10.23.2006

Using a "pointer database" with Real ID:

Warning, we're going to get a bit technical here: I learned from an article at GCN Home, by Wilson P. Dizard III, that a trucker data base has been suggested as a model for Real ID. The problem people want to solve here is that checking everyone's documents in 50 states all the time, to satisfy Real ID security requirements, will hopelessly overload access to federal data bases. If so, you may spend five days renewing your license instead of an hour or two.

The suggested trucker data base is a called a "pointer data base" because, instead of containing actual data (like the details of your birth certificate), it merely notes whether such data exists in another data base. Checking a pointer data base to see whether a candidate already has other state driver's licenses would be much faster than checking other states' data bases to read the candidates other licenses if they exist.

This suggestion raises several red flags for me, for your consideration:
(1) It's possible there are ways to "game" a pointer system to subvert its level of security. I hope to get a comment from Bruce Schneier on this risk. In any case this is a new thing, and its basic level of security has not been tested yet, I think.
(2) Some states are already implementing computer software for Real ID, in order not to fall behind. Each of them is either assuming there will be a pointer data base or not; some of them will have reworking to do, depending on whether a pointer DB is used. This is just one of many, many possible examnples to show the risk of working ahead with neither final specs nor an agreed upon, common design.

More timetable for Real ID:

The DHS says it will issue "draft" specs for Real ID by year end. Jonathan Frenkel, director of law enforcement policy at DHS, says the draft regulations will better explain the broad mandates in the Real ID Act of 2005. The specs have been long coming because the DHS wanted to "get them right the first time." (It's quite hard to get something right the first time, but by now the DHS coud have issued four drafts, and easily gotten it right the fourth time, sooner!)

Frenkel also believes the DHS has tried to make its intentions as clear as possible so states could take steps before regulations are released for comment. Many states have in fact gone ahead with development, and it will be wonderful if we do not hear squeals of agony from them when the specs are final. The whole point of publishing specs is that it's really, really hard to get know what they are until they are final.

10.17.2006

Oct. 2006: An Excellent Technical Review

In PC World, Anuch Yegyazarian reviews the state of Real ID, its technical problemsand prospects. The article, Ral IDs real problems, is clear and farily detailed. Some quotes:
Without knowing which technology to use, states can't even begin soliciting bids from firms to produce the cards. They can't finalize deals. They can't get delivery of product, install the new equipment, train their workers, or run trials to ensure that the system is free of glitches.
The DMV must verify your name, date of birth, social security number, residence, prior licenses, and immigration status before it issues a new license. The problem is, according to the states, only one of the several national databases that would allow state DMVs to check all that information is actually accessible to those DMVs.
Before the system could function, all government entities involved would have to get those other databases securely online, standardize on file formats and authentication procedures, and create the network and server infrastructure to store and shuttle all that data. All of it needs to happen so that, for example, Florida's DMV can ascertain which John Smith is applying for a new license, and can access the proper records in a timely fashion.

10.09.2006

Now Texas feel the heat:

An article in the Brownsville Herald (Texas) by Elizabeth Pierson quotes a spokesperson thus: "[It will] cost the state an estimated $268 million. The money will go toward paying for technology and hiring more than 700 employees to handle the increased traffic."

There's an estimate that an additional three million people (almost double the current number) will need licenses; Texas will no longer be able to accept the Mexican "matricula consular" as proof of identity; and all licenses will expire and require renewal. (One of Texas's current efficiencies is that some licenses never expire.)

'Real ID' Mandate Is Impractical:

An unsigned opinion piece in TheLedger.com (mid-Florida) speaks eloquently to the impracticality of implementing Real ID in 2008. The piece ends:
State officials aren't necessarily opposed to carrying Congress' water and establishing a reliable ID system in the name of national security. What the states would like is more financial help from Congress and a little more time to meet the mandates. "Even with full funding and aggressive state implementation plans," the study said, "the difficulties of complying with yet unpublished regulations by the statutory deadline of May 2008 are insurmountable."

Congress can't wave a magic wand and create a national ID card. And neither can the states. The Real ID Act sets the states up for failure. Passing the buck in such cavalier fashion won't make America safer, it will only create discord in the federal-state homeland security partnership.