[Federal Register Volume 73, Number 19 (Tuesday, January 29, 2008)]
[Rules and Regulations]
[Pages 5272-5340]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 08-140]
[[Page 5271]]
-----------------------------------------------------------------------
Part II
Department of Homeland Security
-----------------------------------------------------------------------
6 CFR Part 37
Minimum Standards for Driver's Licenses and Identification Cards
Acceptable by Federal Agencies for Official Purposes; Final Rule
Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 /
Rules and Regulations
[[Page 5272]]
-----------------------------------------------------------------------
DEPARTMENT OF HOMELAND SECURITY
Office of the Secretary
6 CFR Part 37
[Docket No. DHS-2006-0030]
RIN 1601-AA37
Minimum Standards for Driver's Licenses and Identification Cards
Acceptable by Federal Agencies for Official Purposes
AGENCY: Office of the Secretary, DHS.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Department of Homeland Security is establishing minimum
standards for State-issued driver's licenses and identification cards
that Federal agencies would accept for official purposes on or after
May 11, 2008, in accordance with the REAL ID Act of 2005. This rule
establishes standards to meet the minimum requirements of the REAL ID
Act of 2005. These standards involve a number of aspects of the process
used to issue identification documents, including: Information and
security features that must be incorporated into each card; application
information to establish the identity and immigration status of an
applicant before a card can be issued; and physical security standards
for facilities where driver's licenses and applicable identification
cards are produced. This final rule also provides a process for States
to seek an additional extension of the compliance deadline to May 11,
2011, by demonstrating material compliance with the core requirements
of the Act and this rule. Finally, taking into consideration the
operational burdens on State Departments of Motor Vehicles, this rule
extends the enrollment time period to allow States determined by DHS to
be in compliance with the Act to replace all licenses intended for
official purpose with REAL ID-compliant cards by December 1, 2014 for
people born after December 1, 1964, and by December 1, 2017 for those
born on or before December 1, 1964.
DATES: Effective Date: This rule is effective March 31, 2008. The
incorporation by reference of certain publications listed in the rule
is approved by the Director of the Federal Register as of March 31,
2008.
Compliance Dates: Extensions: As of May 11, 2008, Federal agencies
cannot accept driver's licenses or identification cards for official
purposes, as defined herein, from States that have not been determined
by DHS to be in compliance with the REAL ID Act unless a State has
requested and obtained an extension of the compliance date from DHS.
States seeking extensions must submit a request for an extension to DHS
no later than March 31, 2008. As of December 31, 2009, any initial
extension will terminate unless a State, no later than October 11,
2009, submits to DHS a request for an additional extension and
certification that the State has achieved the benchmarks set forth in
the Material Compliance Checklist. As of May 11, 2011, driver's
licenses and identification cards will not be accepted from States that
are not in full compliance with the provisions of REAL ID.
Enrollment: As of December 1, 2014, Federal agencies cannot accept
driver's licenses or identification cards for official purposes, as
defined herein, from any individual born after December 1, 1964, unless
DHS has determined that the issuing State is in compliance with
Subparts A through D of this rule and the card presented by the
individuals meet the standards of this rule. As of December 1, 2017,
Federal agencies will not accept any State-issued driver's licenses and
identification cards for official purposes unless such cards have been
issued by States that have certified to DHS their compliance with
Subparts A through D of this rule.
FOR FURTHER INFORMATION CONTACT: Darrell Williams, REAL ID Program
Office, Department of Homeland Security, Washington, DC 20528 (202)
282-9829.
SUPPLEMENTARY INFORMATION:
Abbreviations and Terms Used in This Document
AAMVA--American Association of Motor Vehicle Administrators
ACLU--American Civil Liberties Union
CAC--U.S. Department of Defense Common Access Card
CDLIS--Commercial Drivers License Information System
CHRC--Criminal History Records Check
CRBA--Consular Report of Birth Abroad
DHS--U.S. Department of Homeland Security
DMV--Department of Motor Vehicles
DOS--U.S. Department of State
DOT--U.S. Department of Transportation
EAD--Employment Authorization Document
EDL--Enhanced driver's license and identification card
EVVE--Electronic Verification of Vital Events
FOIA--Freedom of Information Act
IAFIS--Integrated Automated Fingerprint Identification
ICAO--International Civil Aviation Organization
ID--Identification Card
JPEG--Joint Photographic Experts Group
LPR--Lawful Permanent Resident
MRZ--Machine Readable Zone
NAPHSIS--National Association of Public Health Statistics and
Information Systems
NASCIO--National Association of State Chief Information Officers
NCSL--National Conference of State Legislatures
NCIC--National Crime Information Center
NGA--National Governors Association
NPRM--Notice of Proposed Rulemaking
PII--Personally Identifiable Information
RFID--Radio Frequency Identification
SAVE--Systematic Alien Verification for Entitlements
SEVIS--Student and Exchange Visitor Information System
SSA--Social Security Administration
SSI--Sensitive Security Information
SSN--Social Security Number
SSOLV--Social Security On-Line Verification
TIF--Tagged Image Format
TSA--Transportation Security Administration
TWIC--Transportation Worker Identification Credential
USCIS--U.S. Citizenship and Immigration Services
WHTI--Western Hemisphere Travel Initiative
Table of Contents
I. Background
II. Discussion of the Final Rule
A. Extension of Deadlines
B. Implementation Dates
C. Verification and Data Exchange Systems Architecture
D. Marking of Compliant REAL ID Documents
E. Prohibition on States Issuing Real ID Cards to Persons Who
Hold a Driver's License in Another State
F. Western Hemisphere Travel Initiative
III. Section-by-Section Analysis of the Final Rule
IV. Discussion of Comments
A. General Comments on the Proposed Regulation
B. Scope, Applicability, and Definitions
C. Compliance Period
D. Privacy Considerations
E. State to State Database Queries
F. Document Standards for Issuing REAL ID Driver's Licenses and
Identification Cards
G. Exceptions Processing for Extraordinary Circumstances
H. Temporary or Limited-Term Driver's Licenses and
Identification Cards
I. Minimum Driver's License or Identification Card Data Element
Requirements
J. Validity Period and Renewals of REAL ID Driver's Licenses and
Identification Cards
K. Source Document Retention
L. Database Connectivity
M. Security of DMV Facilities Where Driver's Licenses and
Identification Cards are Manufactured and Produced
N. State Certification Process; Compliance Determinations
[[Page 5273]]
O. Driver's Licenses and Identification Cards that Do Not Meet
the Standards of the REAL ID Act.
P. Section 7209 of the Intelligence Reform and Terrorism
Prevention Act of 2004
Q. Responses to Specific Solicitation of Comments
V. Regulatory Analyses
A. Paperwork Reduction Act
B. Economic Impact Analyses
C. Executive Order 13132, Federalism
D. Environmental Impact Analysis
E. Energy Impact Analysis
F. Executive Order 13175, Tribal Consultation
I. Background
A. Statutory Authority and Regulatory History
This final rule establishes minimum standards for State-issued
driver's licenses and identification cards that Federal agencies can
accept for official purposes on or after May 11, 2008, as required
under the REAL ID Act of 2005. See, Public Law 109-13, 119 Stat. 231,
302 (May 11, 2005) (codified at 49 U.S.C. 30301 note) (the Act).
During the terrorist attacks on the United States on September 11,
2001, all but one of the terrorist hijackers acquired some form of
identification document, some by fraud, and used these forms of
identification to assist them in boarding commercial flights, renting
cars, and other necessary activities leading up to the attacks. See,
The 9/11 Commission Report, Final Report of the National Commission on
Terrorist Attacks upon the United States (July 2004) (9/11 Commission
Report), p. 390. The 9/11 Commission recommended implementing more
secure sources of identification for use in, among other activities,
boarding aircraft and accessing vulnerable facilities. In its report,
the Commission stated:
Secure identification should begin in the United States. The
federal government should set standards for the issuance of birth
certificates and sources of identification, such as driver's
licenses. Fraud in identification documents is no longer just a
problem of theft. At many entry points to vulnerable facilities,
including gates for boarding aircraft, sources of identification are
the last opportunity to ensure that people are who they say they are
and to check whether they are terrorists.
Id. at 390.
Congress enacted the Act in May 2005, in response to the 9/11
Commission's recommendations.
Under the Act, Federal agencies are prohibited, effective May 11,
2008, from accepting a driver's license or a State-issued personal
identification card for an official purpose unless the issuing State is
meeting the requirements of the Act. ``Official purpose'' is defined
under Sec. 201 of the Act to include access to Federal facilities,
boarding Federally-regulated commercial aircraft, entry into nuclear
power plants, and such other purposes as established by the Secretary
of Homeland Security. Undoubtedly, the most significant impact on the
public of this statutory mandate is that, effective May 11, 2008,
citizens of States that have not been determined by DHS to be in
compliance with the mandatory minimum requirements set forth in the
REAL ID Act may not use their State-issued driver's licenses or
identification cards to pass through security at airports. Citizens in
this category will likely encounter significant travel delays.
The Act authorizes the Secretary of Homeland Security, in
consultation with the States and the Secretary of Transportation, to
promulgate regulations to implement the requirements under this Act.
Section 205(b) of the Act further authorizes the Secretary of Homeland
Security to grant extensions of time to meet the minimum standards of
the Act when States provide adequate justification for noncompliance.
The Act does not, however, give DHS the authority to waive any of the
mandatory minimum standards set forth in the Act. Those mandatory
provisions are set forth below.
Section 202(b) of the Act directs that REAL ID-compliant licenses
and identification cards must include the following information:
(1) The person's full legal name, date of birth, and gender;
(2) The person's driver's license or identification card number;
(3) A digital photograph of the person;
(4) The person's address of principal residence;
(5) The person's signature;
(6) Physical security features designed to prevent tampering,
counterfeiting, or duplication of the driver's licenses and
identification cards for fraudulent purposes; and
(7) A common machine-readable technology, with defined minimum
elements.
Section 202(c) of the Act also mandates certain minimum standards
that States must adopt when issuing driver's licenses and
identification cards intended for use for official purposes (referred
to as REAL ID-compliant cards). Those standards include, but are not
limited to, the following:
The State shall require, at a minimum, presentation and
verification of (1) A photo identity document (except that a non-photo
identity document is acceptable if it includes both the applicant's
full legal name and date of birth); (2) documentation showing the
applicant's date of birth; (3) proof of the person's Social Security
Number (SSN) or verification that the applicant is not eligible for a
SSN; and (4) documentation showing the applicant's name and address of
principal residence. Sec. 202(c).
The State shall require valid documentary evidence that
the applicant is lawfully present in the United States. Such evidence
shall include documentary evidence that the applicant: (1) Is a citizen
or national of the United States; (2) is an alien lawfully admitted for
permanent residence or temporary residence in the United States or
pending application for same; (3) has conditional permanent resident
status in the United States or pending application for such status; (4)
has an approved application for asylum in the United States, a pending
application for asylum, or has been admitted to the United States in
refugee status; (5) was lawfully admitted to the United States using a
valid, unexpired nonimmigrant visa; (6) has a pending or approved
application for temporary protected status in the United States; or (7)
has approved deferred action status. Sec. 202(c)(2)(B).
States must establish procedures to verify each document
required to be presented by the applicant. The State also shall have
entered into a memorandum of understanding (MOU) with DHS to use the
Systematic Alien Verification for Entitlements (SAVE system) to verify
the lawful status of an applicant, other than a U.S. citizen. Sec.
202(c)(3)(C).
States also must confirm with the Social Security
Administration (SSA) that the SSN presented by an applicant (as
required under Sec. 202(c)(1)(C)) is registered to that person. Sec.
202(d)(5).
States must ensure the physical security of facilities
where driver's licenses and identification cards are produced; and the
security of document materials and papers from which driver's licenses
and identification cards are produced. Sec. 202(d)(7).
All persons authorized to manufacture or produce cards to
appropriate security clearance requirements. Sec. 202(d)(8).
Physical security features on the driver's licenses and
identification cards designed to prevent tampering, counterfeiting, and
duplication of the documents for a fraudulent purpose. Sec. 202(b)(8).
The Act also permits a State otherwise in compliance with the Act
to issue driver's licenses and identification cards that do not conform
to the Act's
[[Page 5274]]
requirements. See Sec. 202(d)(11). Federal agencies, however, cannot
accept such driver's licenses and identification cards for an official
purpose and States must ensure that such cards or licenses must state
on their faces that a Federal agency may not accept it for an official
purpose. See Sec. 202(d)(11)(A). States also must use a unique design
or color indicator so that it is readily apparent to Federal agency
personnel that the card is not to be accepted for an official purpose.
See Sec. 202(d)(11)(B).
The Act requires DHS to determine whether a State is meeting the
Act's requirements based upon certifications submitted by each State in
a manner prescribed by DHS.
II. Discussion of Final Rule
DHS published an NPRM on March 3, 2007, proposing requirements to
meet the minimum standards required under the Act. The proposed
requirements included information and security features that must be
incorporated into each card; application information to establish the
identity and immigration status of an applicant before a card can be
issued; and physical security standards for facilities where driver's
licenses and identification cards are produced. For additional
information, please see the NPRM at 72 FR 10820.
DHS received over 21,000 comments on the NPRM and supporting
regulatory evaluation during the sixty-day public comment period for
this rulemaking action. Responses to those comments are set forth in
Section IV of this final rule. This final rule implements the
requirements of the Act, but with significant changes from the NPRM as
a result of public comment, as discussed below.
As discussed above, effective May 11, 2008, Federal agencies are
prohibited from accepting for official purposes state-issued driver's
licenses or identification cards unless an issuing State certifies, and
DHS determines, that it has met the mandatory minimum requirements of
Sec. 202 of the REAL ID Act. Several States have implemented--or are
working to implement--legislation prohibiting their Departments of
Motor Vehicles (DMVs) from complying with the requirements of the Act
or any related implementing regulations issued by DHS. DHS wants to
make clear that effective May 11, 2008, individuals from States who
have not obtained an extension of the compliance date from DHS, or who
have not submitted a Compliance Package to DHS under the deadlines
provided in this final rule, will not be able to use their State-issued
license for federal official purposes, including for identification to
board a commercial airplane. Residents of States that do choose to
comply, however, through submission of their Compliance Plan or a
timely-filed request for an extension, will be able to continue to use
their current license to board commercial aircraft (and for other
official purposes) through December 1, 2014. Effective December 1,
2014, Federal agencies will refuse to accept non-REAL ID-compliant
driver's licenses from all persons born before December 1, 1964 (i.e.
under the age of fifty). Effective December 1, 2017, anyone seeking to
use a State-issued driver's license or identification card for official
purpose, including boarding of commercial aircraft, must have a REAL
ID-compliant card.
A. Extension of Deadlines
Under section 205(b) of the Act, the Secretary of Homeland Security
is authorized to grant extensions of the May 11, 2008 compliance date
to those States who provide adequate justification for their inability
to comply by the statutory deadline. On March 1, 2007, the Secretary of
Homeland Security announced, in conjunction with the release of the
NPRM, that the Department would grant extensions to all States
requesting extensions, not to exceed December 31, 2009. In the NPRM,
DHS proposed that States that would not be able to comply by May 11,
2008, should request an extension of the compliance date no later than
February 10, 2008, and the proposal encouraged States to submit
requests for extension as early as October 1, 2007. Under this final
rule, States must file requests for an initial extension no later than
March 31, 2008. That initial extension would expire on December 31,
2009. Pursuant to Sec. 37.55 of this rule, States must submit requests
for extensions to the REAL ID Program Office. Contact information is
provided in the ``For Further Information'' section of this rule.
Requests for extension must be submitted from the highest level
executive official in the State overseeing the DMV to the REAL ID
Program Office.
DHS received numerous comments from States arguing that the lack of
a centralized verification system would make it impossible for most, if
not all, States to comply with the minimum statutory requirements by
December 31, 2009. DHS recognizes the difficulty that many States may
have in meeting the statutory requirements under the Act, but
emphasizes that the Department has a critical responsibility to ensure
that identification documents used to board commercial air carriers or
access Federal buildings are secure documents and adequately prevent
persons from circumventing Federal security and screening requirements
by use of false or fraudulent identification.
In balancing the operational needs of the States against the
security responsibilities of DHS and the Federal Government, DHS has
decided to allow States to obtain an extension beyond December 31,
2009. DHS, however, will only grant a second extension to States that
demonstrate that they have achieved certain milestones towards
compliance with the Act and the final rule. States unable to
demonstrate this progress will not be able to receive an additional
extension. DHS has identified eighteen milestones, captured in the
``Material Compliance Checklist,'' that States must certify they have
met in order to obtain an extension of the compliance deadline beyond
December 31, 2009. The Material Compliance Checklist is available at
DHS' Web site at www.dhs.gov. The eighteen milestones are all mandatory
requirements under the Act; one of the most important ones, however, is
the State's ability to verify that the applicant is lawfully present in
the United States. Any second extension will terminate effective May
11, 2011, at which time, as discussed above, the State must begin
issuing fully compliant REAL ID cards.
B. Phased Enrollment Periods
DHS initially proposed that States determined by DHS to be in
compliance with the Act and the final rule would have until May 11,
2013 to replace all driver's licenses and identification cards with
REAL ID-compliant cards. Under the NPRM, licenses intended for Federal
official purposes issued by States on or after May 11, 2008 and
determined by DHS to be in compliance with the Act and this final rule
would be REAL ID-compliant, and the State would have worked to replace
existing licenses, through standard renewal or replacement processes no
later than May 11, 2013. Until that phased-in enrollment period
concluded on May 11, 2013, Federal agencies would accept from residents
of compliant States both REAL ID-compliant licenses dated on or after
May 11, 2008 or standard licenses issued before May 11, 2013. The NPRM
also proposed the same phase-in period for States requesting initial
extensions of the compliance date until December 31, 2009, i.e., States
receiving an extension would still have until May 11, 2013 to enroll
their current drivers.
During the public comment period, a number of States and State
associations noted that States obtaining an initial extension of the
compliance date until
[[Page 5275]]
December 31, 2009, would still be required to enroll their existing
driver population (estimated to be approximately 240 million) by May
11, 2013. This would essentially halve the phase-in period and create
an untenable burden and increased costs on States who were committed to
complying with the REAL ID requirements. Several commenters suggested
that DHS consider a risk-based approach that would permit States and
DMVs to defer enrollment of a proportion of the population that
statistically may present a lower risk of obtaining false or fraudulent
identification to, among other potential purposes, circumvent
Transportation Security Administration (TSA) passenger screening
procedures and requirements or to access Federal buildings with a false
identification.
DHS recognizes the significant operational impact on State DMVs if
all licenses issued by a State were required to be REAL ID-compliant by
May 11, 2008, or May 11, 2013; and believes that an age-based approach
is the best way to balance operational concerns against security
concerns. DHS has considered the best methodology to target preventive
efforts against an individual attempting to fraudulently obtain an
identification document to gain access to a Federal facility, nuclear
facility, or commercial aircraft. In the absence of threat reporting
about particular individuals, to which the DMVs will not have access,
DHS has determined that the most appropriate substitute criteria to
apply is age.
DHS has determined that the most logical option to reduce the
significant operational burden on States is to allow States to divide
their license-bearing population and re-issue REAL ID-compliant
licenses through a two-phased enrollment. This approach would reduce
the operational burdens on States, which otherwise would have to
reissue licenses to the majority of their license-bearing populations
within two years for States requiring and obtaining extensions until
May 11, 2011. DHS also has determined that a phased enrollment based on
age is consistent with the intent of the REAL ID Act by focusing the
first phase of enrollment on the population of persons that may have a
higher propensity to obtain and use fraudulent identification.
To determine a logical age to use as a cut-off point for a two-
phased enrollment, DHS determined, based on comments received and
statistical analysis of incident reports obtained from the TSA, that
solely for purposes of establishing an age-based enrollment for
compliance with the REAL ID Act, the logical point of division would be
to allow States to defer enrollment for persons over the age of fifty.
The statistical analysis supporting this determination was conducted by
DHS utilizing TSA incident reports identifying persons arrested or
detained for use of fraudulent identification at TSA screening areas
during the period from October 1, 2004 through July 25, 2007. This
analysis roughly indicates that persons over the age of fifty were less
likely to be involved in TSA-related law enforcement incidents
involving false or fraudulent identification. More specific information
on the methodology underlying this assessment is provided in Section
IV.C. below.
