Congress eyes uniform driver's license standards

From...

By Patrick Thibodeau

WASHINGTON (IDG) -- Congress will soon consider legislation seeking national, uniform standards for state-issued driver's licenses in order to fix a system that made it easy for the September 11 terrorists to get identification.

U.S. Sen. Richard "Dick" Durbin, (Democrat-Illinois), said Tuesday he will introduce legislation that would set minimum uniform standards for driver's licenses, as well as allow data-sharing among federal and state agencies.

IDG.net INFOCENTER Computerworld main page Computerworld's topic-oriented communities Computerworld's IT career center Free daily newsletters Related IDG.net Stories Technology, politics pose biometric bottlenecks Standardized licenses could be boon, burden to business West Virginia uses facial-recognition technology to fight driver license fraud Features PC World.com Product Finder Mastering e-commerce by degrees Fast-track training puts nontechies in IT jobs Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com UnixInsider IDG.net search

This is an issue of importance to businesses that are increasingly swiping or scanning driver's licenses to authenticate customers. The selection of any standard has potential implications for the kinds of systems that businesses can use.

Durbin, the chair of the Senate Subcommittee on Oversight of Government Management, announced his plan at a hearing on driver's licenses and other forms of state-issued identification cards. The issue has raised numerous privacy concerns among those who fear driver's licenses are about to become de facto national ID cards.

But those who testified Tuesday agreed that the current system is flawed. Eight of the 19 terrorists aboard hijacked airliners during the September 11 terrorist attacks on the U.S. had fraudulently obtained identification from Virginia.

Virginia isn't alone. According to one state official at the hearing, Kansas requires a photograph to issue a license, but no Social Security number or fingerprint. Many states are, however, improving technology and adding biometrics to their licenses. But the states often use different technologies, varying the types of magnetic stripes and bar codes to encode information.

"What we have is a system that is broken and a product that is not very reliable," said Betty Serian, a deputy secretary at the Pennsylvania Department of Transportation.

Mary Ann Viverette, the chief of police in Gaithersburg, Maryland, and a vice president of the Alexandria, Virginia-based International Association of Chiefs of Police, said minimum standards and agreements among states are needed "for the inclusion of both a unique identifier, such as a fingerprint, and anticounterfeiting security devices in a driver's licenses."

But creating a standard and technology that can be accessed by law enforcement officials as well as businesses could have costly implications for agencies and companies with legacy systems.

"If you go straight to smart card, you are going to leave millions of terminals at cash registers and airline counters unable to read the card," said Richard Varn, CIO of the state of Iowa, in an interview after the hearing. Varn was among those who testified.

"You don't want to end up with a counter full of readers for different state cards, so you have to work on standards and interoperability," he said.

Key to a successful system will be good databases with reliable information, Varn said, adding, "A dumb card with smart networks and good databases can do just as well as a smart card."

Since databases are where any rights associated with ID cards are stored, he said, that's "where we have to make the solid improvements."

Creating a national standard won't be easy, according to a report this month from a committee of the National Research Council. It cited numerous legal, policy and technical challenges, including questions about authenticating a valid ID card.

A photo ID "would not be sufficient if very high assurance is sought," the report said. If a card uses a magnetic strip, it would be easy to copy stored information to a new card with a different picture. Duplication of a smart card, while difficult, is still possible. And being able to match card information with databases requires systems that are reliable and secure, the report said.

Large back-end systems accessible by large numbers of people would raise security issues, the report said. "Moreover, if verification of identity required an online database query at airports, a handful of 'accidents' at key places around the country (such as wires being cut at critical points in a way that appears accidental) could cripple civil aviation," the report said.

Barry Goleman, a former official for the state of California who now works at American Management Systems Inc. in Fairfax, Virginia, said biometrics such as fingerprints and facial recognition can complete a positive one-to-one authentication of an individual. But the first step is ensuring thorough verification of an individual's identity before a license is issued, he said.