Written testimony of Office of Policy Assistant Secretary David Heyman for a House Committee on the Judiciary, Subcommittee on Crime, Terrorism, and Homeland Security hearing titled “Secure Identification: The REAL ID Act's Minimum Standards for Driver's Licenses and Identification Cards”

2141 Rayburn

Introduction

Chairman Sensenbrenner, Rep. Scott, and members of the subcommittee: Thank you for your leadership on homeland security issues, and thank you for holding this important hearing today so that the Department of Homeland Security (DHS) can provide you with an update on the progress the states have made implementing the REAL ID Act of 2005, Title II of division B of Pub. L. 109-13 (“REAL ID Act” or “Act”). We welcome the opportunity to submit this testimony on how the state, territory, and federal partners have improved the security of driver’s licenses and identification documents.

Over the last two Administrations, we have worked to implement the REAL ID Act of 2005. States have the principal responsibility for implementing REAL ID. DHS developed an Implementation Plan in June 2007 and published a Final Rule in January 2008, which provided states and territories with information on the minimum requirements that must be met and the funding available to help meet those requirements. Since then, DHS awarded over $200 million in grants to states and territories to fund enhancements to driver’s license security programs. Additionally, DHS has issued guidance documents and engaged stakeholders to ensure their concerns were heard. DHS, the states, and the territories have collectively built or are building the technical infrastructure and systems to support verification of social security numbers, birth certificates, U.S. passports, and immigration status—key steps toward improving the security of our documents. Perhaps the greatest success of REAL ID has been that the security of driver’s licenses has been improved in ALL states, even in the 13 states with legislation prohibiting their participation in REAL ID. Diligent outreach and work with states by DHS has yielded real benefits in the last several years.

In my testimony, I will elaborate on the progress but first it is important to provide the background to how we got to where we are today.

Why We Need Secure Identification Documents

Law enforcement must be able to rely on government-issued identification documents and know that the bearer of such a document is who he or she claims to be. Obtaining fraudulent identification documents presents an opportunity for terrorists to board airplanes, rent cars, open bank accounts, or conduct other activities without being detected. According to the 9/11 Commission Report, “All but one of the 9/11 hijackers acquired some form of U.S. identification document, some by fraud.”¹

We recognize that preventing terrorists from obtaining these documents is critical. As the 9/11 Commission noted, “For terrorists, travel documents are as important as weapons.”²

The 9/11 Commission recommended that the federal government work with other layers of government to solidify the security of government-issued IDs. While improving government-issued IDs alone will not thwart every planned terrorist attack, it does present an important obstacle to any potential terrorist operating in the United States and could aid law enforcement in stopping terrorist plots. Securing IDs is a common-sense national security and law enforcement imperative, which also helps to combat identity fraud and illegal immigration. The 9/11 Commission spelled out the need for the federal government and the state or territory³ to take action together on this issue and together we have made considerable progress.

¹ The 9/11 Commission Report: Final Report of the National Commission on Terrorist Attacks upon the United States, at 390 (2004).
² The 9/11 Commission Report: Final Report of the National Commission on Terrorist Attacks upon the United States, at 384 (2004).
³ States and territories is used to refer to all fifty-six jurisdictions covered by the REAL ID Act, to include the fifty states, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Marianas Islands.

Passage of the REAL ID Act of 2005

In May 2005, Congress enacted the REAL ID Act of 2005 in response to the 9/11 Commission’s recommendations for more secure standards for identification. The Act included the following provisions:

• Prohibits Federal agencies from accepting driver's licenses or identification cards unless the Department determines that the state or territory meets minimum security requirements.
• Establishes minimum standards for the:
  • Information and features that appear on the face of the card;
  • Physical security of cards to prevent tampering, counterfeiting, and duplication of the documents for a fraudulent purpose;
  • Presentation and verification of source documents, including presentation and verification of documents evidencing citizenship or lawful status; and
  • Physical security of production and storage facilities and for materials from which REAL ID cards are produced.
• Authorizes the Department of Homeland Security to make grants to states and territories to assist in conforming to the minimum standards of the Act.