Accordingly, DHS, under this final rule, has developed a phased
enrollment approach for States who have certified compliance with the
requirements of the Act and this final rule, and have been determined
by DHS to be in compliance with the Act and this rule. Under this final
rule, once a State certifies compliance with the REAL ID Act and this
final rule, the State may focus enrollment first on issuing REAL ID-
compliant cards to individuals born after December 1, 1964 (those who
will be less than fifty years of age as of December 1, 2014, the date
of full compliance). States may delay the full enrollment of persons
born on or before December 1, 1964, for three additional years, until
December 1, 2017.
DHS believes that this approach balances the security objective of
improving the reliability of identification documents presented for
official purposes, including the boarding of commercial aircraft, with
the needs of the States to spread out their compliance costs over a
greater period of time and to obtain the necessary legal and budgetary
approval from within their States to comply with the regulations. DHS
also notes that States will be able to reduce their overall compliance
costs based on phased enrollment approach. The economic analysis is
presented in section V. of this rule.
C. Verification and Data Exchange Systems Architecture
The REAL ID Act requires States to verify supporting documents with
the issuing agency. Because our population moves freely among the
States, each State will need the capability to verify documents from
issuing agencies in all other States. Although the Act places this
burden on the States, DHS has worked to consider several technical
solutions that would provide States with this capability. DHS has
initiated a verification systems design project to define the
requirements for the optimal system for REAL ID. DHS is working with
the American Association of Motor Vehicle Administrators (AAMVA), the
Department of Transportation (DOT), the Social Security Administration,
the Department of State (DOS), the National Association of Public
Health Statistics and Information Systems (NAPHSIS), and State
representatives to define requirements for a ``hub'' based network and
messaging systems to support the requirements of REAL ID. DHS is
assessing the extent to which the current AAMVA network,
communications, and systems architecture can serve as a platform for
deployment of REAL ID data verification and State-to-State data
exchanges.
The backbone of this hub would be AAMVAnet, the network system that
AAMVA operates to facilitate data verification for State DMVs. DOT is
currently funding an ongoing project to upgrade the capability of
AAMVAnet by building in such security features as end-to-end data
encryption and Federal Information Security Management Act-based
security standards. The DOT-funded project will potentially expand
AAMVAnet's capability to provide the capacity to handle the increased
transaction volume for the required State-to-State transactions.
Finally, the AAMVAnet backbone resides on a private network with no
connectivity to the Internet. It has been, and will continue to be, a
highly secure transportation layer for all communications between
States and agency databases.
With respect to data verification, AAMVAnet already supports
verification of both social security numbers (SSNs) and birth
certificates. These application systems enable States to query the
Social Security On-Line Verification (SSOLV) database managed by the
Social Security Administration (SSA) and the Electronic Verification of
Vital Events (EVVE) system owned and operated by NAPHSIS. While 47
States currently verify SSNs through AAMVAnet, verification of birth
certificates is limited to those States whose vital events records are
available online. In both cases only State DMVs can initiate queries;
personal data are verified and not exchanged; and no personal
information is created, modified, or stored as a result of the
transaction. Working with both SSA and NAPHSIS, DHS is identifying
requirements for enhancements to both application systems.
U.S. Citizenship and Immigration Services (USCIS) is working to
modify the SAVE system to allow States to
[[Page 5276]]
facilitate their ability to meet the verification requirements under
the Sec. 202(c)(3) of REAL ID Act, a requirement that States routinely
utilize the SAVE system to verify the lawful status of REAL ID card
applicants. Currently, a majority of States have already entered into
Memoranda of Understanding with USCIS to access and use SAVE, as
required under section 202(c)(3) of the Act. USCIS is developing a
standard user interface to meet all State DMV business process needs
for immigration-related transactions and to draft requirements for a
common messaging system that takes advantage of the same AAMVAnet
standards and infrastructure that support State DMV queries against
SSOLV, EVVE, and other Federal and State databases.
DHS also is exploring the alternative of using the Commercial
Drivers Licensing Information System (CDLIS) as the baseline platform
for supporting the State-to-State data exchange requirements of the
REAL ID Act and regulation. CDLIS currently supports queries to every
State DMV every time an individual applies for a driver's license in
any State or the District of Columbia. CDLIS already meets the data
exchange requirements of REAL ID for those drivers holding commercial
driver's licenses. Moreover, CDLIS is a secure, State-governed system
that stores the minimum amount of personal information possible to
facilitate the routing of queries and responses between States. DHS is
considering an effort to define system requirements for REAL ID State-
to-State data exchanges based upon the CDLIS model or platform. This
project would define a systems architecture for REAL ID State-to-State
data exchanges that would leverage the ongoing CDLIS modernization
project led by the DOT. DHS will work closely with DOT to build upon
current and planned systems designs to meet the requirements of REAL
ID.
D. Marking of Compliant REAL ID Documents
Section 202(d)(11) of the Act allows States to issue, in addition
to REAL ID-compliant licenses, identification cards not intended to be
accepted by Federal agencies for official purposes. Under the Act,
however, any such card must clearly state on its face that it may not
be accepted by any Federal agency for federal identification or any
other official purpose; and States must use a unique design or color
indicator to alert Federal agencies and other law enforcement that it
may not be accepted for any such purpose. DHS will leave the types of
marking and unique coloring to the discretion of the individual States,
subject to DHS approval as part of the Compliance Package to ensure
that DHS officials, such as TSA screeners, can adequately distinguish
between REAL ID-compliant cards and those not intended for official
purposes.
Based on an analysis of feedback from several commenters, DHS,
however, has determined it would be in the best interest of the
nation's security for States to place a security marking on licenses
and identification cards to allow Federal agencies to more readily
determine which States are issuing licenses or identification cards
that are REAL ID-compliant or have been determined to be ``materially
compliant'' (including verifying that REAL ID applicants are lawfully
present in the United States). DHS will work with States concerning
marking compliant licenses and identification cards that indicate
whether the document was issued in material compliance of the Act's
requirements, or in full compliance of the Act's requirements as set
forth in Subpart E of this rule.
E. Prohibition on States Issuing REAL ID Cards to Persons Who Hold a
Driver's License in Another State
Section 202(d)(6) of the Act requires that States ``refuse to issue
a driver's license or identification card to a person holding a
driver's license issued by another State without confirmation that the
person is terminating or has terminated the driver's license.'' In the
NPRM, DHS maintained that we are not regulating the issuance of
driver's licenses beyond that required under the REAL ID Act, but
encourage the policy of ``one driver, one license.'' Following comments
on the rule, however, DHS believes it is necessary to clarify that the
REAL ID Act mandates that a State cannot issue a REAL ID license to a
person who is holding a license issued by another State or to an
individual who already holds a REAL ID card. (A person can, however,
hold a REAL ID card and another non-REAL ID, non-driver's license
identification card). DHS, therefore, revised Sec. 37.33, moving that
provision to a separate section (Sec. 37.29), to clarify and emphasize
that a State cannot issue a REAL ID card without verifying that an
applicant does not hold another REAL ID card or a driver's license from
another State, or if the applicant holds another driver's license, that
he or she is taking steps to terminate that license. See Sec.
202(d)(6) of the Act.
F. Western Hemisphere Travel Initiative
Section 7209 of the Intelligence Reform and Terrorism Prevention
Act of 2004, as amended,\1\ requires the Secretary of Homeland
Security, in consultation with the Secretary of State, to develop and
implement a plan to require travelers entering the United States to
present a passport, other document, or combination of documents, that
are ``deemed by the Secretary of Homeland Security to be sufficient to
denote identity and citizenship.'' This DHS and Department of State
(DOS) initiative is referred to as the Western Hemisphere Travel
Initiative (WHTI). DHS and DOS have issued several regulations
implementing WHTI travel document requirements at air ports of entry,
and proposing documents acceptable for cross border travel at land and
sea ports-of-entry. For additional information on the WHTI rulemaking
actions, please see 71 FR 68411 (Nov. 24, 2006) (final air rule) and 72
FR 35087 (proposed land and sea rule).
---------------------------------------------------------------------------
\1\ Pub. L. 108-458, as amended, 118 Stat. 3638 (Dec. 17, 2004).
---------------------------------------------------------------------------
As part of WHTI, the Secretary of Homeland Security has the
authority to designate alternative documents that denote identity and
citizenship that can be used for cross border purposes at land and sea
ports-of-entry. In determining which documents should provide a
convenient, low-cost alternative for U.S. citizens, particularly those
residing in border states, DHS notes that State DMVs are well
positioned to provide an enhanced driver's license (EDL) to meet this
need. DHS is coordinating efforts to ensure that an EDL, developed to
meet the requirements of WHTI, will adopt standards that REAL ID
requires, as they are defined through the REAL ID rulemaking process.
For an EDL to be an acceptable WHTI document for land and sea cross-
border travel, it can only be issued to U.S. citizens, denote such
citizenship on the face of the card, and must include technologies that
facilitate electronic verification and travel at ports-of-entry. DHS
will continue to work closely with interested states to develop
driver's licenses that can meet both REAL ID and WHTI requirements.
The requirements outlined above constitute substantive changes
between the March 2007 proposed rule and this final rule. A more robust
discussion of this final rule and DHS's responses to comments are set
forth below.
[[Page 5277]]
III. Section-By-Section Analysis of the Final Rule
Section 37.1 Applicability
DHS added a reference to Sec. 202(d)(11) of the REAL ID Act to
make it clear that the provisions of this rule apply to States who
intend to issue driver's licenses or identification cards that can be
accepted by Federal agencies for official purposes and that intend to
be determined by DHS to be in compliance with section 202 of the REAL
ID Act.
Section 37.3 Definitions
DHS added a definition of ``full compliance'' to clarify the
relationships between full compliance with the requirements of Subparts
A through D, and ``material compliance'' with the procedures in Subpart
E that allow a State to file for and receive an extension.
DHS refined the definition of ``covered employees'' in this final
rule to clarify that employees refers to DMV employees.
DHS added a definition of ``duplicate'' for driver's licenses and
identification cards issued subsequent to the original license or card
bearing the same information and expiration date as the original.
DHS has modified the definition of ``full legal name'' to bring it
closer to existing name conventions used by the Social Security
Administration, the Department of State, and other issuers of source
documents.
DHS has added the definition of ``material change'' to provide
clarity for States as to when an individual may be required to make an
in-person visit to a DMV office to obtain an updated REAL ID driver's
license or identification card when certain information changes from
the time they obtained their previous REAL ID document. For the purpose
of this final rule, a change of address of principal residence does not
constitute a material change.
DHS has added a definition of ``material compliance'' as a basis
for establishing the benchmarks that DHS will use to evaluate State
progress toward meeting the requirements of this rule. States in
material compliance with Subparts A through D of this rule will be
granted a second extension until no later than May 10, 2011 to meet all
the requirements of this rule.
DHS maintained the same definition of ``official purpose'' as that
proposed in the NPRM and set forth in the REAL ID Act; to mean
``accessing Federal facilities, boarding Federally-regulated commercial
aircraft, and entering nuclear power plants.''
DHS also added a definition for ``personally identifiable
information'' as it pertains to these rules and the REAL ID Act.
DHS changed the definition of ``principal residence'' from the
location where a person has his or her true, fixed, and permanent home
and intends to return, to the location where a person currently resides
even if this location is temporary, in conformance with the residency
requirements of the State issuing the driver's license or
identification card, if such requirements exist. DHS made this change
in response to comments that the prior definition would unfairly
prevent persons such as military personnel or students residing
temporarily in a State from obtaining a driver's license or
identification card from that State.
DHS revised the definition of ``sexual assault and stalking'' to
incorporate the meaning of these terms given by State laws.
DHS broadened the scope of the term ``State address
confidentiality'' to allow States to cover not only victims of violence
or assault, but also ``other categories of persons'' that may need to
have their addresses kept confidential.
DHS added a comprehensive definition of the term ``verify'' to
clarify the scope of application in the rule. The definition makes it
clear that verification includes two interrelated procedures: (1)
inspection to see if the document is genuine and has not been altered,
and (2) checking to see that the identity data on the document is
valid.
Section 37.5 Validity Periods and Deadlines for REAL ID Driver's
Licenses and Identification Cards
The proposed language in Sec. 37.5 required that all cards issued,
reissued, or renewed after May 11, 2008 had to be REAL ID-compliant by
May 11, 2013 in order to be acceptable by Federal agencies for official
purposes. As discussed in Section II above and the responses to
comments in Section IV below, DHS has determined that the following
enrollment schedule will apply under this final rule: (1) Effective
December 1, 2014, Federal agencies will be prohibited from accepting
State-issued driver's licenses or identification cards for official
purpose from individuals born after December 1, 1964, unless the
individual presents a REAL ID-compliant card from a State that has
certified and that DHS has determined compliance with the REAL ID Act
and this final rule; and (2) effective December 1, 2017, Federal
agencies will be prohibited from accepting for official purposes from
any individual (regardless of age) State-issued driver's licenses or
identification cards that are not REAL ID-compliant.
Section 37.11 Application and Documents the Applicant Must Provide
DHS proposed, in the March NPRM, that States must maintain
photographs of individuals who applied for, but ultimately were denied
a REAL ID card by the State, for up to one year. However, DHS also
proposed that States must maintain photographs of persons denied REAL
ID cards based on suspected fraud for ten years and reflect in the
State's records that a driver's license or identification card was not
issued by the State because of suspicions of fraud. In response to
comments, this final rule was amended to provide a uniform photograph
retention provision of five years for persons who are denied a REAL ID
card, regardless of the reason that the State denies issuance of a REAL
ID card. DHS has also added a provision requiring States to retain the
photo for two years after expiration of the card to allow individuals
to renew licenses after they have expired.
The NPRM also proposed to require, under Sec. 37.11(b), that
States retain with applicant source documents the required signed
declaration that the information presented by the applicant is true and
accurate. This final rule no longer requires States to retain the
required declaration with the applicant's source documents, the
retention of which is mandated under Sec. 202(d)(2) of the Act.
Instead, recognizing the operational burdens on the States, DHS is
exercising its discretion on this matter to require only that the
declaration must be retained by States consistent with applicable State
document retention requirements or policies.
Under Sec. 37.11(c), DHS has added a provision that would allow
DHS to change the list of documents acceptable to establish identity
following publication of a notice in the Federal Register.
DHS also has provided States a broader latitude to accept documents
other than documents issued by a Federal or State-level Court or
government agency to establish a name change. Moreover, where State law
or regulation permits, the State may record a name other than that
contained in the identity document on the face of the license or card
as long as the State maintains copies of the documentation presented
pursuant to Sec. 37.31, and maintains a record of both the recorded
name and the name on the source documents in a manner to be determined
by the State.
[[Page 5278]]
The NPRM proposed, under Sec. 37.11(e), that an applicant for a
REAL ID card must provide documentation establishing a Social Security
Number (SSN) or the applicant's ineligibility for an SSN. This final
rule amends that proposed requirement to allow an applicant, if a
Social Security Administration account card is not available, to
present any of the following documents bearing the applicant's SSN: (i)
A W-2 form, (ii) a SSA-1099 form, (iii) a non-SSA-1099 form, or (iv) a
pay stub bearing the applicant's name and SSN. A State, however, must
verify the SSN pursuant to Sec. 37.13(b)(2) of this final rule.
DHS has amended proposed Sec. 37.11(f) to give States more
discretion in the acceptance of documents required to demonstrate the
applicant's principal address by removing specific requirements that
documents used to demonstrate address of principal residence be issued
``monthly'' and ``annually.''
In response to comments regarding demonstrating the applicant's
lawful status in the United States, DHS has amended Sec. 37.11(g) with
regard to which identity documents may serve as satisfactory evidence
of the applicant's lawful status. While all identity documents listed
in Sec. 37.11(c) must be verified by the State in the manner
prescribed in Sec. 37.13, State verification of some of the identity
documents also provides satisfactory evidence of lawful status.
Therefore, if the applicant presents one of the documents listed under
Sec. 37.11 (c)(1)(i)-(viii)(except for (v)), the issuing State's
verification of the applicant's identity in the manner prescribed in
Sec. 37.13 will also provide satisfactory evidence of lawful status.
State verification of the remaining identity documents listed in Sec.
37.11(c), however, does not provide satisfactory evidence of lawful
status and the applicant must provide additional documentation of
lawful status as determined by USCIS.
In response to comments on the exceptions process proposed in Sec.
37.11(h), DHS has amended this final rule to allow U.S. citizens to
utilize the process to prove lawful status. In response to comments
that it was unrealistic and too costly to require States to provide
quarterly reports analyzing the use of their exceptions process, this
proposed requirement has been replaced with a requirement that States
must conduct a review of the DMV's use of the exceptions process and
submit the report to DHS as part of their certification package per
Sec. 37.55. Section 37.11(h) has also reduced the information required
to be maintained by the State when the exceptions process is used.
Section 37.13 Document Verification Requirements
Based on numerous comments and ongoing State DMV programs, the rule
now includes the provision that the State must make reasonable efforts
to ensure that the person has not been issued identification documents
in multiple or different names. Identified by several responders as the
top priority for reducing the number of fraudulent licenses issued,
this requirement has been reformulated and moved from Sec. 37.11 to
37.13.
In response to concerns that a number of the verification systems
contained in the proposal would not be operational by the verification
deadlines, the final rule gives States more flexibility in verifying
documents and identity data.
DHS added language that provides that nothing in this section
precludes a DMV from issuing an interim license or a license under
Sec. 202(d)(11) of the Act to permit an individual to resolve any non-
match issue, but clarifies that such cards cannot be accepted for
official purposes.
Section 37.15 Physical Security Features for the Driver's License or
Identification Card
DHS has deleted the proposed card design standards in response to
comments which stated that the standards were an undue burden on the
States. DHS has added language that States must conduct a review of
their card design and submit a report to DHS as part of its
certification package that indicates the ability of the designs to
resist compromise and document fraud attempts.
Section 37.17 Requirements for the Surface of the Driver's License or
Identification Card
In response to comments that some States allow a name other than
the full legal name on the identity document to be on the surface of
the license, this section has been amended to require full legal name
as demonstrated on the applicant's identity document, but an individual
may establish his or her name with other documentation where State law
or regulation permits, as long as the State maintains copies of the
documentation presented pursuant to Sec. 37.31 and maintains a record
of both the recorded name and the full legal name on the identity
document in a manner to be determined by the State.
Under Sec. 37.17(d), the unique license or card identification
number must only be unique to each license or card holder within the
State and not unique across all the States and other covered
jurisdictions.
With regard to full facial digital photographs pursuant to Sec.
37.17(e), DHS has clarified the discussion to bring it into closer
compliance with DHS, Federal and national standards. Language was added
that allows photographs to be in black and white or color.
To provide States with greater flexibility in protecting
confidential addresses, Sec. 37.17(f) contains new language that
allows the display of an alternative address on the license or card, if
a State permits this, and acceptance of an administrative order issued
by a State or Federal court to show that an individual's address is
entitled to be suppressed. States may also use an address convention
used by the U.S. Postal Service where a street number and street name
have not been assigned.
Further, Sec. 37.17(g) now requires that States establish an
alternative procedure for individuals unable to sign their names. The
requirement to use the Roman alphabet has been replaced with use of the
Latin alphabet which is more common.
In response to several comments from States and AAMVA that REAL ID-
compliant documents should be marked or ``branded'' as REAL ID-
compliant, DHS has added 37.17(n) which requires that REAL ID-compliant
licenses and identification cards bear a DHS-approved security marking
in accordance with the level of compliance with the Act.
Section 37.19 Machine Readable Technology on the Driver's License or
Identification Card
This section contains technical conforming changes to reflect the
changes made in Sec. 37.11(c)(2) allowing a name other than the full
legal name to appear on the license or card if a State law permits.
State or territory of issuance has been added to the MRZ data fields to
accommodate instances where a State may not have a residency
requirement or may allow use of an out-of-State address to receive a
license.
Section 37.21 Temporary or Limited-Term Driver's Licenses and
Identification Cards
In response to comments that the term ``temporary'' may cause
confusion under current terminology practices with some DMVs, this
section adds new terminology and now refers to such licenses/cards as
``limited-term or temporary.'' DHS also added language that provides
that the verification of
[[Page 5279]]
lawful status for such licenses/cards may be through SAVE, or ``another
method approved by DHS.''
Section 37.23 Reissued REAL ID Driver's Licenses and Identification
Cards
In response to comments, Sec. 37.23 now provides that States may
conduct a non-in-person (i.e., remote) reissuance of a driver's license
or card if State procedures permit the reissuance to be conducted
remotely, except that a State may not remotely reissue a license or
card where there has been any material change in information since
prior issuance.
