acceptable for official purposes until the end of the 
applicable enrollment period under Sec.  37.5; or the State 
subsequently is found by DHS under this Subpart to not be in 
compliance.
    (c) Driver's licenses and identification cards issued by a State 
that has been determined by DHS to be in material compliance and that 
are marked to identify that the licenses and cards are materially 
compliant will continue to be accepted by Federal agencies after the

[[Page 5340]]

expiration of the enrollment period under Sec.  37.5, until the 
expiration date on the face of the document.

Subpart F--Driver's Licenses and Identification Cards Issued Under 
Section 202(d)(11) of the REAL ID Act


Sec.  37.71  Driver's licenses and identification cards issued under 
section 202(d)(11) of the REAL ID Act.

    (a) Except as authorized in Sec.  37.27, States that DHS determines 
are compliant with the REAL ID Act that choose to also issue driver's 
licenses and identification cards that are not acceptable by Federal 
agencies for official purposes must ensure that such driver's licenses 
and identification cards--
    (1) Clearly state on their face and in the machine readable zone 
that the card is not acceptable for official purposes; and
    (2) Have a unique design or color indicator that clearly 
distinguishes them from driver's licenses and identification cards that 
meet the standards of this part.
    (b) DHS reserves the right to approve such designations, as 
necessary, during certification of compliance.
* * * * *

    Issued in Washington, DC, on January 10, 2008.
Michael Chertoff,
Secretary.
[FR Doc. 08-140 Filed 1-28-08; 8:45 am]
BILLING CODE 4410-10-P