In June 2007, DHS submitted, and the Senate and House Appropriations Committees subsequently approved, the REAL ID Implementation Plan. In the REAL ID Implementation Plan, DHS outlined its plans to make grant funds available specifically for projects that addressed the following areas:

• Enhancements to existing communications and verification systems to support cost effective electronic verification of source documents.
• Development of a secure indexing or pointer system for verification that an individual does not hold multiple licenses in multiple states or territories.
• Development of a cost effective capability for verification of lawful status. Improvements to the infrastructure to support electronic verification of birth certificates.
• Model privacy standards, security practices, and business rules regarding verification of applicant information with Federal and state agencies.

Additionally, in January 2008, the Department published the REAL ID regulation (“Minimum Standards for Driver's Licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes” (6 C.F.R. part 37)) providing greater detail on the minimum requirements states and territories must satisfy to be in compliance with the Act.

When determining whether a state has implemented a secure driver’s license program, DHS will base its decision on what states have done to meet the requirements of the regulation. The security benchmarks in the regulation focus on: identity assurance procedures; license information and security features; secure business processes; employee training and background checks; and privacy protections. They also address the primary sources of fraud in the issuance and use of driver’s licenses and identification cards.

DHS Funding to Support Efforts to Meet the Security Standards of the REAL ID Act

Since FY 2006, the Department has obligated a total of $273 million in REAL ID program funds to support states and territories in their efforts to meet the requirements of the REAL ID Act.

From FY 2006 through FY 2011, FEMA awarded approximately $200 million in grants to 54 states and territories to fund individual projects to improve the security of their credentials, facilities, systems, and business processes commensurate with the standards of the REAL ID Act. States and territories have been able to allocate these funds based on individual needs, priorities, and operations.

States and territories have used these awards to meet the material compliance security benchmarks and other REAL ID standards, including:

• Adding tamper resistant or enhanced security features to their documents.
• Modifying their facilities to limit access to sensitive materials and card production areas.
• Modernizing information technology systems to promote interoperability.
• Conducting fraudulent document training or re-engineering the driver’s license issuance process to reduce customer wait times.
• Implementing verification of lawful status.
• Improving their ability to protect applicants’ personal information.

For example, using REAL ID FY 2008 Demonstration Grant funds, the State of New York purchased facial recognition software to detect individuals holding multiple drivers’ licenses, sometimes in an attempt to evade law enforcement detection. New York used facial recognition technology to review the records of 600,000 holders of New York State Commercial Driver Licenses (CDLs). The results of this effort led to the arrest of more than 50 commercial drivers for fraudulently obtaining multiple driver licenses using an alias. Since February 2010, 800 people have been arrested for having two or more licenses under different aliases.

From FY 2008 through FY 2011, FEMA also awarded approximately $63 million in targeted grants to five states, Mississippi, Kentucky, Indiana, Florida, and Nevada, which volunteered to upgrade existing communications and verification infrastructure needed by all states and territories to meet the requirements of the REAL ID Act.

• The following verification capabilities to meet the verification requirements of the REAL ID regulation are either operational or in pilot testing. Specifically:
  • The states have upgraded the infrastructure necessary to support DMV verification of birth certificates. Birth records from 38 state Vital Records Agencies are now available for electronic verification;
  • Fifty states and the District of Columbia are verifying social security numbers;
  • Forty-seven states and territories have signed an agreement with USCIS to verify lawful status through the SAVE program; and
  • Four states are piloting verification of U.S. passports and this capability will be available to all states later this calendar year.
• Driver Licensing Agencies (DLAs) have used, and are continuing to use, remaining Driver’s License Security Grant awards to fund the local information technology and business process improvements needed to connect to and use these systems.

Additionally, USCIS has supported almost $10 million in projects for the development and deployment of cost-effective methods that states and territories can use to verify lawful status, U.S. passports, and social security numbers. USCIS has worked together with the states and territories in the development, testing, and deployment of these capabilities.

Facilitating Conformity with the Standards of the REAL ID Act—Guidance and Outreach for the States and Territories

The Department’s efforts extend far beyond providing financial assistance to states and territories. DHS has been working with states and territories to assist them in understanding and meeting the security standards of the REAL ID Act. In 2008 and 2009, DHS issued two guidance documents for that purpose:

• REAL ID Mark Guidelines (October 2008), providing DHS recommendations for the marking of licenses.
• REAL ID Security Plan Guidance Handbook (February 2009), providing best practices for: securing facilities where enrollment, production, and/or issuance of REAL ID driver’s licenses and identification cards occur; card design and security; privacy; personnel security, and the contents of the security plans.