Section 37.25 Renewal of REAL ID Driver's Licenses and Identification
Cards
Section 37.25(a)(2) adds language that requires the States to
reverify SSN information to ensure that the applicant's information is
still valid. DHS has also added explicit language requiring that the
State must verify electronically information that it was not able to
verify at a previous issuance or renewal, if the systems or processes
exist to do so.
Section 37.27 Driver's Licenses and Identification Cards Issued During
the Age-Based Enrollment Period
This section has been added to affirm the acceptability of driver's
licenses and identification cards issued, reissued, or renewed prior to
the end of the age-based enrollment period. For example, if an
individual is 60 years of age and their license naturally expires in
2009, the State may issue that individual a license under that State's
current practices, and that license will be accepted for official
purposes until 2017, after which time that individual must present a
license that complies with this rule for that card to be accepted for
official purposes. As of December 1, 2014, individuals born after
December 1, 1964 (that is, under fifty years old on that date) must
present a REAL ID card when they present a State-issued driver's
license or identification for official purposes. As of December 1,
2017, all individuals presenting a State-issued driver's license or
identification card for official purposes must present a REAL ID card.
The new section reemphasizes that an individual's driver's license will
continue to be accepted for official purposes until the expiration of
the individual's applicable enrollment period.
Section 37.29 Prohibition Against Holding More Than One REAL ID Card or
More Than One Driver's License
In response to numerous comments to clarify the ``one driver one
license'' concept in the REAL ID rules, DHS has created a stand-alone
section, Sec. 37.29, that specifically states that an individual may
hold only one REAL ID card, whether it is a REAL ID identification card
or a REAL ID driver's license. In addition, prior to issuing a REAL ID
driver's license, a State that is complying with REAL ID must check
with all other States to determine if the applicant currently holds a
driver's license or REAL ID identification card in another State, and
if so, the receiving State must take measures to confirm that the
person has terminated or is terminating the driver's license or REAL ID
identification card issued by the prior State pursuant to State law,
regulation or procedure.
Section 37.31 Source Document Retention
DHS has added language to Sec. 37.31 to reiterate the requirement
that States must protect any personally identifiable information
collected pursuant to the REAL ID Act as described in the Security Plan
(Sec. 37.41).
In response to comments, DHS deleted the following requirements
from this section:
That States must replace black and white imagers with
color imagers by December 31, 2011;
That States using digital imaging to retain source
documents must use the AAMVA Digital Exchange Program or a standard
that has interoperability with the AAMVA standard;
That all images must be linked to the applicant through
the applicant's unique identifier assigned by the DMV; the amended
requirement now states that all images must be retrievable by the DMV
if properly requested by law enforcement.
DHS has also added a provision that allows States to record
information from birth certificates in lieu of retaining an image or
copy if State law permits and if requested by the applicant. This will
protect medical and other personal information not relevant to REAL ID.
Section 37.33 DMV Databases
DHS changed the title of this section from ``Database connectivity
with other States'' to ``DMV Databases.'' This section has also been
amended to require that the DMV database allow capture of the full
legal name and any other name recorded under Sec. 37.11(c)(2) without
truncation.
Section 37.41 Security Plan
DHS amended this section to clarify that each State submit a single
security plan to address DMV facilities involved in the enrollment,
issuance, manufacturing and production of driver's licenses and
identification cards, rather than all State DMV driver's license/
identification facilities as stated in the NPRM. This change is in
response to comments that it does not enhance overall security to
require every DMV office (which could be interpreted to include
administrative offices) to submit a security plan and individual risk
assessments.
Furthermore, in response to comments asking for clarification,
Sec. 37.41(b)(iii) now provides that the release and use of personal
information must, at a minimum, be consistent with the Driver's Privacy
Protection Act, 18 U.S.C. 2721 et seq.
This section of the final rule now indicates that the fraudulent
document training requirement would be satisfied by a fraudulent
document training program approved by AAMVA. DHS has also deleted the
requirements that the security plan contain procedures to revoke and
confiscate driver's licenses or identification cards fraudulently
issued in another State, in response to comments that States have no
authority to carry out such a requirement.
A new section has been added to Sec. 37.41 to state that the
Security Plans contain Sensitive Security Information and must be
handled and protected in accordance with 49 CFR Part 1520.
Section 37.43 Physical Security of DMV Production Facilities
This section is unchanged.
Section 37.45 Background Checks for Covered Employees
Section 37.45(d) has been amended to recognize background checks
that are similar to those required under Sec. 37.45 and that were
conducted on or after May 11, 2006, and that the DMV does not have to
check references from prior employers for individuals that have been
working with the DMV for at least two consecutive years prior to the
Act taking effect. (The Act becomes effective on May 11, 2008).
Therefore DMVs would not have to seek references from prior employers
of employees who have been with the DMV consecutively from May 11, 2006
to May 11, 2008. The final rule clarifies that the waiver provision in
Sec. 37.45(b)(1)(v) allows a waiver of requirements for the
determination of arrest status and includes circumstances where the
individual has been arrested, but no final disposition on the matter
has been reached.
[[Page 5280]]
In response to comments, DHS deleted the requirement that States
must conduct a financial history check as part of the background check
of covered employees.
Section 37.45 now requires that the State confirm the employment
eligibility of the covered employee, rather than lawful status through
SAVE, and recommends that the State participate in the USCIS E-Verify
program (or any successor program) for employment eligibility
verification.
Section 37.51 Compliance--General Requirements
DHS has modified this section in response to many comments. DHS
recognizes that States will be unable to meet all the requirements of
this rule beginning on January 1, 2010, the day after the termination
of the extension period proposed by DHS in the NPRM. For example,
requirements for State verification of source documents depend upon the
deployment of electronic systems that have not yet been developed.
Therefore, DHS proposes that States meeting key benchmarks for progress
toward compliance with the REAL ID Act be granted an additional
extension until no later than May 10, 2011 to meet all the requirements
of Subparts A through D. States seeking a second extension would submit
a Material Compliance Checklist to DHS no later than October 11, 2009,
documenting their progress in meeting the benchmark requirements.
States meeting these benchmarks would also be able to issue driver's
licenses and identification cards bearing security markings indicating
that the license was issued in conformity with REAL ID standards.
Section 37.55 State Certification Documentation
The title of the section was amended to reflect the changes to the
certification process discussed above. The required contents of the
State certification have been amended in the final rule to delete the
requirement for a copy of all statutes, regulations, and administrative
procedures and practices related to the State's implementation program.
DHS has amended the requirement that a State's governor certify
compliance to read that a State's highest level official with oversight
responsibility over the DMVs certify compliance. In addition, the
frequency of certification reporting has been modified to be similar to
the three-year intervals required by several Department of
Transportation programs. Thus, in accordance, Sec. 37.57 ``Annual
State Certifications'' has been removed.
Section 37.59 DHS Reviews of State Compliance
DHS has rephrased the information requirement in the section to
require any reasonable information pertinent to determining compliance
with this part as requested by DHS. Also, DHS must now provide written
notice to the State in advance of an inspection visit. The final rule
provides that, in the event of a DHS preliminary determination that the
State has not submitted a complete certification or that the State does
not meet one or more of the minimum standards for compliance under this
part, DHS will inform the State of the preliminary determination within
forty-five days. Finally, this section now includes DHS procedures for
reviewing a Material Compliance Checklist as part of the procedure for
granting States an additional extension until no later than May 10,
2011.
Section 37.61 Results of Compliance Determination
The final rule now states that DHS will determine that a State is
not in compliance when it fails to submit the certification as
prescribed or to request an extension as prescribed in the subpart.
Section 37.63 Extension of Deadline
The NPRM was not clear on the timing of submissions for requests
for extension. Although proposed regulatory text stated that requests
for extension must be submitted no later than October 1, 2007; the
preamble requested submission of compliance plans and strongly
encouraged ``States to communicate their intent to certify compliance
or request an extension by October 1, 2007.'' We clarify the deadline
for submission of requests for extension in the final rule, providing
that requests for extension must be submitted to DHS ``no later than
March 31, 2008.'' DHS will notify a State of its acceptance of the
extension within forty-five days of receipt.
This section now includes the procedure for requesting an
additional extension until no later than May 10, 2011. States seeking
an additional extension shall submit a Material Compliance Checklist to
DHS no later than October 11, 2009, documenting the State's progress in
meeting certain benchmarks. States meeting the benchmarks included in
this checklist will be granted a second extension until no later than
May 10, 2011.
Section 37.65 Effect of Failure To Comply With This Part
DHS amended this section to provide that REAL ID driver's licenses
and identification cards issued by the State during the term of any
extension will continue to be acceptable for official purposes until
the card expires.
Section 37.67 Non-REAL ID Driver's Licenses and Identification Cards
This section was renumbered to Sec. 37.71, consistent with the
structure of the Part. The section was also renamed to ``Driver's
licenses and identification cards issued under Sec. 202(d)(11) of the
REAL ID Act'' to further clarify that DHS interprets this section of
the Act to apply only to States that certify and DHS determines are
compliant with the REAL ID Act, as defined by these regulations, and
that choose to also issue driver's licenses and identification cards
under the Act that are otherwise not acceptable by Federal agencies for
official purposes.
IV. Discussion of Comments
During the sixty-day comment period, DHS received over 21,000
comments on the NPRM. DHS received numerous requests to extend the
comment period past the sixty days provided in the NPRM. DHS has
carefully considered the comments and determined not to extend the
comment period for the NPRM. As discussed above, under the REAL ID Act,
Federal agencies will be prohibited from accepting driver's licenses or
other State-issued identification cards from States that are not in
compliance with the requirements of the Act by May 11, 2008, less than
one year away. Given the complexity of the Act's requirements and these
implementing regulations, extending the comment period beyond sixty
days would serve only to delay issuance of this final rule and deprive
States of the information necessary for their DMVs to begin
preparations and adjust their operations consistent with the
requirements of this final rule and the Act. Further, in addition to
the 60-day comment period, DHS provided several opportunities for
additional public participation through such events as the May 1, 2007,
public meeting in Davis, California (with participation also available
via webcast); and meetings with stakeholders. We determined that the
60-day comment period and additional DHS outreach during the comment
period provided adequate time for the public to consider and provide
meaningful comment on the NPRM.
We also received several comments that were filed well past May 8,
2007, the close of the comment period. As discussed above, given the
upcoming May 11, 2008, compliance deadline and the adequacy of the
sixty-day comment
[[Page 5281]]
period and public outreach, DHS has not accepted or considered comments
that were filed after the May 8, 2007 close of the comment period.
Because DHS did not extend the comment period, allowing some commenters
to file late--or to provide late filed supplements to their comments--
would disadvantage those commenters who did not file late and would
also have preferred additional time to file comments or amend the
comments that were filed within the deadline. Comments that were timely
filed, but not processed immediately by DHS due to technical errors by
the submitter or DHS, are not considered to have been filed late and
were considered in the development of this final rule.
A. General Comments on the Proposed Regulation
1. General Comments in Support of the Proposed Regulation
Comments: Several commenters expressed general support for the
proposed rule. Commenters wrote that the REAL ID program will provide a
measurable and positive impact on a wide range of security matters, and
that the cost estimates, methods of implementation, and the projected
time frames were reasonable. One commenter wrote that REAL ID correctly
specified a set of performance standards rather than listing static
prescriptive standards, and that enhanced document security is
essential to combat terrorists, can help improve transportation safety,
and can combat identity theft or other criminal acts.
Response: DHS agrees with these commenters, and believes that
States that fully implement these rules will improve national security
by improving the security and reliability of a key document carried by
many Americans. Both the REAL ID Act and the REAL ID regulations focus
on improving the reliability of State-issued driver's licenses and
identification cards and decreasing the likelihood that an individual
can fraudulently obtain an identity document or alter a legitimate
identity document to create a false identity. The availability of
better and more reliable security documents means that government and
law enforcement officials have a greater opportunity to prevent
terrorists and other unauthorized persons from gaining access to
commercial airplanes and Federal facilities.
2. General Comments in Opposition to the Proposed Regulation
Comment: Many commenters expressed general opposition to the REAL
ID program. General comments included the following: DHS misinterpreted
the REAL ID Act, the proposed rule is incomplete and problematic,
adequate studies have not been conducted to determine that the program
will work, the rule's requirements will lead to degradation in the
level of State DMV customer service, the rule would harm citizens'
privacy, and the rule requires additional Federal funding. Many
commenters wrote that the rule fails to provide appropriate security,
utility, or privacy and one commenter said the rule ``is inadequate to
meet the intent of the REAL ID Act and the needs of the states and
citizens of the U.S.'' Another commenter wrote that DHS ``could have
done a better job of creating a regulatory framework that does not
increase the risk of identity theft nor enable widespread governmental
and commercial tracking of U.S. residents.'' Several commenters
requested that DHS provide a revised NPRM reflecting comments and that
DHS accept at least a second round of comments before issuing a final
rule. Other commenters asked that public advocacy groups and other
stakeholders be consulted to ensure the final rule properly considers
citizen rights and interests. Several commenters, including States,
wrote that a secure identity credential could increase fraud, identity
theft, and other forms of misuse, including the ability to access
confidential information, and that many security leaks would occur. Two
commenters said the Federal government has an existing program, the
passport program, that does everything the REAL ID is supposed to
accomplish, and that it makes sense to expand the passport program
rather than revamping State driver's license requirements. Other
commenters wrote that an improved system of Social Security number
verification is a more efficient, less intrusive system for work status
verification and driver's license eligibility.
Response: DHS appreciates the many comments received; however, DHS
respectfully disagrees with the comments generally opposing the REAL ID
program. DHS believes that both DMVs and the American public will
welcome having a more secure and reliable form of identification, and
that DMVs will take the necessary steps to ensure that their customer
service efforts are not degraded as a result of the regulations. DHS
strongly disagrees with the proposition that the rules will lead to an
increase in identity theft, harm privacy, or enable the government to
track individuals in their daily lives. To the contrary, the rules
create an environment where it is far less likely that an individual
can fraudulently obtain a State-issued identity document using another
person's identity and identity documents and minimizes the possibility
that one individual can obtain identification documents in multiple
names and identities. The privacy interests of driver's license and
identification card applicants are strengthened, rather than weakened,
since this rule requires all States to protect the personally
identifiable information that DMVs collect from applicants.
Establishing minimum standards for States to issue more secure licenses
does not confer any ability on the government to monitor or track
anyone, although it does improve the ability of the government and
private sector parties to rely on the identity document an individual
presents.
DHS does not believe that additional rounds of comments on the
requirements proposed in the NPRM are necessary before issuing this
rule. Some 21,000 comments were filed in the docket covering the full
range of issues. In addition, DHS hosted a town hall meeting in
California to hear directly from the public and reconstituted the
groups that participated in the 2005 Department of Transportation-led
negotiated rulemaking committee in order to gather input and comments
directly from those groups.
DHS does not agree that a passport issued by the Department of
State fulfills the same function as a State-issued driver's license.
Individuals who have no intention of leaving the United States do not
need to obtain a passport in order to enter another country or reenter
the United States. Any of these same individuals who desire to drive
would need to obtain a driver's license.
DHS also disagrees with the comment that a Social Security number
(SSN) is an adequate substitute for the statutory requirement that an
individual have lawful status in the United States. Mere possession of
a SSN cannot replace the statutory requirement that States verify an
individual's lawful status in the United States. There are individuals
who are no longer lawfully present in the United States who have SSNs.
3. Cost Considerations
Comment: Numerous commenters questioned the anticipated costs of
the REAL ID requirements. Specifically, commenters wrote that the costs
of the REAL ID program would be ``huge,'' ``exorbitant,''
``significant,'' or ``excessive.'' Some States wrote that estimated
costs for implementing REAL ID were equal to or substantially
[[Page 5282]]
exceeded their current operating budgets for motor vehicle licensing.
One State estimated its costs for verification and re-verification will
be over $100 million in the first year; another State estimated its
costs would be $19.5 million for initial expenses and $9 million a year
for ongoing expenses. Another commenter suggested that the burden would
be particularly heavy on small States, which would be overwhelmed by
the volume of queries they would receive each day from States with
large populations and which would not have funds to improve their
systems to handle the query volume. Commenters identified several
features of REAL ID implementation that they believed would be the most
costly, including verification requirements; the requirements for
issuing driver's license and identification card renewals; background
checks for State personnel issuing cards; the need to upgrade computer
systems; hiring additional staff; and renegotiation of existing
contracts.
Response: DHS has examined both the budgetary impacts and economic
impacts of the proposed rule and understands the significance of these
costs for States. DHS has also reviewed various options that would
reduce the disproportionate burden upon small states but have not found
a feasible alternative that would provide the same benefits but at a
lower cost.
DHS has also reviewed many of the high-cost options of the proposed
rule and has significantly reduced both the infrastructure costs and
the costs of reenrollment for States. As stated in other parts of this
document, DHS agrees with an age-based approach and concludes that
there is a higher risk of individuals under age fifty obtaining
fraudulent identification than there is for those over this age limit.
Comment: Commenters wrote that DHS had overestimated the benefits
of REAL ID and that the potential benefits did not justify the high
cost of implementation. One commenter stated that cost estimates are
low given that DHS has ``no clear idea of how to implement the REAL ID
Act's dictates and has made some unrealistic calculations.''
Response: DHS understands that the benefits of the proposed rule on
REAL ID are difficult to quantify and that there are some imperfections
in the methodology. Commenters stated that DHS has overestimated the
benefits when in fact it developed a ``break-even analysis.'' DHS
estimated that if the requirements of the proposed rule lowered by
0.061% per year the annual probability of a terrorist attack that
caused both immediate and longer run impacts then the quantified
benefits of the REAL ID regulation would be positive.
This ``break-even'' analysis was based on the rule having an impact
on the annual probability of the U.S. experiencing 9/11 type attacks in
the ten years following the issuance of the rule. DHS believes that the
probability and consequences of a successful terrorist attack cannot be
determined for the purposes of this analysis. However, it was not
necessary to assume that there was (or is) a probability of being
attacked in any particular year. Instead, the analysis examined the
reduction in the probability of an attack so that the expected cost of
REAL ID equaled the expected value of the benefits. Since it is
extremely difficult to predict the probability and consequences of a
hypothetical terrorist attack, DHS asked what impact would the proposed
and final rule have to have on the annual probability of experiencing a
9/11 type of attack in order for the final rule to have positive
quantified net benefits. The analysis does not assume that the United
States will necessarily experience this type of attack, but rather is
attempting to provide the best available information to the public on
the impacts of this rule.
Comment: Many commenters wrote that the cost of REAL ID would be
borne initially by the States, and then passed on to those States'
citizens in the form of higher fees for driver's licenses, higher
taxes, or reduced services. Commenters wrote that higher fees would be
paid by persons who need driver's licenses but who do not fly, enter
Federal buildings, or go into nuclear facilities. Another commenter
wrote that citizens would incur large costs to acquire the source
documents needed to obtain REAL ID cards. One commenter wrote that the
costs of REAL ID would drain resources from other vital public
services. One commenter wrote lost income would be borne by commercial
drivers and motor carriers domiciled in non-compliant States, and that
the costs to commercial drivers to obtain new REAL ID commercial
drivers licenses may result in reduced trucking services to Federal
facilities. One commenter wrote that the DHS cost estimate of $7.88
billion over ten years would amount to a cost of $96.25 per REAL ID
holder.
Response: DHS acknowledges the concerns of the individuals who
commented that this rule will impose significant costs and believes
that a large portion of the costs will be passed on from the States to
the States' REAL ID applicants in the form of higher fees for driver's
licenses. But each citizen in the United States, whether he or she has
a driver's license or not will be receiving security benefits as a
result of this rulemaking. For example, the 9/11 Commission believes
that acceptable forms of identification will help ensure that people
are properly identified. The Commission's report, which informed the
basis for the REAL ID Act of 2005 said that: ``At many entry points to
vulnerable facilities, including gates for boarding aircraft, sources
of identification are the last opportunity to ensure that people are
who they say they are and to check whether they are terrorists.''
DHS agrees that some applicants might incur added costs to acquire
the source documents needed to obtain REAL ID cards but, overall, DHS
has attempted to minimize the potential added costs while remaining
true to the intent of the Act. People are being provided ample time to
acquire any source documents that they might not have so the potential
added costs will be lessened should they take advantage of this
flexibility. Consequently, the added costs are expected to be small.
With regards to commercial drivers and motor carriers domiciled in
non-compliant States, the commenter did not provide any useful cost
data that could be included in the regulatory analysis. This was
probably due to the fact that it is impossible to estimate at this time
how many states would choose to not participate.
Comment: Several States wrote that the costs of REAL ID would
divert money from other homeland security projects whether or not the
States diverted a portion of the Homeland Security Grant Program
funding, as DHS would allow them to do. States that raised the
possibility of diverting twenty percent of their Homeland Security
Grant funds wrote that a diversion would be impossible immediately as
funds were already committed to other uses. One commenter called the
use of DHS grants for REAL ID ``at best, window dressing,'' and another
commenter called it ``an empty hole.'' An additional commenter
identified training and equipment for rescue and first responder
personnel as areas likely to suffer reduced funding. One commenter
wrote that if REAL ID security measures ultimately have no effect,
those spent dollars would have been spent more effectively in
maintaining and strengthening proven security measures.
Response: DHS believes that some commenters may have misunderstood
DHS's announcement about the use of State Homeland Security Grant
Program
[[Page 5283]]
(SHSGP) funds for REAL ID purposes. DHS did not suggest that SHSGP
funds would replace appropriated monies from Congress to help the
States implement the rules and comply with the REAL ID Act. DHS and the
Administration are continuing to work with Congress on the availability
of additional funding to the States for these purposes.
All homeland security funding decisions require trade-offs among
various competing priorities given the available funding. The 9/11
Commission Report noted that fraudulently-obtained identification is
equivalent to a weapon in the hands of a terrorist.
4. Unfunded Mandate Reform Act
Comment: Numerous commenters wrote that REAL ID is an unfunded
mandate. The American Association of Motor Vehicle Administrators
(AAMVA) wrote that past and proposed Federal budget submissions had
fallen far short of securing necessary funding for both the Federal
government and the States to implement REAL ID. More than twenty-seven
States called for Federal funding of the REAL ID program. Two States
suggested that Federal funding for REAL ID not be in the form of grants
for which a State would have to submit applications, but rather be
either a block grant or set-aside match for State funds. AAMVA wrote
that because eighty percent of a SHSGP funding must be passed along to
local governments, in fact a much smaller percentage of available DHS
funding will be available to each State for REAL ID implementation.
Response: As discussed elsewhere in this preamble, DHS is adopting
a more flexible approach for States to implement the requirements of
REAL ID, including a second extension period and age-based enrollment.
This approach will permit States to spread out implementation costs
over a greater period of time. Congress has appropriated $40,000,000 in
grant funding to the States. These grants will be made available to the
States through both categorical and competitive grants. In addition,
States may utilize up to 20% of their SHSGP funding. This combination
of funding, flexibility and phasing provides the relief that States and
other commenters are seeking.
5. Privacy Concerns
Comments: Several States and many other commenters expressed
concerns about threats to the privacy of State residents who apply for
REAL ID cards once the requirements are implemented. Commenters also
expressed concern for the privacy of DMV employees who would be subject
to background screening. Some commenters wrote that any privacy
requirements must adhere to those of the Driver Privacy Protection Act
and applicable State laws. Other commenters urged DHS to encourage
States to meet agreed-upon privacy and security requirements. Another
commenter asked that privacy and acceptable use policies address State
DMV information systems, equipment, employees, and contractors. One
commenter wrote that the regulations omit crucial privacy and security
protections to the point that the proposed rule conflicts with Federal
privacy and security principles. Several commenters were concerned
about privacy protection for immigrants, ethnic minorities, and others
who might be discriminated against based on use of the REAL ID.
Response: DHS understands that commenters have many concerns that
implementation of the REAL ID Act may impact the privacy of driver's
license and identification card holders and their personally
identifiable information. DHS recognizes, however, the importance of
privacy protection and has sought to address privacy in a comprehensive
manner. First, the final rule requires a minimum of information to be
collected by the States to verify identity for issuance of a license or
identification card and a minimum of information to be printed on the
card and in the machine readable zone.
Second, the final rule requires the States to file, as part of the
certification process, a security plan that explains how the State will
protect the personally identifiable information collected, stored, and
maintained in DMV records or information systems including a privacy
policy.
In addition to this rulemaking, DHS intends to issue a set of
Privacy and Security Best Practices that are built on the Fair
Information Principles and Federal Information Security Management Act
(FISMA) standards to help guide the States in protecting the
information collected, stored, and maintained pursuant to the REAL ID
Act.
DHS plans to include the following elements in its Privacy and
Security Best Practices: Issuing a clear and understandable privacy
policy to each card holder; providing individual access and correction
rights for card holders; specifying the purpose for collecting
personally identifiable information in the privacy policy and
limitation of the use to those purposes; limiting the information
collected for those purposes; limiting disclosure of the information
except to a governmental agency engaged in the performance of official
responsibilities pertaining to law enforcement, the verification of
personal identity, or highway and motor vehicle safety, or a third
party as authorized under the Driver's Privacy Protection Act;
requiring data quality standards and security safeguards to protect
against loss or unauthorized access, destruction, misuse, modification,
or disclosure; performing a Privacy Impact Assessment (PIA) to identify
and analyze how personally identifiable information related to
implementation of the REAL ID Act is collected, used, maintained, and
protected; and establishing accountability for compliance with the
State's privacy and security policies to ensure that these best
practices are fully implemented.
Finally, DHS recognizes that States will also be guided by their
own privacy laws, which may provide greater protections and are not
preempted by the REAL ID Act.
6. Concerns With the REAL ID Act Itself
Comments: Many commenters wrote that the REAL ID Act has
deficiencies that the regulatory process cannot cure. One State asked
DHS to work with States to identify problematic statutory components
and to seek Congressional amendments to facilitate a ``rational and
funded approach for implementation.'' Some commenters wrote that the
rule sets no clear minimum standards for States to follow. A commenter
wrote that there were no hearings or Senate floor debate on the REAL ID
Act; another commenter wrote that DHS held only one town hall meeting
before the comment period ended. One commenter asserted that the
development process did not recognize its tribal entitlement to
meaningful consultation regarding the REAL ID regulations.
Response: DHS was charged to issue regulations to implement the law
that Congress enacted. DHS held extensive consultations with the States
during the development of the NPRM and during the public comment
period, and the Town Hall meeting held in California during the comment
period was published in the Federal Register and available via the Web
to a national audience. Over 21,000 comments were filed in the docket.
While additional individuals may have preferred to express their
comments orally at town hall meetings, DHS believes that the scope and
breadth of the comments filed adequately informed DHS on the issues of
concern to the commenters. DHS does not believe that the tribal
consultation obligations required by Executive Order 13175 were
triggered in this rulemaking, as this final rule will not have a
[[Page 5284]]
substantial direct effect on one or more Indian tribes and will not
impose substantial direct compliance costs on Indian tribal
governments. Further, tribal governments will not be substantially
affected as tribal members are licensed through State agencies.
7. DHS Acting Outside the Scope of Its Authority
Comment: Several commenters wrote that DHS is acting outside the
scope of its authority, and cited several examples, including requiring
States to conduct various document verifications, requiring States to
implement motor vehicle facility security plans, and requiring States
to revoke licenses collected by other States. Two States commented that
requiring background checks for employees other than those engaged in
manufacturing REAL ID cards was outside the scope of authority and
interferes with employee collectively bargained rights. Several
commenters wrote that the REAL ID Act constitutes a delegation of
licensing authority to DHS. Another commenter wrote that Congress only
intended to exclude illegal aliens from eligibility to obtain a REAL
ID.
Response: The REAL ID Act provides the Secretary of Homeland
Security with authority to issue regulations necessary to implement the
requirements of the Act. DHS understands that there is a balance
between Executive discretion in interpreting the REAL ID Act through
regulation, while also respecting the State's autonomy to govern an
inherently State function--the driver's license issuance process. DHS
has attempted to preserve State autonomy wherever possible, while
remaining consistent with the Act, and believes these regulations
represent a logical interpretation of the Act and Congressional intent.
8. Constitutional Concerns
Comment: Several commenters wrote that requiring a REAL ID for
access to Federal courts may raise Constitutional issues for litigants,
jurors, attorneys, witnesses, media, and the public. Another commenter
wrote that requiring REAL ID for accessing Federal ports will have
consequences for intrastate licensees attempting to conduct business.
Response: DHS does not believe that the REAL ID Act or the
implementing regulations will impede the public's Constitutional
rights. Once REAL ID is in effect, an individual presenting a driver's
license to access a Federal courthouse must use a REAL ID driver's
license to do so. However, that individual may present other documents,
or may not be required to present identification at all, depending on
the courthouse's pre-existing identification policies.
Comment: Several commenters wrote that the REAL ID rules would
impermissibly commandeer and coerce State governments in service of a
Federal objective and would prohibit Congress from exercising its
Commerce Clause powers. One commenter wrote that courts have long
recognized that licensing of drivers is a traditional State police,
health, and safety function, and under the Tenth Amendment, such State
authority generally is not subject to encroachment by the Federal
government.
Response: DHS recognizes both the important national interest in
secure identity documents and the Federalism implications of the
policies which underpin this rule. Accordingly, DHS has welcomed and
encouraged State participation in this process and, where possible,
drafted these rules in such a way as to maximize State discretion.
Where the exigencies of national security and the need to prevent
identity fraud have militated in favor of a uniform national standard
(e.g., baseline security features on identity cards and background
check requirements), DHS has, as reflected above, consulted with States
in order to ensure that the uniform standards prescribed could be
attained by the States and would reflect the accumulated security
experience of State motor vehicles administrations.
Comment: Some commenters wrote that the REAL ID Act and regulations
violate the Constitutional right to travel freely from one State to
another by denying citizens in non-compliant States the right to board
any plane, interstate bus, or Amtrak train. Other commenters wrote that
government initiatives conditioning the ability to travel upon the
``surrender of privacy rights'' require particular scrutiny. One
commenter wrote that the situation is acute for residents of Hawaii or
Alaska who often have no choice but to travel via Federally-regulated
modes of travel.
Response: DHS does not agree that the REAL ID Act will hinder
individuals' rights to interstate travel. The REAL ID Act states that a
Federal agency may not accept State driver's licenses or identification
cards for official purposes unless a State is meeting the requirements
of the Act. At this time, the definition of ``official purposes''
includes boarding Federally-regulated commercial aircraft; no other
form of transportation is included. Moreover, travelers will be able to
use identification other than a REAL ID driver's license to board an
aircraft. While Federally-regulated commercial aircraft are a mode of
transportation, the Act only prohibit Federal agencies from accepting a
non-REAL ID license or card where a State-issued driver's license is
presented by the individual. Where individuals are allowed to board
aircraft or enter Federal facilities with documents other than a State-
issued driver's license or identification (such as a passport or
military identification card), neither the Act nor these rules change
those processes and procedures. Further, an individual with a State-
issued non-compliant driver's license or identification card may travel
interstate or intrastate in a commercial motor carrier, Amtrak train,
ship, individual automobile, or any other mode of transport aside from
Federally-regulated commercial aircraft. These transportation options
illustrate that individuals' rights to travel are not substantially
impeded.
Comment: Several commenters and States expressed concern with a
State's lack of authority to request or demand that other jurisdictions
correct erroneous records about individuals and that there is no easily
available process for resolving errors. A number of commenters wrote
that the lack of a process for correcting errors in the REAL ID Act
violates both procedural and substantive due process under the Fifth
and Fourteenth Amendments. One commenter expressed concern with the
requirements that licensing authorities maintain for ten years the name
and photograph of individuals denied licenses because of suspicion of
attempting to obtain a fraudulent license.
Response: DHS recognizes that the provision of redress is an
important element of any credentialing program. Applicants need a
process by which they can access their records, correct errors, and
obtain due process if denied a card. States already provide such a
redress process for driver's license applicants. Generally, State DMVs
direct applicants to the appropriate Federal agency, SSA, to resolve
SSN verification issues or to USCIS to resolve immigration status
verification issues. SSA and USCIS have redress programs in place to
assist individuals whose records are incomplete or inaccurate. State-
to-State record checks are also done routinely, and when an applicant
needs to access his or her out-of-State DMV record, the applicant must
make the request directly to the State DMV. DHS will work with the
States to inform the public of their ability to access and correct DMV
records as well as records
[[Page 5285]]
held in the various Federal data verification systems used to implement
this rule.
The ten-year retention period proposed in the NPRM for the
photograph and identity of individuals denied a license has been
reduced in the final rule to five years. This limited retention is
necessary to enable State DMVs to reduce the incidence of individuals
who shop among DMVs until one issues a license.
Comment: Three commenters wrote that there is no due process in
instructing DMVs to refer an applicant to the local USCIS office when
there is a non-match through SAVE. There may be no local USCIS office,
and a non-citizen has no straightforward route to review and correct
their records and USCIS lacks jurisdiction to correct errors made by
different immigration agencies. One commenter wrote that only through
the FOIA process can an immigrant gain access to his or her immigration
records, and that tens of thousands of FOIA requests are currently
pending.
Response: DHS disagrees that there is a lack of effective due
process or redress when there is a non-match through SAVE. An
individual who believes that information about him or her in SAVE is
inaccurate, can schedule an appointment online with USCIS at
www.uscis.gov and be assigned an appointment at the appropriate USCIS
office based on the individual's residential zip code. These
appointments afford an opportunity to meet with an Immigration Officer
face-to-face to resolve any non-asylum related issues relating to a
current or pending immigration case. Minimal information, including an
Alien Registration Number or Receipt Number is required to schedule an
appointment.
Comment: Several commenters wrote that REAL ID has the potential
for fostering discrimination, particularly against non-citizens. One
commenter urged DHS to ensure REAL ID-compliant cards are all accepted
equally, without ``geographic discrimination.'' One commenter wrote
that REAL ID will cause discrimination against U.S. citizens who
``look'' or ``sound'' foreign. This commenter wrote that DMV employees
must make subtle judgments about who is a citizen. Another commenter
wrote that non-citizens and foreign nationals who are in the United
States for work or study will be singled out and that renewing a
document will be difficult because DMV employees will not understand
the complexities of immigration law. One commenter urged DHS to
promulgate rules prohibiting discriminatory behavior and creating
penalties for DMV staff who discriminate against individuals.
Response: DHS believes that the States will take adequate measures
to prevent discrimination and is unable to create private rights of
action for the behavior of DMV employees. DHS disagrees that citizens
will be treated differently based on their ``looks'' or ``sounds''
since all persons seeking to obtain a REAL ID-compliant driver's
license or identification card have to establish their identity, date
of birth, and lawful status in the United States. Furthermore, State
DMVs already work with immigration documents and questions of
citizenship and immigration status under their applicable State laws
and have developed increasing familiarity with this subject already,
without evidence of discriminatory practices in so doing.
9. REAL ID Will Not Make the Nation Safer
Comment: Commenters wrote that terrorist intentions cannot be
predicted based on identification and that REAL ID will not prevent
determined bad actors from using a compliant REAL ID to gain access to
Federal buildings, nuclear facilities, and aircraft. A number of
commenters wrote that it is not clear whether REAL ID will enhance the
nation's security or create new opportunities for those seeking to
exploit the nation's security. Commenters also wrote that
centralization of personal data would create a greater security risk
and may raise demand and value of a counterfeit document. Some
commenters wrote that the proposed regulations would not have prevented
the 9/11 terror attacks since all but one of the hijackers could still
have obtained a State driver's license. One commenter said that REAL ID
is predicated on a flawed belief that only ``outsiders'' intend to harm
the United States, yet U.S. citizen ``insiders'' have committed
terrorist acts.
Response: The commenters are correct that the REAL ID rules cannot
completely eliminate the possibility that an individual will commit an
act of terrorism inside the United States. However, by improving the
security and reliability of State-issued identification documents, the
rules substantially increase the ability of the government and law
enforcement to identify with greater accuracy an individual at a check
point or screening opportunity. Furthermore, the rules minimize the
possibility of an individual possessing multiple documents, as some of
the 9/11 terrorists did. The 9/11 Commission and Congress have
concluded that this ability may prevent or deter future acts of
terrorism.
It is incorrect to assume that the REAL ID rules could have had no
impact on the 9/11 terror attack. As described in great detail in the
9/11 Commission Report, the ability of the terrorists to easily obtain
multiple, legitimate identity documents facilitated their ability to
move about the country and to board the ill-fated aircraft with minimal
scrutiny. Under this final rule, it will be significantly more
difficult for an individual to use a false name or provide fraudulent
documents to obtain an identification that can be used for purposes of
boarding a commercial airplane. Therefore, the final rule makes it less
likely that a terrorist could circumvent watch-list screening processes
and security procedures (as upgraded or developed post-9/11) and board
a commercial airplane.
Further, several of the terrorists no longer had lawful status in
the United States. Under the REAL ID Act and this final rule, those
individuals would now be unable to obtain REAL ID driver's licenses or
would only obtain a temporary driver's license that clearly indicates
on its face an expiration date tied to the expiration of the holder's
status.
10. REAL ID Will Result in Persons Driving Without Licenses and Auto
Insurance
Comment: Several commenters wrote that REAL ID, and the weeks it
can take to collect documents needed to replace lost or stolen
licenses, would result in illegal immigrants driving without a license
and auto insurance, and this would present health and safety risks on
the roadways.
Response: DHS does not believe that the implementation of the REAL
ID requirements will result in persons, particularly illegal aliens,
driving without a license and auto insurance any more than may already
be occurring. Most States already require the collection and submission
of particular documents in order to replace lost and stolen licenses.
11. REAL ID Will Place a Heavy Burden on State DMVs
Comment: Many States and AAMVA wrote that if States are to maintain
their present levels of service while incorporating REAL ID, they will
need to hire additional employees, increase service hours, expand or
increase facilities to accommodate customer volume, purchase additional
equipment to support personnel, create and implement public education
campaigns
[[Page 5286]]
to inform customers, and anticipate and handle increases in customer
inquiries. The commenters recommended several DHS actions, including
coordinating between DHS and DOT's Federal Motor Carrier Safety
Administration (FMCSA) to reassess their approach to funding REAL ID
requirements; prohibiting Federal agencies from charging transaction
fees for verification; coordinating among DMVs, the National
Association for Public Health Statistics and Information Systems
(NAPHSIS), and State vital record agencies to provide reliable data and
acceptable fees; requiring States to employ electronic verification
systems only as they become available; and consolidating and
synchronizing system development schedules. Other commenters
recommended changes to the enrollment and renewal processes, including
allowing for waivers of verification requirements for certain
categories of persons whose identification had already been vetted by
the Federal government, allowing transfers of authorization from State
to State of persons with valid REAL ID identification cards, and
exempting certain segments of the population from REAL ID requirements.
Response: Based on these comments, DHS is taking several measures
to reduce the impact of the rule. First, States meeting specific DHS
benchmarks for progress toward REAL ID compliance will qualify for
additional extensions until no later than May 10, 2011. Second, DHS is
adopting an age-based approach to REAL ID implementation. The rule
requires individuals born after December 1, 1964 to enroll and receive
REAL ID cards prior to December 1, 2014, in order for those cards to be
accepted for official purposes. Individuals aged fifty or older on
December 1, 2014 will not be required to enroll until December 1, 2017.
After December 1, 2017, all individuals will have to possess REAL ID
cards in order for those cards to be accepted for official purposes.
This timeline will substantially reduce the impact of REAL ID on DMV
operations and budgets.
Comment: Many States and commenters wrote that REAL ID will
significantly increase service times at DMVs, resulting in a
degradation of service. AAMVA estimated that DMV workloads will
increase by 132 percent and that transaction times for license renewals
will double. One commenter wrote that central issuance would impose
considerable burdens on citizens of rural, low-density states. Several
States wrote that the inability to use the Internet would impose a
significant burden on DMV operations; one State wrote that the
elimination of telephone and mail-in address changes would force
approximately 400,000 additional persons into its DMV offices.
Commenters also wrote that State DMVs will be required to add new
staffing and infrastructure and, at the same time, replace or
reconfigure their existing offices. States commented that hundreds of
new employees will need to be hired and new costs incurred to obtain
fingerprinting and background and financial checks of DMV staff. A few
States noted that they will have to renegotiate contracts for services
such as card printing or purchase new printers.
Response: DHS understands the commenters' concerns and agrees that
forcing the entire driver's license and identification card holder
population into a compressed timeframe would likely result in increased
DMV service times and a general degradation of services. The final rule
permits, for example, additional time for enrollment, remote license
transaction processing, and eliminates the necessity of in-person DMV
visits for address changes. Further, there is no requirement for
financial background checks or central issuance of licenses, although a
number of States have adopted central issuance as a best practice.