Because of additional requests from the states for clarification, the Department plans to issue additional guidance in the near future to clarify the minimum standards that states and territories must meet to achieve full compliance with the Act and provide examples of how states can meet them. While DHS has worked closely with many individual states and territories—some of which already submitted full compliance packages—the Department believes that the guidance will reduce the uncertainty surrounding the regulation and encourage states and territories to submit information on their progress consistent with the minimum standards of the REAL ID Act. In providing further guidance, DHS’s purpose is to afford every state and territory the flexibility and opportunity to reach full compliance in a practical manner.

DHS’s subject matter experts have worked with the states and territories continually since 2007. Through its participation in meetings with the states, territories, partnering federal organizations, and stakeholders as well as attendance at a wide range of conferences, our program office, the Office of State-Issued Identity Support (OSIIS), visited 44 of 56 states and territories covered by the REAL ID Act, including four of the five U.S. territories. DHS continues to work closely with the Department of State on the passport verification module. DHS has worked with the American Association of Motor Vehicle Administrators (AAMVA) to coordinate implementation of the standards of the REAL ID regulation. In particular, DHS participated with the states and territories in the drafting of the Personal Identification – AAMVA North American Standard – DL/ID Card Design to ensure that states and territories can implement the REAL ID requirements for card design by means of common, consensus-based data formats and card technologies endorsed by all states and territories.

Since 2007, OSIIS has also participated in at least 40 meetings with AAMVA and member states regarding all aspects of the REAL ID program, and provides regular briefings at the semiannual AAMVA Board of Directors Meetings and regional meetings. OSIIS representatives have also attended annual meetings of National Association for Public Health Statistics and Information Systems since 2007. The program communicates regularly with the Coalition for A Secure Driver’s License. OSIIS has also participated in a dozen on-site meeting with the State of Mississippi and the Mississippi consortium of states leading state efforts to improve the communications system infrastructure supporting the verification requirements of the Act.

Thirteen states⁴ have laws prohibiting compliance with the REAL ID Act. Even so, DHS believes that some of these states already issue secure identification documents consistent with the standards of the regulation.

It is important to note that the REAL ID regulation provides DHS with the ability to recognize comparable programs in states and territories that issue driver’s licenses and ID cards consistent with the minimum requirements of the regulation. States and territories are, in fact, already achieving success with their comparable efforts.

For example, four states (Michigan, New York, Vermont, and Washington) currently issue Enhanced Driver’s Licenses and Enhanced Identification Documents (EDLs) that were developed in alignment with the REAL ID standards, but can also be used by U.S. citizens as a border crossing document to enter the United States through a land or sea port of entry in accordance with the Western Hemisphere Travel Initiative (WHTI).

⁴ Alaska, Arizona, Idaho, Louisiana, Maine, Minnesota, Missouri, Montana, New Hampshire, Oklahoma, Oregon, South Carolina, and Washington.

Approaching Deadline

The deadline for meeting the standards of the REAL ID Act is January 15, 2013. To assist DHS in making compliance determinations, the regulation also requires states and territories to submit certification materials at least 90 days prior to the effective date of compliance. A DHS compliance determination means that a state’s or territory’s program meets or exceeds the REAL ID regulatory requirements or has a program comparable to the requirements of the REAL ID regulation.

Conclusion

This hearing seeks to take stock of implementation of the REAL ID Act of 2005. DHS relies on alternative data collection methods, such as grant reporting, to document progress made by states and territories in improving the security of their driver’s licenses and identification cards commensurate with the standards of the REAL ID Act. While this does not afford DHS full visibility into all the progress states have made, we can say that the Department, along with our federal, state and territory partners, has made great strides in improving the security of credentials since 9/11 and the subsequent enactment of the REAL ID Act of 2005. States and territories have made significant progress in meeting the benchmarks and other requirements of the REAL ID regulation and most are meeting REAL ID facility, production, issuance, and card standards. We commend them for their efforts.

Thank you again for this opportunity to testify. I am happy to answer any questions you may have.