Comment: Several commenters wrote that State DMV officials will
require extensive training in recognizing the many types of immigration
documents and statuses that applicants may present. One commenter wrote
that REAL ID would change State DMVs ``into a wide-ranging enforcement
agent of the Federal government in areas from immigration rules to
Social Security fraud.'' Commenters also wrote that State DMVs will be
required to add new staffing and infrastructure and, at the same time,
replace or reconfigure their existing offices. A few States noted that
they will have to renegotiate contracts for services such as card
printing or purchase new printers.
Response: DHS disagrees that the REAL ID Act or its implementing
rules would result in DMV employees acting as enforcement agents. The
rules require that the DMV issue compliant licenses only to individuals
lawfully present in the United States and whose Social Security Number
can be verified with the Social Security Administration. DHS also
believes that the rules simplify the handling of immigration-related
issues, which DHS concedes is a very complicated area. DMV officials
are required to verify a non-citizen's lawful status with DHS. The SAVE
system administered by USCIS permits DMVs ``one stop shopping'' to
verify an individual's lawful status in the United States. Furthermore,
many States provide extensive document training to their personnel to
assist in identification and authentication of valid documents.
Furthermore, State DMVs already work with immigration documents and
questions of immigration status under their applicable State laws and
have developed increasing familiarity with this subject.
Comment: Commenters wrote that State DMVs will be required to
undertake other activities that they do not currently perform. One
State wrote that by some State laws, driver's licenses and State ID
cards are issued by two separate government agencies. Several States
said they would need to acquire new or enhanced records management
systems. Other States wrote that they will have to physically rearrange
their facilities to comply with the REAL ID requirement to maintain a
photo of everyone who applied for a license.
Response: While there may be activities DMVs may now need to
perform in order to issue more secure driver's licenses and
identification cards under REAL ID, Congress determined that these
activities are necessary in order to ensure more secure and reliable
forms of identification. Understanding that these new functions may
cause strain on some DMV facilities, the final rule provides
flexibility and additional time for states to implement these
activities.
12. Those Without Access to Required Documents
Comment: Several commenters wrote that REAL ID would impose
significant burdens on low-income individuals in the form of
significantly higher fees for licenses and ID cards, higher additional
costs to obtain necessary underlying documents, and extra time from
work, potentially involving lost wages, to apply for REAL ID cards. One
commenter wrote that a consequence of these burdens could be a likely
increase in counterfeited ID cards and large numbers of individuals who
lack Federally-compliant identification. Several commenters stated that
certain groups would be unfairly affected by the requirement to produce
certain documents, including foreign nationals, Native Americans,
domestic violence victims, the homeless, the elderly, and military
personnel. In addition, commenters described circumstances that could
impede individuals' access to required documents, such as natural
disasters.
Response: DHS believes that the REAL ID Act does not have a
[[Page 5287]]
disproportionate impact on certain groups. There is no evidence that
many of these groups lack the documents required to establish an
individual's name, date of birth, SSN, and lawful status. Should States
determine that the economically disadvantaged individuals are
experiencing a hardship in obtaining the necessary documents or cannot
afford the license fee established by the State, nothing in the rule
precludes a State from offering the driver's license or identification
card or copy of a birth certificate at a reduced cost or waiving the
fee altogether. In addition, the final rule enables States to establish
an exceptions process for a variety of situations and circumstances,
including circumstances where a particular suite of documents are
unavailable following a natural disaster.
13. REAL ID Will Be a Burden to End-Users
Comment: Two commenters wrote that the responsibility for
validating REAL ID cards is a government function and should not be
delegated to air carriers. Instead, DHS should provide ``readers,''
similar to those used by Immigration and Customs Enforcement, for use
at airports. Two commenters requested the rule make clear that the
current option regarding individuals submitting to a more extensive
physical search rather than showing ID before passing through airport
security will not be affected by the REAL ID Act.
Response: Neither the NPRM nor this final rule govern what
documents should be accepted or procedures followed at airports and
Federal facilities when an individual is unable to present a REAL ID-
compliant document as his or her form of identification. DHS does not
agree with the comment that validating a REAL ID is exclusively a
government function, and believes that a wide variety of entities would
want to validate a REAL ID document before accepting it as a valid form
of identification.
Comment: Another commenter asked how end-users could continue
routine functions if, after 2013, State-issued driver's licenses do not
meet REAL ID standards, since REAL ID would be required for access to
nuclear facilities. If a State is not in compliance or elects not to
participate in the REAL ID program, access by persons with licenses
from those States would be prohibited, and the ability of the plants to
function could be seriously impaired. A commenter mentioned that an
access authorization program supervised by the Nuclear Regulatory
Commission is already in place. One commenter wrote that while
commercial nuclear power plants are licensed by the NRC, they are
privately owned and operated and security is the responsibility of the
owner/operator, not the Federal government; therefore, they should be
exempted from the final rule requirements.
Response: Since the REAL ID Act specifically included access to a
nuclear facility as an example of an ``official purpose,'' DHS cannot
simply exempt nuclear power plants from the scope of the rules. DHS
agrees with the commenter that access authorization programs supervised
by the Nuclear Regulatory Commission may provide sufficient safeguards
concerning access to nuclear facilities. The NRC-supervised programs
may set forth alternative procedures or acceptable forms of
identification for persons seeking access to a nuclear facility;
however, if an individual is presenting a driver's license or State-
issued identification card, it must be REAL ID-compliant pursuant to
the REAL ID Act.
Comment: One commenter expressed concern about the impact of REAL
ID on commercial truck drivers, and suggested that drivers without REAL
ID identification cards would be far less valuable to carriers. One
commenter wrote that motor carriers domiciled in non-compliant States
would be at a severe disadvantage in finding drivers, and commercial
drivers themselves will have to absorb the additional costs of REAL ID,
including increased fees to obtain licenses and lost income.
Response: Any additional fees that DMVs may charge to obtain a REAL
ID document will not fall disproportionately on commercial drivers.
Nothing in the rules precludes companies employing commercial drivers
from subsidizing the costs incurred by the drivers they employ.
Furthermore, a REAL ID driver's license is not the sole document a
commercial driver could use to access a Federal facility. Since a
Federal facility may accept other forms of identification or establish
alternative procedures to admit individuals with non-compliant licenses
to Federal facilities, DHS does not believe that commercial driver's
license holders will be disadvantaged by living in a State that chooses
not to comply with the REAL ID requirements.
B. Scope, Applicability, and Definitions
Comment: Two State commenters and the AAMVA requested clarification
of the terms verification, authentication, and validation. Two
commenters asked for a clear definition of the term ``Federal
facility.'' One commenter wrote that it is a statutory requirement to
consult with the U.S. Department of Transportation in developing new
definitions for driver licensing terms. Commenters also requested
clarification regarding what age individuals will be required to obtain
a REAL ID. It was suggested that the age requirement should be
consistent with the age airlines require passengers to have their own
identification documents. One commenter expressed the need to inform
the public, in detail, how individuals will be impacted by not
obtaining a REAL ID.
Response: DHS agrees that the term ``verification'' should be
clarified. The final rule defines ``verify'' to include two processes:
Ensuring that the source document is genuine and has not been altered
and that the identity data contained on the document are valid.
DHS does not believe that the term Federal facility needs further
definition and cannot predict how individuals without a REAL ID-
compliant driver's license or identification card (either through their
own choice or because a State does not issue compliant documents) will
be impacted. DHS notes that individuals without a REAL ID-compliant
document will still be able to enter Federal facilities and board
commercial aircraft, and these rules cannot determine what alternative
documents are acceptable for those purposes. DHS believes that each
State can determine the appropriate minimum age to issue a REAL ID-
compliant driver's license or identification card to its residents and
does not believe that a single Federal standard is necessary in this
area.
1. Definition of ``Official Purpose''
Comment: Two States wrote that since many Federal areas require
identification, all ``official purposes'' must be clearly stated in the
rule so that States can make informed decisions on whether to be REAL
ID-compliant based upon the impact on the State budget versus the
negative convenience impact on its citizens. Numerous commenters wrote
that the definition of ``official purpose'' captures the requirements
of the REAL ID Act and they are opposed to expanding the definition.
Commenters stated that, should DHS decide on expanding the definition
of ``official purpose,'' it should not be done without an open comment
period. One commenter wrote that DHS has arbitrarily chosen to restrict
the required presentment of REAL ID-compliant documents to a much
smaller set of official uses than was contemplated by Congress, and
this contradicts and undermines DHS's statutory mandate to enforce
Federal immigration law. One State suggested that DHS create a list of
[[Page 5288]]
applicable Federal facilities. One commenter voiced concern over
possible expansion of the definition to include Federally licensed
firearms dealers and that residents of non-compliant States could be
blocked from purchasing firearms. One commenter encouraged DHS to
consider all the ways in which REAL ID could be used and not limit it
to boarding of Federally-regulated commercial aircrafts, entering of
Federal facilities, and nuclear power plants.
Response: DHS agrees with those commenters who noted that the
proposed definition of ``official purpose'' is consistent with
Congressional intent. DHS is neither expanding nor limiting the
definition further in this rule. DHS will continue to consider
additional ways in which a REAL ID license can or should be used and
will implement any changes to the definition of ``official purpose'' or
determinations regarding additional uses for REAL ID consistent with
applicable laws and regulatory requirements. DHS does not agree that it
must seek the approval of Congress as a prerequisite to changing the
definition in the future (except of course to remove one of the three
statutorily-mandated official purposes) as Sec. 201(3) of the Act
gives discretion to the Secretary of Homeland Security to determine
other purposes.
DHS does not intend that a REAL ID document become a de facto
national ID based on the actions of others outside of DHS to limit
the99ir acceptance of an identity document to a REAL ID-compliant
driver's license or identification card.
Comment: Commenters proposed other acceptable documents, including
over-the-counter interim identification cards and tribal identification
documents that should be accepted for official purposes. Another State
noted that Canadian citizens drive to the United States and fly out of
local airports and that it would benefit them economically to accept
Canadian passports as identification cards for Federal purposes. AAMVA
wrote that for States choosing not to comply with REAL ID, an alternate
form of identification is essential to ensure that commercial carriers
and drivers who deliver to Federal facilities continue to have
unimpeded access to these facilities and that interstate commerce is
not impeded. One commenter wrote that tribal ID issues must be
incorporated into the regulation at the outset. One commenter wrote
that DHS's disallowing of Transportation Worker Identification
Credential (TWIC) as an alternative to a REAL ID document because of
``slow progress'' in implementing the TWIC program will be invalid if
DHS extends REAL ID implementation. The commenter suggests permitting
use of TWIC because like REAL ID, TWIC also is a Federally-vetted
identification card.
Response: As noted in other responses, the REAL ID rule does not
control what other, if any, alternative documents can be accepted by
Federal agencies where an individual seeks to present an identification
document other than a State-issued driver's license or identification
card (which, under the Act and this final rule, must be REAL ID-
compliant).
2. Other Definitions
Comment: One State asked for several amendments to the rule
definitions. Specifically, the State asked that ``ability to affect''
be clarified to mean ``direct ability to affect''; that digital
photograph should read as ``a digitally printed color reproduction of
the face of the holder of the license or ID card''; that a definition
be added for foreign passports; clarification that providing a foreign
passport with a valid visa is an acceptable document for validating a
REAL ID; clarification that ``principal residence'' is not a residency
requirement, but merely defines principal address; and clarification
that Secretary means ``Secretary of the U.S. Department of Homeland
Security.'' AAMVA suggested that the term ``reissued'' be amended to
include ``only when material changes are required such as name
changes.''
Response: DHS agrees that the term ``principal residence'' needs
additional clarification and has defined the term in the rule to mean
the location where a person is currently domiciled (i.e., presently
resides even if at a temporary address) in conformance with the
residency requirements of the State of domicile, if such requirements
exist. DHS agrees with the comment regarding material changes and the
rule now states that a State may conduct a remote reissuance if State
procedures permit as long as there has been no material change in the
applicant's information since prior issuance. DHS believes that the
definitions of ``ability to affect'' and ``foreign passport'' do not
need further clarification. DHS decided against the proposed definition
of ``digital photograph'' since certain high-security features work
best with a black and white photograph and DHS does not want to
preclude States from using such technology to secure their licenses.
C. Compliance Period
Comment: Many commenters, including at least twenty States and
AAMVA, wrote that the compliance period is too short and is impossible
to meet. Specific reasons cited for why the compliance period is too
short included the following: The compliance deadline fails to take
into account the States' cycles for valid driver's licenses and
identifications; systems that DMVs must use to verify documents under
REAL ID either do not exist or are not operational; the compliance
deadline compels States to take on the unfunded expenses of hiring and
training more staff and making significant infrastructure changes,
waiting times for customers at DMVs will increase, the compliance
deadline reflects a failure to understand how State legislatures work
and how complex the process is for issuing State driver's licenses and
identification cards, and compliance deadline leaves insufficient time
for States to appropriate funds for the cost of implementing REAL ID.
Commenters also wrote that States have no incentive for requesting such
extensions, and several State legislatures have declined to even
attempt compliance with the Act or the rule.
Response: DHS agrees with the commenters that States would be
unable to fulfill the entire range of REAL ID regulatory requirements
by May 11, 2008. Therefore, DHS is taking several measures to reduce
the impact of the rule. First, States meeting specific DHS benchmarks
for progress toward REAL ID compliance will be granted additional
extensions until no later than May 10, 2011. Second, DHS is adopting an
age-based approach to REAL ID enrollment and will only require
individuals born after December 1, 1964 to enroll by December 1, 2014,
in order to receive cards acceptable for official purposes on December
1, 2014. Thus, individuals aged fifty or older on December 1, 2014,
will not be required to be enrolled until December 1, 2017. These
measures will substantially reduce the impact of REAL ID enrollment on
DMV operations and budgets.
DHS has chosen this approach as the most effective and expeditious
way to achieve the purposes of the Act. DHS believes that this approach
balances the strong national security objective of improving the
reliability of identification documents presented for official
purposes, including the boarding of commercial aircraft, with the needs
of the States to spread out their compliance costs over a greater
period of time and to obtain the
[[Page 5289]]
necessary legal and budgetary approval from within their State to
comply with the regulations.
Comment: Many commenters and States did not agree on the proposed
compliance period and suggested additional ideas, from basing the
compliance period on the natural license expiration date to extending
compliance through 2018. Two commenters wrote that a six-month planning
deadline after possible publication of a final rule is unrealistic, and
once there are operational systems available to all jurisdictions for
implementing REAL ID, States should have at least one year to connect
to those systems before issuing compliant cards. Other commenters
suggested delaying the full implementation date by some other term of
years commensurate with State driver's license renewal periods. Another
commenter wrote that State legislatures need two years after issuance
of a final rule to enact enabling legislation. One State suggested a
four-year compliance delay, as the State has a lack of funding; other
States proposed a delay of five years following final rule publication
because those States will not complete legislation and budget actions
before that time. One commenter wrote that the compliance date would
result in every State requesting a waiver and compressing the
enrollment process from five years to something less. AAMVA suggested a
ten-year compliance period, to 2018, and also recommended that DHS
avoid setting the implementation period until there are systems for
verification accessible in all jurisdictions.
Response: As noted above, DHS agrees that the compliance date
should be extended and therefore has extended the enrollment deadline
to December 1, 2014, for drivers after December 1, 1964 (that is, under
age fifty), and to December 1, 2017 for all other drivers as described
above.
Comment: Commenters wrote that DHS should permit States to
grandfather into REAL ID compliance those individuals who have held a
driver's license for ten years. Another commenter wrote that DHS should
give States the flexibility to delay re-verifying certain populations
so that States maximize their resources and avoid severe service
disruptions. Where a State can verify customer data before issuing a
license or identification document, DHS should permit States to use
``alternative renewal processes'' during the REAL ID enrollment period.
Another commenter wrote that a State should be able to waive
verification requirements for members of the military, Federal
employees, and passport holders who already have been through a Federal
vetting process. Another commenter proposed grandfathering in any State
that can demonstrate that its process for issuing driver's licenses or
identification documents is similar to REAL ID.
Response: The REAL ID Act does not authorize Federal agencies to
accept non-compliant cards from specific age groups or other
populations through a grandfather clause. DHS, as discussed above,
recognizes the operational burden on States if they were required to
reenroll all licensed drivers by the initial proposed enrollment date
of May 2013. DHS has determined, based on comments received requesting
deferments or exemptions for populations based on age and a statistical
analysis of TSA incident report data, that an age-based enrollment
would provide States with the most reasonable implementation options.
DHS has determined that, based on TSA incident report data it has
reviewed, that a logical dividing point for age-based enrollment would
be fifty years of age. As a result, the rule requires the States to
focus first on individuals born after December 1, 1964, when issuing
REAL ID cards. These individuals will be under fifty years of age on
December 1, 2014. DHS has determined that deferring the REAL ID
enrollment requirements until December 1, 2017, for those individuals
born on or before December 1, 1964, will relieve the States of some
operational burden associated with re-licensing their license holders.
This provision will enable States to extend the enrollment of this
lower-risk population until December 1, 2017.
This approach is based on a review of several data sets that
correlated age and the propensity to commit a terrorist act and age and
the likelihood to commit a criminal act.
Depending on the specific data set examined, different age cutoffs
starting at the age of thirty-five would be appropriate for the REAL ID
final rule. Of the several data sets that were examined, the best data
set is one from TSA, because it is the only one that shows a
correlation between activities occurring within TSA's purviews, an
incident resulting in a arrest, the age of the individual and the use
of a fraudulent identification.
For this final rule, data was collected and analyzed on the total
number of TSA incidents involving the use of fraudulent identification
representing the time period from October 1, 2004 through July 25,
2007. The data was then sorted and those potential incidents involving
the use of a fraudulent identification (using the key words fraud,
false, fake, and ID) were extracted. Each incident report was read and
those incidents that were not germane to the REAL ID rulemaking were
purged. Finally, DHS, using both the raw data as well as the calculated
rates (based on the number of individuals flying), grouped the
incidents into different age groups. The results were a data set that
correlated one of the primary requirements of this rulemaking (the need
to present an appropriate identification prior to boarding an airplane)
to the use of a fraudulent identification by the age of an individual.
A total of 98 incidents of where an individual was arrested that
involved the use of a fraudulent identification was included in this
group. The age of the individuals arrested was available for 86 of the
arrests. The weighted mean age of an individual arrested was 32 years
of age with a standard deviation of 8.95 years. This means that about
two-thirds of those individuals who were involved in an incident where
an arrest occurred were between the ages of 23 and 41. About ninety-
five percent were between the ages of 14 and 50.
Using this data, DHS estimated the percentage of individuals who
would be prevented from using a fraudulent identification (as a result
of the REAL ID rule) for the age cutoffs 41, 45.5, and 50. Based upon a
normal distribution, 66.7% of all individuals using a fraudulent
identification would be between the ages of 23 and 41 (1 standard
deviation) and 95% of all individuals would be between the ages of 41
and 50. These statistics were then used to estimate the risks
associated with the age cutoffs of 41, 45.5, and 50. An age cutoff of
41 would allow DHS to potentially prevent the likelihood of 83% of all
individuals from using a fraudulent identification. But as a means of
providing additional national security, the final REAL ID rule would
not have prevented 17% of the individuals from using a fraudulent
identification.
With a cutoff of age 50, DHS would potentially prevent the
likelihood of 97% of all individuals from using fraudulent
identification. But as a means of providing additional national
security, the final REAL ID rule would not have prevented 3% of the
individuals from using a fraudulent identification. Since the age
cutoff 45.5 is the midpoint of the ages 50 and 41, DHS estimated the
likelihood that REAL ID would prevent the use of a fraudulent
identification, by using the averages for
[[Page 5290]]
the age cutoffs 50 and 41 and found that an age cutoff of 45.5 would
prevent the likelihood of 90% of all individuals from using a
fraudulent identification. But as a means of providing additional
national security, the final REAL ID rule would not have potentially
prevented 10% of the individuals from using a fraudulent identification
(See Table Below).
Table 1.--Risks Associated With Different Age Cutoffs
------------------------------------------------------------------------
Risks associated with different age cutoffs
-------------------------------------------------------------------------
Potential
Potential percentage
percentage number of
Age cutoff number of incidents
incidents not
prevented prevented
(%) (%)
------------------------------------------------------------------------
41............................................ 83 17
45.5.......................................... 90 10
50............................................ 97 3
------------------------------------------------------------------------
The TSA data was analyzed even further by stratifying the universe
of these 86 arrests into three categories. The categories are (1)
Arrests where a fraudulent identification was discovered, but the
fraudulent identification was not the reason that the individual became
a suspect; (2) arrests where the individual was a TSA Selectee and
during the process, a fraudulent identification was discovered; and (3)
arrests where the individual became a suspect because of his/her use of
that identification and the use of a fraudulent identification was the
cause for the arrest. Because DHS was not able to determine a priori
the characteristics of the population as a whole as to who uses a fake
identification and who does not (in order to determine an appropriate
age cutoff), the best that can be done is to examine the ages of those
who were arrested when the use of a fraudulent identification was the
cause of the arrest and compare that population to those who were
arrested where a fraudulent identification was discovered at the time
of the arrest but the fraudulent identification was not the reason to
suspect the individual. The results show that the means of each
population are not statistically different from each other. In other
words, we cannot say that the samples are from different populations
and we accept the null hypothesis.
Comment: One commenter wrote that the waiver process by which a
State may request an extension of the compliance deadline to December
31, 2009 is acceptable, as it gives States the time they need to plan,
budget, and implement the regulations. Another commenter wrote that
compliance related to the verification of lawful status of aliens could
be implemented by all 56 states and territories by the May 11, 2008
deadline, and that there is no rational basis to extend the specific
deadline for SAVE compliance. One commenter wrote that DHS should
institute a formal safe harbor so that a State may be deemed compliant
if it is making reasonable progress toward implementing REAL ID. One
commenter wrote that when there is a legitimate reason to grant an
extension for one State, it should apply to all states. Another
commenter wrote that a State's request for an extension should be
deemed justified in the absence of extraordinary circumstances. One
commenter wrote that DHS has demonstrated flexibility by allowing
States to delay implementation and creating a petition process for
States needing more time, and the commenter encouraged DHS to continue
collaborating so that States have the necessary flexibility to comply
with the law.
Response: Although the above comments indicated that certain
aspects of the proposed rule do not require an extended compliance
period, all the commenters observed that States would be unable to meet
the overall compliance deadline proposed in the NPRM. As noted earlier
in this preamble, in addition to the extension proposed in the NPRM
through December 31, 2009, DHS is allowing a second extension request
valid until no later than May 10, 2011.
Also as noted earlier in this preamble, DHS has chosen this
approach as the most effective and expeditious way to achieve the
purposes of the Act. DHS believes that this approach balances the
strong national security objective of improving the reliability of
identification documents presented for official purposes, including the
boarding of commercial aircraft, with the needs of the States to spread
out their compliance costs over a greater period of time and to obtain
the necessary legal and budgetary approval from within their State to
comply with the regulations. Furthermore, because some States are
uniquely situated and have taken different steps to come potentially
closer to compliance with the REAL ID Act than other States, DHS does
not believe that ``one size fits all'' when it comes to the use of the
Secretary's extension authority.
D. Privacy Considerations
Comment: DHS received numerous comments regarding the need to
protect the privacy of REAL ID cardholders. The comments raised a wide
range of concerns including the creation of a national ID;
establishment of a Federal database on all ID holders; the uses of the
ID; the need to set specific standards to protect privacy, including
addressing data storage, access rules, safeguarding the data, and
retention period for the data; the need to provide a redress process;
limiting Federal access to the data; who should operate or govern the
query system; and best practices for privacy protection of the data.
AAMVA also commented that the States are committed to protecting
privacy and that they are prepared to address privacy in their security
plans and many already have such plans in place.
At least one State and several other commenters, including NASCIO,
expressed concerns about the development, governance, and protection of
privacy in Federal reference databases. NASCIO recommended collective
State governance. Many commenters wrote that State information security
requires extreme caution, given that exposing personal information in
untested databases would result in great harm if a security breach
occurred.
Response: DHS recognizes that protecting the privacy of REAL ID
cardholders is a prerequisite to obtaining the public's trust in the
REAL ID card. DHS has addressed those concerns in the final rule to the
full extent of its authority by mandating protections for the
personally identifiable information DMVs collect, store, and use
pursuant to the REAL ID Act and its implementing regulations.
1. Privacy Concerns Regarding a National ID and a Federal Database
With regard to concerns that REAL ID will create a national ID, DHS
does not intend that REAL ID documents become a de facto national ID
and does not support creation of a national ID. The REAL ID Act,
however, does not provide authority for DHS to issue restrictions on
who may or may not use REAL ID cards. DHS can only define those
``official purposes'' for which a REAL ID credential must be used in
lieu of other State-issued driver's licenses. The final rule has
limited ``official purposes'' to those set forth in the Act--accessing
Federal facilities, boarding Federally-regulated commercial aircraft,
and entering nuclear power plants. In addition, the final rule does not
require that the REAL ID driver's license or identification card number
or design be unique nationally, thus possibly limiting the
functionality of the REAL ID card or identification number as a
[[Page 5291]]
national ID card. It is unclear at this early stage whether REAL ID
cards in fact will be used differently from current State driver's
licenses and identification cards; but if cardholders experience
specific abuses regarding third-party misuse of these cards, Congress
and the States can determine whether and how to address such abuses.
With regard to concerns that REAL ID will create a Federal database
on all REAL ID card holders, DHS does not intend to own or operate a
database on all driver's license and identification card holders. REAL
ID implementation, however, will require a messaging system (generally
known as a ``hub'') to serve as the backbone to support the
verification checks REAL ID requires. In addition, the State-to-State
data exchange will likely require a software application (likely an
index or pointer system) to enable the States to exchange limited
information to identify whether an applicant for a card holds a card in
another jurisdiction.
DHS is mindful that the States expect to continue to have control
over their systems, their information, and the processes that govern
any use or access. DHS agrees that issues relating to the governance of
any State-to-State exchange of information are critically important,
and that the States will need to play an important role in determining
the governance structure of any system(s) that may interface with State
licensing systems and the Federal verification systems required to
implement REAL ID. Many of the individual State comments emphasized
that they are committed to protecting privacy and that they are
prepared to address privacy in their security plans and already have
such plans in place. The governance of the system(s) necessary to
conduct the data checks will be established in consultation with DOT
and the States during the first phase of the REAL ID implementation.
The Privacy Impact Assessment issued in conjunction with the final rule
discusses the governance issue in more detail.
As described above, DHS is currently working with AAMVA, DOT, the
Social Security Administration, the Department of State, National
Association of Public Health Statistics and Information Systems
(NAPHSIS), and State representatives to define requirements for a
messaging system to support the multiple data verification checks REAL
ID requires. The backbone of the messaging system could be AAMVAnet,
the network system AAMVA already operates to facilitate data
verification for the State DMVs. It is important to note for purposes
of privacy and security that the AAMVAnet backbone resides on a private
network with no connectivity to the Internet, making it much less
vulnerable to attacks. It has been, and will continue to be, a highly
secure transportation layer for all communications between the States
and agency databases. DHS will work with DOT and AAMVA to build upon
the security, privacy, and governance principles that have guided AAMVA
and the States for decades in conducting licensing checks by
reinforcing the security and privacy features of the AAMVA
communications and systems architecture.
In addition to potentially using AAMVAnet as the backbone, DHS,
DOT, and the States are exploring the alternative of using the
Commercial Drivers Licensing Information System (CDLIS) as the platform
for supporting the State-to-State data exchange requirements of the
REAL ID Act and regulation. CDLIS already supports queries to every
State DMV every time an individual applies for a driver's license in
any State or the District of Columbia. Although privacy groups urged
DHS not to build upon CDLIS since it is a centralized database, it is
more technically and economically difficult to design a State-to-State
data exchange system that avoids using a central repository (an index
or pointer system) to direct the checks to the appropriate State. DHS
understands that State systems would not be able to handle the volume
of messages received if all jurisdictions were sending and receiving
messages from all jurisdictions at the same time. The central
repository would facilitate the check by identifying which
jurisdiction(s) has a match and obtaining the relevant record
information. The repository would only be used to facilitate the State-
to-State data exchange or for authorized law enforcement personnel who
are checking a specific license or identification card against the
system. Moreover, CDLIS is a secure, State-governed system that stores
only the minimum amount of personal information necessary to minimize
false positives and to facilitate the routing of queries and responses
between States.
With regard to limiting access, (Federal, State, and private-
sector) to the State DMV data stored in the data verification system,
DHS, DOT, and the States will define the access rules. The REAL ID Act
does not create Federal access rights to State DMV databases. Moreover,
DHS supports limiting access to the data verification system to
authorized State DMV personnel and to Federal government agencies
engaged in official responsibilities pertaining to law enforcement, the
verification of personal identity, or highway and motor vehicle safety.
For example, DHS personnel do not currently access CDLIS or AAMVAnet.
Its law enforcement agents obtain access to State driver's license
information using National Law Enforcement Telecommunications System
(NLETs) and commercial data sources.
2. Protection of State DMV Databases
To help protect the privacy and security of the personally
identifiable information (PII) held in State DMV databases, Sec. 37.41
of the final rule requires States to prepare a security plan for all
State DMV facilities and systems involved in the issuance, enrollment,
production, or manufacture of driver's licenses and identification
cards, and to submit the plan to DHS as part of the State's application
for certification. The final rule requirement for the security plan to
include reasonable administrative, technical, and physical safeguards
to protect the security, confidentiality, and integrity of the
personally identifiable information collected, stored, and maintained
in DMV records and information systems is consistent with key
information safeguards outlined in the Privacy Act of 1974 (5 U.S.C.
552a) and the Federal Information Security Management Act of 2002 (44
U.S.C. 36).
The security plan requires a number of important privacy and
security safeguards including, but not limited to: (1) Procedures to
prevent unauthorized access, use, or dissemination of applicant
information and images of source documents retained pursuant to the
Act; (2) standards and procedures for document retention and
destruction; (3) a privacy policy; (4) a prohibition on release and use
of personal information that, at a minimum, is consistent with the
Driver's Privacy Protection Act, 18 U.S.C. 2721 et seq.; (5) access
controls, including employee access badges, background checks and
systems controls; (6) emergency incident response plans; (7) internal
audit controls; (8) physical security of facilities where driver's
licenses and identification cards are produced; (9) security of the
document materials and papers from which driver's licenses and
identification cards are produced (Sec. Sec. 37.41 and 37.43).
The requirement that the security plan include a privacy policy
regarding the personally identifiable information collected and
maintained by the DMV provides a key privacy protection. Although the
final rule does not define
[[Page 5292]]
the specific content of the privacy policy, DHS expects that the policy
will reflect the fair information principles noted in the NPRM, which
call for openness, individual participation (access, correction, and
redress), purpose specification, data minimization, use and disclosure
limitation, data quality and integrity, security safeguards, and
accountability and auditing. These principles are widely recognized and
embodied in numerous Federal, State, and international law and codes of
practice. In addition to reflecting these principles, DHS recognizes
that the privacy policies will need to be consistent with State privacy
laws governing DMVs information practices, and the final rule in no way
reduces the protections States already afford PII held by DMVs.
With regard to concerns regarding disclosure of PII from DMV
databases, the final rule requires that the security plan include a
prohibition on release and use of personal information that, at a
minimum, is consistent with the DPPA. Although the DPPA provides for a
large number of permissible uses, it is the only Federal law that
currently applies to State DMV records and will provide a floor that
States can build upon to further limit the disclosure of DMV record
information.
3. Privacy Concerns Regarding the Machine Readable Technology Employed
by REAL ID
Section.IV.I.8 of the comments discussion discusses the comments
and responses regarding the machine readable zone (MRZ) on REAL ID
cards. In brief, commenters were split between the privacy groups that
were concerned about third party ``skimming'' of information from the
MRZ if it is not encrypted, and the State and law enforcement groups
that opposed encryption because it could interfere with speedy law
enforcement access to the information and it would be difficult and
costly to manage encryption keys across so many jurisdictions.
Given law enforcement's need for easy access to the information,
and the complexities and costs of implementing an encryption
infrastructure, DHS is not requiring encryption of the MRZ at this
time. If, in the future, the States collectively determine that it is
feasible to introduce encryption, DHS may consider such an effort so
long as the encryption program enables law enforcement easy access to
the information in the MRZ. Moreover, in the future, DHS, in
consultation with the States and DOT, and may consider technology
alternatives to the PDF417 2D bar code that provide greater privacy
protections after providing for public comment.
As discussed in the Privacy Considerations section of the NPRM (72
FR at 10824-25), DHS strongly encourages the States to address concerns
about the ability of non-law enforcement third parties to collect or
skim personal information stored on the REAL ID driver's licenses or
identification cards. Some States, such as California, Nebraska, New
Hampshire, and Texas have passed laws that prohibit the collection of
information on a driver's license or identification card. In addition,
AAMVA has drafted a Model Act \2\ that, if enacted by a State, would
prohibit commercial users, except as provided by the State's
legislation, from using a scanning device to: (1) obtain personal
information printed or encoded on the card and; (2) buy, sell or
otherwise obtain and transfer or disclose to any third party or
download, use or maintain any data or database, knowing it to contain
personal information obtained from a driver's license or identification
card. The Model Act authorizes verification of age for purchasing
alcoholic beverages or tobacco products, but with strict limitations on
the storage and use of such information.
---------------------------------------------------------------------------
\2\ ``Model Act to Prohibit the Capture and Storage of Personal
Information Obtained from a Driver's License or ID Card,'' AAMVA 26-
8.2-03, 2003.
---------------------------------------------------------------------------
In addition to concerns about third-party skimming, privacy groups
commented that access to the MRZ should be restricted to law
enforcement, while other commenters also supported access without
information collection for bars and liquor stores to help prevent
underage drinking. In response to commenters urging that the rule limit
Federal agency access to the MRZ, DHS is not aware of any current plans
by Federal agencies to collect and maintain any of the information
stored in the MRZ. If a Federal agency should want to use the MRZ to
collect and maintain personally identifiable information in the future,
any such information collected from the MRZ would be subject to the
protections of the Privacy Act of 1974 (5 U.S.C. 552a), and other
Federal laws and policies regulating the use and handling of personally
identifiable information, including requiring appropriate time for
public notice.
A number of commenters also urged DHS to limit the data elements in
the MRZ to the minimum necessary, particularly if the MRZ is not
encrypted. DHS has reviewed the elements identified in the NPRM and
eliminated the requirement to include the name history in the MRZ. All
other data elements are necessary for DMV and law enforcement purposes.
4. Additional Privacy Concerns
The privacy groups and individuals also filed comments on a number
of other privacy issues such as redress, the confidentiality of the
address for certain at-risk individuals, and the Western Hemisphere
Travel Initiative (WHTI)-compliant card and its use of Radio Frequency
Identification (RFID) technology. The comments and responses to these
additional privacy concerns are discussed in other sections of this
final rule.
Comment: Two States wrote that the proposed rule did not provide
adequate safeguards for data storage, thereby significantly increasing
the risk of identity theft. One commenter wrote that even the most
rigorous security measures could be foiled by personnel with legitimate
access intentionally or inadvertently exposing information. Several
commenters wrote that the rule's broad expansion of data collection and
storage creates a significant threat to privacy and that guidance on
access to data and accountability should be issued. Commenters also
wrote that stored data should be secured to protect the identities of
victims from abusers in State government who have database access.
Response: Section 37.41 of the final rule helps address concerns
about adequate protections for the DMV databases and information
systems. It calls for States to prepare a security plan, including
providing reasonable administrative, technical, and physical safeguards
to protect the security, confidentiality, and integrity of the
personally identifiable information stored and maintained in DMV
records and information systems. The rule specifically points out the
need to include access control measures to prevent unauthorized access
to the information. States are already sensitive to the importance of
protecting their data and systems. Section 37.33(b) will help ensure
that DMVs provide comprehensive, layered security protection to reduce
the incidence of unauthorized access and use. In addition, this final
rule does not preempt States from implementing privacy protections that
are even more protective.
Comment: One State wrote that DHS should set standards for
accessing the required information from the Federal government and
other States so that the verification process is performed
[[Page 5293]]
similarly by all States. Multiple commenters stated that they want data
systems to be one-way and used solely for the purpose of verification;
Federal system owners would not be able to query State databases.
Similarly, other commenters wrote that the rule should limit how States
can access Federal databases for purposes of verifying source documents
and should only allow authorized DMV employees access to Federal
databases. One commenter requested that the final rule make clear that
no State may electronically access source documents contained in DMV
databases in other States. Several States opposed Federal government
access to the extensive data collected by States and suggested a
network interface that only allowed State queries of the databases. One
commenter wrote that it is unclear from the proposed rule how the
federated query service will operate and manage the data between
databases and DMVs, and while strict access controls to REAL ID data
and documents will help minimize security and privacy risks, such
controls will not be possible without DHS answering these questions
prior to implementing REAL ID.
Response: DHS is working with DOT, AAMVA, and the States to enhance
existing querying systems to meet the requirements of the REAL ID Act
and rule. This ``federated querying system'' builds upon existing
systems that include verification of DMV applicant birth certificates
and social security numbers. These existing systems enable States to
query the SSOLV database managed by SSA and the EVVE database managed
by NAPHSIS. In both cases, only State DMVs can initiate queries.
Moreover, SAVE, the USCIS system for verifying the lawful status of
individuals in the United States, is designed on a similar basis, with
only States able to initiate queries. Enhancements to existing systems
to verify information held by the Department of State will be designed
and built on the same principles.
In addition, State-to-State data exchanges required by REAL ID may
consider leveraging the Commercial Drivers Licensing Information System
(CDLIS) as the baseline platform for systems design, development and
deployment. CDLIS is a secure, State-governed system that stores the
minimum amount of personal information possible to facilitate the
routing of queries and responses between States. Enhancements to CDLIS
to support the requirements of REAL ID will not change the fundamental
architectural, security, and privacy principles upon which CDLIS has
been built and operated by the States for nearly two decades.
As noted above, Sec. 37.41 of the final rule addresses these
concerns. It calls for States to prepare a security plan, including
providing reasonable administrative, technical, and physical safeguards
to protect the security, confidentiality, and integrity of the
personally identifiable information stored and maintained in DMV
records and information systems. The rule specifically points out the
need to include access control measures to prevent unauthorized access
to the information.
Comment: One State recommended that paper document retention should
not be required once electronic formats were secured. Another commenter
wrote that REAL ID should collect only the data that is absolutely
necessary and keep it for only as long as necessary, and requirements
should be in place to periodically review and purge information.
Response: Section 202(d)(2) of the Act mandates that States
``retain paper copies of source documents for a minimum of 7 years or
images of source documents presented for a minimum of 10 years.'' DHS
does not have discretion to change that requirement. Accordingly, under
this final rule, States may choose to keep paper copies, microfiche, or
digital images of source documents. Depending on the method of document
retention adopted by the State, the State must maintain paper copies
for a minimum of seven years, or microfiche or digital images of source
documents for a minimum of 10 years pursuant to the Act. We note that
the NPRM proposed to allow retention of microfiche for 7 years;
however, as discussed above the statute mandates retention of
``images'' of source documents for 10 years. A microfiche is a film
image, rather than a paper copy, of a document; therefore, we have
corrected the error in the proposed rule to more accurately reflect the
statutory mandate.
Comment: Many commenters wrote that obtaining a REAL ID could
become a requirement for participation in American life, and that a
REAL ID could be used for purposes beyond what is contemplated today,
such as controlling gun ownership or smoking. Another commenter wrote
that implementing REAL ID would undoubtedly result in a system that
political and agency heads would not restrain themselves from using and
expanding in the future, and that REAL ID would become a practical
necessity for anyone wishing to travel on an airplane, open a bank
account, collect Social Security benefits, or take advantage of other
government benefit programs. Other commenters wrote that the result
would be a dividing of the citizenry into those who have REAL
identification cards and those who do not, with the later group subject
to suspicion. One commenter urged DHS to make clear in the final
regulations that driver's license numbers and ID card numbers must be
unique within a State and that the REAL ID cards should not have a
nationally standard format.
Response: DHS agrees with the comment that a driver's license or
identification card number needs to be unique only within a State and
need not be a unique nationally identifying number. DHS also
understands the concerns raised in the comments about how a REAL ID
might be used outside of the defined ``official purposes'' identified
in the Act and this final rule. DHS does not intend that a REAL ID
document become a de facto national identification card. Whether States
choose to require presentation of a REAL ID for State purposes is not
within the purview of DHS's authority under the Act--which applies to
documents that Federal agencies can accept for official purposes--and
thus is outside of the scope of this rulemaking.
E. State to State Database Queries
Comment: Several commenters suggested the following requirements
for State databases: using a single agreed-upon naming record keeping,
clarifying ``transferable'' functionalities, implementation of point-
to-point interfaces for data verification, a decentralized query
system, and a system to check for duplicate registrations in multiple
States. One commenter suggested that every State have a data governance
committee. Several States offered best practice suggestions to support
State database security, including encryption, annual employee
confidentiality agreements, secured data centers, testing programs to
determine tampering, security audits, and multi-factor authentication.
Response: DHS agrees that issues relating to the governance of any
State-to-State exchange of information is critically important, and
that the States will need to play an important role in determining the
governance structure of any system(s) that may interface with State
licensing systems and the Federal verification systems. DHS is mindful
that the States expect to continue to have control over their systems,
their information, and the processes that govern any use or access.
During the initial period of REAL ID implementation, States will
conduct data verification using their current
[[Page 5294]]
methods of connection to SSOLV, SAVE, and the other State DMVs. States
will continue to use AAMVAnet to connect to these data sources.
AAMVAnet is governed by the Board of AAMVA and is subject to the
security and privacy requirements established by the association of
DMVs. As DHS, DOT, AAMVA, and the States complete the upgrade of
existing systems to meet the requirements of REAL ID, these systems
will be deployed and operated on the same basis as the current network
of AAMVAnet-based systems for DMV verification of applicant data and
State-to-State exchanges of driver information. The architecture of
these systems will determine the scope and extent of the privacy
concerns they pose.
F. Document Standards for Issuing REAL ID Driver's Licenses and
Identification Cards
1. Identity
Comment: One State agency asked whether the term ``source
document'' in the proposed rule is synonymous with ``identity
document'' used in the Act. One State wrote that it was concerned about
individuals having to surrender their REAL ID card from one State when
moving to a new State and applying for a new card. Many commenters
wrote that certain applicants would have difficulties obtaining proper
source documents, including refugees, lower-income individuals, persons
who live in rural areas, the elderly, minorities, and abuse victims.
Another State suggested that the rule should only specify criteria and
procedures rather than a list of specific documents.
Response: DHS disagrees with the comment that the rule should
specify criteria rather than a list of specific documents acceptable to
establish a person's identity. Limiting the number of documents means
that only the documents which DHS has found to be the most secure may
be used to demonstrate identity. Second, identifying specific documents
improves the chances that DMV employees will be able to distinguish
valid from fraudulent documents because there will be fewer categories
of documents with which they will need to be familiar. Third, a smaller
list of documents increases the ease of verifying the documents
independently, a related statutory requirement and one that will be
very effective in reducing document and identity fraud.
DHS does not agree that certain categories of individuals cannot
reasonably obtain the identity documents specified in the rule, but the
rule provides a reasonable level of discretionary flexibility to
address these types of cases.
Comment: Commenters wrote that the list should be expanded to
include a variety of documents, including adoption papers, refugee
status paperwork, expired foreign passports if USCIS documentation is
current, passports with expired visas, derivative visas, Immigration
Court documents, foreign birth records, foreign national identification
cards, the I-94 (Arrival-Departure Record), and the I-797 (Notice of
Action). Refugees and asylees are more likely to have these documents
before they receive an Employment Authorization Document (EAD). Two
States suggested that documents that can be electronically verified
through SAVE should be acceptable. Commenters wrote also that foreign
applicants may have documents that are not on the list but may have
been issued by DHS or the courts to prove immigration status.
Response: The document list provided in the proposed regulation and
adopted under this final rule is only for demonstrating identity, not
lawful status in the United States. DHS agrees with the commenters who
suggest that any document verifiable by SAVE is acceptable for proving
lawful status, and that is what this final regulation provides. These
can include Forms I-797 and I-94 as they provide sufficient information
for a State DMV to check SAVE, which will be the method by which aliens
lawfully present in the United States establish lawful status. But
because many of these documents (including the ones listed above)
cannot, and are not intended to, prove a person's identity, an
additional document must be provided for that purpose. In the case of
refugees and asylees, they will be able to obtain a Form I-766,
Employment Authorization Document.
DHS cannot accept the comment that foreign documents be included on
the list of acceptable documents to prove identity. First, section
202(c)(3)(B) of the Act specifically prohibits any States from
accepting any foreign document other than a passport. Second, the Act
requires that documents presented for proof of identity be verified by
the issuing agency. State DMVs cannot be expected to verify with
foreign governments the validity of documents. DHS has, instead,
decided to use the U.S. visa within the foreign passport as the
identity document that a nonimmigrant alien can present.
Comment: One commenter wrote that a delayed birth certificate
should be considered an acceptable document. One State wrote that many
births in rural areas are not recorded, and States should be able to
use other documents. One commenter wrote that a requirement for a
certified copy of a birth certification would place a hardship on poor
persons. One commenter supported the concept of re-verification of
birth certificates for renewals of REAL identification cards, except
that the rule should allow the option for the applicant to use
documents with the current legal name instead of the name at birth.
Response: While confirming identities with delayed birth
certificates can be problematic, this final rule does not preclude a
State from accepting a validly-issued delayed birth certificate. DHS
agrees that some, mostly elderly, individuals may not have a birth
certificate at all. As a result, the final rule permits a State to use
its exceptions process to determine what alternative documents an
individual may present in this limited circumstance to establish his or
her date of birth. DHS does not agree that lower-income individuals
will have a hardship obtaining certified copies of their birth
certificates and believes that States may be able to assist those
individuals for whom the cost of obtaining a birth certificate is
prohibitive. Further, DHS believes that there is value in re-verifying
applicant information upon renewal of driver's licenses and
identification cards and has amended the renewal sections to require
re-verification of SSN prior to issuance.
Comment: Commenters requested a variety of additional documents be
considered as acceptable source documents, including Federally-issued
identification documents such as military identification cards, the
Common Access Card, retired military ID cards, dependent military ID
cards, Veteran Affairs Universal Access Photo ID cards, and
Transportation Workers Identification Credentials (TWIC). Some
commenters also requested that Native American Tribal Documents be
deemed acceptable source documents. One State asked whether a tribal
photo identification card accompanied with a Canadian birth certificate
(which is currently acceptable to the commenting State) will be
acceptable to DHS. If not, these populations may encounter particular
difficulty obtaining a REAL ID.
Response: DHS does not agree with comments suggesting addition of
Native American Tribal Documents, TWIC cards, or Common Access Cards
(CAC) or military identification issued by the U.S. Department of
Defense as identity documents for REAL ID purposes at this
[[Page 5295]]
time. DHS continues to understand from the Department of the Interior
and Bureau of Indian Affairs that Tribal members are similarly situated
to the general population, and have access to the identification
documents set forth in the rule. Where a Tribal member does not have
the necessary document to establish identity, date of birth, or lawful
status, a State's exception process can take this into account based on
the State's knowledge and experience with Tribal documents in its area
of jurisdiction.
In regard to the use of a TWIC as proof of identity, at this time,
DHS does not believe that it would be feasible for States to accept
TWIC cards as initial proof of identity by persons applying for a REAL
ID card. First, section 202(c)(3) of the REAL ID Act requires States to
verify all documents presented by applicants as proof of identity. The
capability for States to verify a TWIC card currently does not exist at
this time.
Second, although a TWIC holder must have been determined to be
lawfully present in the United States to obtain the TWIC, the TWIC does
not necessarily expire when the holder's lawful status expires.
Therefore, a DMV could not use the TWIC card alone as evidence of
lawful status and the applicant would have to present both a TWIC (for
identity) and a separate document (for status).
Accordingly, there is little benefit to the individual or the DMV
at this time to include a TWIC as an acceptable identity document. As
such, the final rule does not include TWIC as an acceptable form of
identification. However, DHS will revisit this issue in the future
should such a capability become available and will consider the ability
for States to verify TWICs with the federal government as the standards
for the ``hub'' are developed.
2. Social Security Documentation
Comment: Several commenters, including States, wrote that obtaining
a Social Security card can be a lengthy process. They argued that some
individuals may have lost their original card, a Social Security number
(SSN) does not enhance the identification process, and ineligibility
for a SSN is difficult to determine and verify. One commenter wrote
that individuals might not have a SSN because of religious beliefs. One
State wrote that States should have the option of requiring a Social
Security card.
Response: The REAL ID Act requires that individuals provide proof
of their Social Security account number or verification that they are
not eligible for a Social Security account number. While the typical
proof submitted to DMVs is a Social Security card, the rule allows for
the submission of alternate documents, such as a W-2 form, SSA-1099
form, or pay stub to establish the SSN. Use and verification of the SSN
is widely seen by almost every State as an effective tool in enhancing
the identification process. DHS has further amended the rule to clarify
for the DMVs when an individual will have not have a SSN, which is
largely tied to immigration status and identity documents used to apply
for a driver's license. Other instances may be addressed in exceptions
processing.
3. Principal Residence Documentation
Comment: Many commenters suggested that the definition of
``principal residence'' be amended. One State recommended that DHS
define ``principal residence'' as the jurisdiction in which an
individual spends the most time. Another commenter requested
``principal residence'' be defined as the primary or most important
place of abode of an individual and at which he or she presently has an
intention of living for an indeterminate period. Another State
suggested that the definition be changed to require that a person's
principal residence be within the jurisdiction issuing the card and to
allow the States to issue exemptions. One State suggested that DHS
clarify the definition so that students, military, visitors, and others
who are temporarily residing in another jurisdiction are not required
to change their principal residences.
Response: DHS agrees that the definition of ``principal residence''
needs to be clarified in the rule. The term is defined in the final
rule as the location where a person is currently domiciled (i.e.,
presently resides even if at a temporary address) in conformance with
the residency requirements of the State of domicile, if such
requirements exist.
Comment: Commenters wrote that requiring two documents proving
residence is burdensome on certain individuals (i.e., recent movers,
minors, homeless, and those not listed as primary payer on accounts)
and suggested use of the United States Postal Service (USPS) National
Change of Address system as a verification tool. One State recommended
that the rule allow use of an on-line address verification system to
replace the two forms of address documents, at least for remote
renewals.
Response: DHS does not agree that it is too burdensome to require
an individual to produce two documents to establish his or her address
of principal residence. Since the State has maximum flexibility in
determining what documents are acceptable for this purpose, DHS
believes that the States will be able to find a combination of
documents for each person eligible to apply for a REAL ID driver's
license or identification card. DHS believes States may use the
procedures established in their exceptions processes when seeking to
document the address of principal residence of the homeless or other
individuals who may not have a fixed street address.
Comment: Commenters wrote that there are certain groups of people
including students, long-haul truck drivers, the homeless, migrant
workers, and others who do not have a single fixed address and who will
not be able to meet this requirement. One commenter requested that the
rule be strengthened by clarifying in the exceptions process that the
requirement of a fixed address will be waived as long as a REAL ID
applicant can make a showing that they have none and that they can
comply with other documentation requirements.
Response: As noted above, DHS believes that States will be able to
resolve these issues through the use of their exceptions process.
Comment: Several commenters noted the difficulty in providing a
street address because many rural addresses use rural route numbers
only, and recommended new regulatory text: ``An acceptable street
address includes rural delivery route and/or box number or other
address convention used by the USPS in all areas of the U.S. where a
number and street name has not been assigned for U.S. mail delivery.''
One commenter wrote that in its jurisdiction, it is common to find
streets with same names throughout different communities and that rural
addresses are identified by kilometers and hectometers within a street
address or neighborhood. Another commenter (a State) has islands that
do not have home addresses; mail is delivered to post offices where the
residents must go to retrieve their mail. One State noted that many
Native American populations do not have physical addresses.
Response: DHS agrees with these comments and has amended the rule
to define ``address'' as an address convention used by the USPS in
areas of the United States and Territories where a number and street
name has not been assigned for U.S. mail delivery.
Comment: One commenter wrote that address changes make up the
largest number of driver record changes and many States do not require
issuance of
[[Page 5296]]
a replacement card until the next renewal cycle. Several commenters,
including States, wrote that when an address change occurs, no REAL ID
card need be required and that it is cost prohibitive for States to
issue new documents for address changes.
Response: DHS agrees with these comments and is no longer requiring
an in-person transaction for an individual to change his or her
address. DHS also leaves it to State law and procedure when and under
what circumstances a State requires issuance of a replacement driver's
license or identification card.
4. Lawful Status Documentation
Comment: Several commenters wrote that there are many examples of
lawfully present immigrants who may not have the listed documents and
that the list should be expanded. One commenter wrote that these
omissions violate the Constitution by denying to individuals in these
classes the rights and privileges accorded to others, and stated
immigration documents do not always reflect actual status. A State
wrote that Temporary Protected Status aliens should be required to
provide documentation from DHS of an established identity. Some
commenters objected to the need for an unexpired U.S. visa on a foreign
passport. They pointed out that renewing a visa would involve foreign
travel, and in any case a visa does not authorize a stay in the U.S.
for any particular period of time. An alien with nonimmigrant status
may lawfully extend or change his or her nonimmigrant status without
maintaining a valid visa stamp. One State noted that in some cases a
passport might expire before the visa.
Response: DHS has included the list of documents as verifying
identity of the person presenting them, not lawful status. Lawful
status may be determined through verification against DHS's SAVE
system. Aliens who are granted Temporary Protected Status are already
eligible for EADs, Form I-766, and thus have a document proving
identity. DHS does not believe that this rule treats citizens and
aliens differently--each is required to prove identity and lawful
status to obtain a REAL ID driver's license. Further, DHS does not
believe that treating citizens and aliens differently is in violation
of the Constitution, but an inherent right of a sovereign nation and
one that reflects American constitutional law. Regarding the visa in a
foreign passport, DHS is not treating the visa itself as a document
establishing lawful status. Again, the check of DHS's SAVE system will
accomplish that purpose. The visa is used to verify identity and can be
verified with the issuing agency--the U.S. State Department. DHS cannot
verify, with the issuing agency as required by statute, foreign
passports because there is no guarantee that issuing a foreign
government would respond to a DMV request for a specific passport.
Finally, like all documents that verify identity, the document itself
must be unexpired to assure that a significant amount of time has not
passed such that the person's appearance has changed. This is a
fundamental rule with issuance of all types of documents that are
designed to prove a person's identity.
5. Verification of Documentation Presented
Comment: One commenter wrote that DHS should partner with AAMVA in
implementing document verification requirements. Several commenters
wrote that States need ongoing training and guidance for verification
and to be advised what to do if documents cannot be verified. A few
commenters noted that the verification of documents is only a
verification that paper contains legitimate data and not that the
applicant is the owner of the paper or that the document is authentic.
A State asked who makes the determination of whether a State's
verification procedure is ``effective.'' Several commenters wrote that
Federal electronic verification systems do not exist yet or need
significant enhancements; therefore, compliance requirements should be
delayed. One commenter wrote that States must find their own ways to
verify documents but that States lack the legal authority to force
compliance. Commenters suggested States use third party databases or
automated document authentication systems and share images to deter
identity fraud. One State asked whether it would have to re-verify
source documents if the applicant already had a REAL ID from another
State.
Response: DHS is working with AAMVA and State representatives to
design and implement verification systems to support the requirements
of the REAL ID Act and this rule. Representatives of numerous States
and the Federal agencies responsible for verification of identity
information for REAL ID and related Federal government programs are
continuing to meet to develop recommendations on prioritization of data
and document verification systems based on risk and value. Two
verification systems are currently available for use by all States--the
SSOLV system for verification of social security numbers with the SSA
and the SAVE system managed by USCIS for verifying that an applicant is
lawfully present in the United States and for how long. These systems
have been in widespread use for many years and are highly effective.
DHS is working to improve further the usability and accuracy of these
systems and to meet REAL ID-specific requirements. DHS is also working
with the appropriate Federal and nongovernmental agencies to verify
other documents and applicant data mandated by this rule. As these
systems are deployed and become widely available for use by States, DHS
plans to publish notices of availability and timetables for required
use in the Federal Register.
DHS recognizes that verification consists of two separate elements:
(1) Determining that the source document is genuine and has not been
altered; and (2) determining that the identity data contained on the
document is valid. Electronic verification systems can support these
elements. However, DHS recognizes that other methods can be employed by
States to confirm one or more elements of identity assurance.
Electronic verification systems are only one component of a suite of
measures to assure States that the applicants are who they say they are
and that they are lawfully present in the United States.
DHS recognizes that there are many different techniques for
verifying the identity and qualification of applicants and will
evaluate the effectiveness of such techniques.
Comment: AAMVA and several States wrote that a system of passport
verifications through the Department of State is not available and it
will be difficult for States to determine name matches. One commenter
wrote that States must find their own ways to verify documents but that
States lack the legal authority to force compliance. Commenters
suggested that States use third party databases or automated document
authentication systems and share images to deter identity fraud. One
State asked whether it would have to re-verify source documents if the
applicant already had a REAL ID from another State.
Response: DHS is working with the Department of State and AAMVA to
provide a capability to verify passports, U.S. visas, and other
information held by the Department of State. When this capability is
widely available for State use, DHS will publish a Notice of
Availability in the Federal Register and establish timelines for State
use of this capability. DHS is also working with Federal, State, and
nongovernmental organizations to identify and improve
[[Page 5297]]
name formats and matching algorithms used by identity verification
systems.
Comment: Commenters wrote that they supported the use of a SAVE
system to verify lawful status because State DMV staff should not have
to be immigration officials, but that many improvements needed to be
made to the system. Commenters wrote that SAVE needs to indicate the
type of pending nonimmigrant status the applicant has, as well as work
authorization information. Another commenter wrote that for students
and exchange visitors, information is provided in the Student and
Exchange Visitor Information System (SEVIS) system, but SAVE and SEVIS
are not yet linked. Several States wrote that they should not have to
pay transactional costs for Federally-mandated verification through a
Federal system.
Response: The SAVE system has proven to be a highly effective means
of verifying immigration status information for many DMVs and other
Federal and State agency users for twenty years. DHS is working with
AAMVA and USCIS to improve the usability, accuracy, and reliability of
the SAVE system even further, to include access to SEVIS and other data
through SAVE.
DHS is committed to expediting and subsidizing the improvement,
design, development, deployment, and operation of verifications systems
to support the requirements of the REAL ID Act and this rule; however,
the States have typically borne the costs of verifying the identity and
qualifications of applicants for driver's licenses and identification
cards.
Comment: Several commenters supported the use of the EVVE system,
but pointed out that it is not ready for implementation, and that an
exception process would be needed. States opposed having to bear the
costs for verification.
Response: DHS recognizes that the EVVE system is not ready for full
implementation. The final rule provides for additional time for States
to implement EVVE or another system that provides for the verification
of birth records. Verification of identity information is a valuable
tool that many DMVs utilize. Birth data is currently collected and
maintained by the States, and DHS is not seeking to Federalize these
records.
Comment: A few commenters supported the continued use of the SSOLV
system, even though manual intervention is sometimes needed and the
system is sometimes not available. One State wrote that it opposed
having to re-verify SSNs that were previously verified through SSOLV.
Response: DHS agrees that the SSOLV system is the best existing
system to verify an individual's SSN. DHS does not believe that the
short amount of time it takes a State to enter an SSN and verify it
through SSOLV is an unreasonable burden to impose, even for those
persons whose SSN was previously verified through SSOLV. Forty-eight
States and the District of Columbia currently have the capability to
verify SSNs through SSOLV or other means. This requires electronic
verification of SSNs with SSA but allows States to use other means than
SSOLV. Verification of SSNs through SSOLV costs pennies and is
typically completed in a few seconds. DHS, AAMVA, and the States are
working with SSA to improve the accuracy and reliability of the SSOLV
system.
Comment: Several States and commenters expressed concern that
States are required to verify an individual's address of principal
residence, yet DHS concedes in the rule that no such method exists.
AAMVA wrote that in order for the States to support the verification
process, DHS must clarify what the ``system of document verification
acceptable to DHS'' really means. One State wrote that DHS should
develop national standards for address requirements and verification;
AAMVA wrote that this verification should be left to the States to
determine and provide to DHS in their certification plans. Several
States wrote that development or implementation of an electronic
verification system for proof of principal residence is not feasible.
Response: DHS agrees that States are best situated to verify an
individual's address of principal residence. The rule gives States
maximum flexibility in determining an individual's address of principal
residence.
Comment: Many commenters wrote that DHS should delay implementation
of this final rule until all system components needed for verification
are in place and tested. AAMVA and several States expressed concern
about the cost for verification processes, particularly programming
costs for States to adapt State systems for the new requirements and to
establish connections with verification systems. States wrote that an
all-driver verification system is needed for implementing the REAL ID
program. Commenters suggested expanded use of the Commercial Driver
License Information System to satisfy the one-driver, one-record goal.
Some commenters objected to the concept of a national database. Some
commenters wrote that electronic verification systems must be fast and
reliable; provide real-time, accurate information; and be integrated
into the REAL ID issuance process. One commenter favored a
decentralized query system where one DMV uses an applicant's basic
identifying information to send requests to other jurisdictions. A few
States asked how a compliant State would interface with a noncompliant
State in verifying an out-of-State card. Other commenters wrote that
the requirement to check with other States to see whether a REAL ID had
been issued should apply to all driver's licenses, not just REAL ID
identification cards.
Response: Two of the critical systems for verifying Social Security
Numbers and lawful status are fully operational and currently used by
many or most States. As stated above, DHS is working with other Federal
agencies, nongovernmental agencies like AAMVA and NAPHSIS, and the
States to design and deploy additional systems as quickly as possible.
These systems will be integrated with the licensing issuance process in
each State. States cannot and will not be required to use systems that
are not fully operational and available for use.
DHS is also working with the Department of Transportation, AAMVA,
and the States to enhance the functionality of CDLIS to meet the
requirements of the REAL ID Act and this regulation. Neither the Act
nor this regulation requires the design or deployment of a new national
database or any new system of exchanging of information between States
beyond that already implemented through CDLIS and the National Driver
Register. All States currently participate in the exchange of driver
information mandated under these processes. The REAL ID final
regulation simply requires States issuing REAL ID driver's licenses or
identification cards to verify that an individual does not possess a
valid driver's license or identification card in another State. This
requirement is similar to the existing statutory and regulatory
requirements for commercial driver's licenses. When this functionality
is available, DHS will publish a Notice in the Federal Register
detailing the procedures and timeline for State-to-State exchange of
data required under the Act.
G. Exceptions Processing for Extraordinary Circumstances
Comment: Three States and three other commenters said that DHS
should set minimum standards for the
[[Page 5298]]
exceptions process so that there is consistency across the States.
However, other States noted that the process should not be too rigidly
defined, because the very nature of an exception will by necessity
deviate from the current process, and that there are too many variables
that need to be analyzed on a case-by-case basis to develop a rigid
exceptions process.
Response: DHS disagrees with the comments that DHS should establish
a uniform exceptions process for each State. DHS recognizes that each
jurisdiction may face its own unique and particular set of facts and
circumstances to resolve and that DHS is unable to address all such
circumstances. DHS believes that States must have the flexibility to
craft an exceptions process adequate to the needs of their States and
recognizes that no two State exceptions processes may be identical.
Comment: AAMVA and multiple States opposed the requirement that
States submit quarterly reports to DHS analyzing their exceptions
processes. Four of these commenters suggested that the information
could be included in a State's annual certification report instead.
Further, AAMVA and many States opposed the provision requiring State
exceptions processes to be approved by DHS and said this requirement
would reach too far into the day-to-day operations of State agencies.
Response: DHS agrees that the proposed rule's requirement for a
quarterly report on the use of the exceptions process is too burdensome
a requirement for the States. The final rule strikes the quarterly
reporting and requires States to submit a report as part of the
recertification package a State will submit to DHS in connection with
REAL ID. As necessary and appropriate, a State can designate this
report as Sensitive Security Information (SSI).
Comment: One commenter said that DHS should allow States to employ
exceptions processing on any list of documents that they deem
circumstantially appropriate. Numerous commenters opposed prohibiting
use of the exceptions process to demonstrate lawful status. In general,
these commenters believed that many legal immigrants and other groups
of people would not be able to meet the rule's requirements for proving
lawful status. One commenter said that the scope of the exceptions
process described in the proposed regulatory text does not correspond
to the scope of the exceptions process described in the rule's
preamble. The commenter urged DHS to revise the proposed regulation to
explicitly include all data elements required under the REAL ID Act
within the scope of the exceptions process.
Response: DHS agrees in part with the comments submitted. Under
this rule, the exceptions process can now also be used by a U.S.
citizen to establish his or her lawful status in the United States.
This will accommodate the needs of elderly or rural residents, for
example, who have not obtained a birth certificate but were born in the
United States. The exceptions process may not be used by non-citizens
to establish lawful status in the United States. That status must be
verified in all instances with DHS.
Comment: Several commenters requested that State records not
include a ``full explanation'' regarding why alternative documentation
was accepted. These commenters expressed concern that victims of
domestic violence would be forced to disclose their history of abuse
and that information about their location and any name changes would be
widely accessible in State databases of driver records. They
recommended that a generic statement be added to records of victims of
domestic abuse that would indicate that alternative documents were
accepted ``for reasons of public safety.'' Three commenters said that
it would not be feasible for States to mark exceptions in their data
files until they complete computer system upgrades.
Response: DHS agrees that States may use statements like ``for
reasons of public safety'' or similar generic expressions when using
the exceptions process for victims of domestic violence or others,
where the State feels it is necessary to preserve the confidentiality
of the reason the exceptions process was used.
Comment: Some commenters suggested that the exceptions process be
broadened to include specific populations of individuals who may have
problems producing the required documents, who may not spend the
majority of time at home (out-of-State students, active military
personnel), or who may not be able to come to the DMV in person
(individuals with disabilities). Other commenters, including AAMVA,
suggested that the exceptions be related to risk and could factor in
year of birth or duration of continuous relationship with the State of
licensure. Similarly, one State suggested that the rule grandfather all
current holders of driver's licenses or identification cards that were
previously verified as lawfully-present through SSOLV and/or SAVE.
Response: As noted above, DHS does not believe it would be
beneficial to establish a uniform exceptions process for all States.
DHS recognizes that each jurisdiction may face its own unique and
particular set of facts and circumstances to resolve and that DHS is
unable to address all such circumstances. DHS believes that States must
have the flexibility to craft an exceptions process adequate to the
needs of their State and recognizes that no two State exceptions
processes may be identical.
DHS does not agree with the comment that individuals can be
``grandfathered'' for REAL ID purposes. The fact that an individual
once had lawful status in the United States when checked through SAVE
is not indicative of his or her present status. As noted elsewhere
above, DHS does not believe it is burdensome to require an SSOLV check
for all persons seeking a REAL ID driver's license or identification
card.
H. Temporary or Limited-Term Driver's Licenses and Identification Cards
[Sec. 37.21]
Comment: Two commenters said that use of the term could cause
confusion with other license types and requested that another label
such as ``limited-term'' be substituted to avoid confusion. One
commenter suggested that temporary cards indicate on the face whether
the holder is a citizen or non-citizen because any immigration status
can be lost or revoked or expire at any time during life of the card.
Response: DHS agrees with these commenters. DHS has added the
phrase ``limited-term'' to avoid any confusion with existing State
licensing schemes involving temporary driver's licenses or
identification cards. The section of the rule is now entitled
``Temporary or Limited-Term Driver's Licenses and Identification
Cards.''
Comment: Two States said that matching the expiration date of a
temporary driver's license or ID card to the end date of an applicant's
authorized stay would require major internal system and business
process changes and may also require a legislative change in some
States.
Response: DHS notes that matching the expiration date of a
temporary or limited-term driver's license to the end date of an
applicant's authorized stay in the United States is a requirement of
the statute that DHS lacks the authority to change.
Comment: Several commenters opposed the provision limiting the
duration of temporary licenses or ID cards to the duration of admission
or to one year if the applicant's authorized stay does not have a fixed
expiration date. Numerous commenters cited concern with how the period
of authorized stay is determined, in the
[[Page 5299]]
event, for example, that a person has a visa that expires in two years
but the I-94 expires in two months. One country urged DHS to accept the
term of validity of the visa, which are generally valid for relatively
long periods, as the ``period of time of applicant's authorized stay.''
Response: These comments cannot be accepted. Section
202(c)(2)(C)(ii) of the Act requires that the duration of the driver's
license to be limited to the period of the person's authorized stay or
in the case of no specific period, a duration of one year. DHS does not
have the authority to amend or change this direct statutory
requirement. The period of admission will be determined not by
documents themselves, but with the use of the SAVE system which can
best identify a person's lawful period of admission. Finally, a visa
cannot be considered to be a person's period of authorized stay as a
visa only allows a person to apply for admission to the United States.
It does not represent, in any sense, permission to stay within the
United States for any particular period of time.
Comment: Commenters said that this provision would be unduly
burdensome for many individuals who have lawful status for extended
periods of time, such as F and J visa holders, and specifically
expressed concern that the rule is eliminating a long-standing
provision for J-1 participants, who, under State Department
regulations, are entitled to a thirty-day grace period after completion
of their programs to travel within the United States One of these
commenters suggested that States be allowed to use the end dates listed
on the certificates of eligibility for each of these visa types as the
``ending date'' of status for the purpose of obtaining a driver's
license.
Response: Again, the determination for lawful status in the United
States will be made by the SAVE system, not particular documents. SAVE
takes into account the grace periods to which those in certain F and J
statuses are generally entitled. It should be noted, however, that
since F and J non-immigrants are admitted for ``duration of status,''
which is an indeterminate period, they would normally be issued
licenses valid for one year.
Comment: Two States said that annual, in-person enrollment for
these individuals would provide little added homeland security value
while overcrowding DMV offices.
Response: DHS agrees in part with these comments. The final rule
provides that individuals holding REAL ID cards that are not temporary
or limited-term may renew remotely where there has been no material
change in the individual's information (i.e., name or lawful status)
and the State re-verifies the individual's lawful status and SSN where
applicable. Because lawful status can change over time, DHS believes
that it is necessary for a State to determine that these individuals
remain in lawful status prior to extending the validity period of any
REAL ID-compliant driver's license or identification card.
Comment: Three commenters asked DHS to clarify whether temporary
driver's licenses and ID cards need to have the security features of
REAL ID-compliant documents.
Response: Temporary or limited-term driver's licenses and
identification cards qualify as REAL ID-compliant documents so they
must contain the same security features as any full-term REAL ID
driver's license or identification card.
Comment: One commenter asserted that temporary driver's license or
identification cards should not be permitted because international and
foreign licenses are valid for individuals who are in the United States
for less than one year.
Response: The REAL ID Act permits States to issue temporary or
limited-term driver's licenses and identification cards. States will
continue to determine how long an individual must be present or have
residence in a State before the State requires that person to obtain a
driver's licenses or identification card. Nothing in these rules
precludes States from permitting an individual to use an international
or foreign license to operate a motor vehicle in a State.
Comment: Commenters had specific comments about how this annual
renewal provision would affect particular groups. Several domestic
abuse advocacy organizations said that the annual requirement would
give more power to abusers who have confiscated or destroyed the
identification documents of their victims. One commenter said that DHS
needs to amend the rule because the confidentiality requirements under
the Violence Against Women Act (VAWA) preclude entry of certain
immigrant victims into the SAVE system. The group suggested that if
yearly renewal is required of immigrant victims, it should use the fax-
back system developed by the INS to verify eligibility for Federal
public benefits. A State expressed concern with DHS having defined
``sexual assault,'' ``stalking,'' ``[d]omestic violence,'' and ``dating
violence'' in establishing exceptions for the REAL ID requirement to
display an individual's principal residence address on the license or
identification card. The State argues that the proposed regulation
would require that any State wishing to comply with the regulations
must adopt the Federal definition of these crimes. This commenter
argues that DHS can avoid this Federalism implication by allowing
States to continue to decide who should be protected under address
confidentiality programs.
Response: DHS agrees, in part, with these comments. The final rule
clarifies any misperception in the NPRM that a State would have to
adopt the VAWA definition of certain terms, and makes it clear that
States can continue to enroll and safeguard victims based on their own
laws. DHS disagrees with the comments that the renewal requirement
conflicts with any provisions of VAWA. If an individual's identity
documents have been destroyed by an abuser, a State can address this
situation through its exceptions process.
Comment: AAMVA, two other commenters, and four States expressed
concern with the proposed requirement that a temporary document clearly
state on its face that it is temporary. The commenters said that
modifying cards to comply with the proposed rule would be costly and
suggested that the rule instead allow States to use a restriction code
on the front with clarifying language on the back. One State requested
that DHS provide the exact wording that must be displayed on the face
of a temporary card. One privacy group said that identifying the card
as temporary on its face would amount to a ``scarlet letter'' for
immigrants and would lead to discriminatory interactions with police
and other individuals. One State commented that it does not support the
``facial branding'' of cards.
Response: DHS does not agree with these comments and has clarified
the rule to state that a temporary or limited-term license must
indicate on the license and in the machine-readable zone that it is
temporary. States may use different methods to indicate the temporary
nature of the license, such as using restriction codes on the front of
the card and explanatory text on the back of the card.
Comment: AAMVA and one State said that they support in-person
renewals for temporary REAL ID driver's licenses or identification
cards because lawful status can change and the population of
individuals with temporary lawful status is far smaller and easier to
manage with in-person renewals than the larger population of U.S.
citizens. In contrast, one State requested that DHS allow applicants to
mail in copies of the appropriate documents proving lawful status as
long as the State verifies the information via the SAVE system. One
[[Page 5300]]
commenter suggested that foreign students be allowed to renew online if
they are required to do so annually. One State questioned how many one-
year terms of extension would be permitted if length of stay is not
specified on a submitted Federal immigration document. Two States wrote
that after an applicant obtains a REAL ID card, the applicant should
not have to re-supply source documents for renewals or conversions.
Several States suggested that the rule state that notice of change of
address may be made on-line or by mail as long as electronic
verification can be accomplished.
Response: DHS agrees with the AAMVA comment that individuals
holding a temporary or limited-term license must renew in person in
order to present evidence of continued lawful status. DHS believes that
this is necessary because lawful status can change, and this policy is
consistent with the language of the REAL ID Act. As such, the
requirement remains unchanged from the NPRM.
Changes of address may be made on-line, by mail, or as otherwise
permitted by the DMV. There are no limits on how many years a State can
issue a one-year license or identification card to an individual who is
present for an undetermined ``duration of status'' as long as that
individual remains in that lawful status or another.
Comment: Numerous States expressed concern that the current
processing time involved in USCIS review of applications for various
immigration statuses impacted by REAL ID will result in a large number
of applicants who wish to renew their licenses but their applications
to extend their status has not been acted on by USCIS within the year.
Two States suggested that States issue interim documents that would be
valid for very short periods until an applicant receives his or her
permanent document demonstrating lawful status. Another commenter
suggested that such an interim card be based on the applicant's visa
until authorization is received and verified through SAVE, which should
be programmed to contact the querying State when there is an updated
applicant status. One commenter recommended that the rule allow States
to use a license expiration date 90 days beyond the expiration date of
the immigration document to allow for USCIS processing of applications
to extend lawful status. Commenters said that individuals in certain
statuses will not be able to comply with the requirement to present
documentation showing extended lawful status upon renewal because in
most cases, their statuses will not have been extended but merely
continued.
Response: Again, State DMVs will use the SAVE system, and not
particular documentation, to determine that the license applicant is in
lawful status. An application that is properly filed with USCIS
entitles the person to remain in lawful status beyond the period listed
on the person's Form I-94 or other immigration document, that
information is reflected in the SAVE system. Thus, aliens in these
situations would be able to obtain REAL ID-compliant licenses and
States would not have to add any additional processes with USCIS.
I. Minimum Driver's License or Identification Card Data Element
Requirements
1. Full Legal Name
Comment: Many commenters raised issues about the concept of full
legal name. One commenter stated that the provision infringes on powers
reserved to the States in that it dictates to the States acceptable
methods for name changes, and that it effectively nullifies the common
law name change process that some States permit. Proposed Sec.
37.11(c)(2) would have required the applicant to present documents
showing a legal name change, but several commenters pointed out that
these documents may come from local or foreign government sources in
addition to Federal and State governments. Two States opposed the
proposed requirement to present these documents, and an individual
opposed having name change information on the REAL ID. One State
suggested that the rule also should provide instructions for
individuals whose gender has been legally changed.
Response: DHS agrees that where State law or regulation permits an
individual to establish a name other than that contained on the
identity document he or she presents for a REAL ID driver's license or
identification card, the State shall maintain copies of the
documentation presented pursuant to Sec. 37.31 and maintain a record
of both the recorded name and the name on the source documents in a
manner to be determined by the State. The use of initials or nicknames
shall not be permitted, except to the extent that an initial is
necessary to truncate a name longer than 39 characters in length, in
which case the name should be truncated pursuant to ICAO-9303
standards. DHS also agrees that local or foreign government-issued
documents can be used to establish a name history. The final rule
reflects these changes.
Comment: Numerous States and AAMVA stated that there is no standard
naming convention for Federal agencies and as a result passports,
immigration documents, and social security cards list disparate names,
making identifying the full legal name difficult. Many States commented
that the Federal government needs to adopt a single standard for full
legal name and apply it to all Federal records, rather than depending
on the State DMVs to resolve this in the face of multiple Federal
approaches. Due to discrepancies among naming conventions, one
commenter suggested that DHS provide a list of most acceptable to least
acceptable documents used to establish full legal name. Several
commenters wrote that documents evidencing a name change may come from
local or foreign government sources in addition to Federal and State
governments.
Response: DHS agrees that there is no standard naming convention
currently used by Federal agencies. It would be beyond the scope of
DHS's rulemaking authority to impose such a convention on all Federal
agencies. Nevertheless, the lack of a common Federal standard does not
mean that DHS should not establish minimum standards for the States to
follow as required by the REAL ID Act. However, based on comments
received, DHS is slightly modifying the definition of the definition of
``full legal name'' to bring it closer to existing name conventions
used by the Social Security Administration, the Department of State,
and other issuers of source documents.
Comment: AAMVA and numerous States commented that the States need
flexibility and DHS should drop the prohibition against using initials
and nicknames. One State wrote that the name on the driver's license
should be the one the person chooses to use, with the full legal name
stored in the database and in the MRZ, and that without common naming
conventions, it is imprudent to assume that a regulatory requirement
forcing the public to adopt a single name will achieve any desired end.
One State commented that it should be able to use an alternative name
if the applicant's source documents clearly show a link between that
name and the name presented on other source documents.
Response: As noted above, DHS agrees that where State law permits
an individual to establish a name other than that contained on the
identity document presented for a REAL ID driver's license or
identification card, the State must maintain a record of how the name
was established in a manner to be prescribed by the State. The use
[[Page 5301]]
of initials or nicknames shall not be permitted, except to the extent
that an initial is necessary to truncate a name longer than 39
characters in length, in which case the name should be truncated
pursuant to ICAO-9303 standards. Where the individual has only one
name, that name should be entered in the last name or family name
field, and the first and middle name fields should be left blank. Place
holders such as NFN and NMN should not be used.
Comment: Both States and victim advocacy groups objected to the
full legal name requirement because the rule would not provide
exceptions for victims of domestic violence. The rule would require
that past names be included in DMV records, which would expose victims
to danger. In addition, the SSA requires victims to change their names
before changing SSNs and prohibits them from revealing previous names
and SSNs. Commenters wrote that the proposed rule conflicts with this
prohibition by requiring that the previous names be revealed as well as
with the court orders under which many victims are granted new
identities.
Response: The REAL ID Act does not include any exceptions for
victims of domestic violence not to provide their full legal names.
DMVs may want to take appropriate measures to protect the
confidentiality of those records so that a stalker or victimizer could
not use the DMV database to locate the individual.
Comment: Many commenters noted concern with the name requirement
for the MRZ, particularly inclusion of the name history on the MRZ.
States questioned whether some name histories would fit on the MRZ.
Others questioned the need for the requirement if the history is
available in the State DMV database and cited the potential for abuse.
Many also commented that the requirement would result in a complete
rewrite of States' systems and is one of the most costly parts of the
rule. For example, one State commented that the 125-character field
would delay its implementation for 3 to 5 years until it can obtain a
new mainframe.
Response: DHS agrees with the comments and is no longer requiring
that the name history be stored on the MRZ.
Comment: One State asked for guidelines for translating names from
other alphabets: a name in the Cyrillic alphabet can be changed to the
Latin alphabet a variety of ways. Another commenter recommended
referencing the AAMVA name specifications generically rather than a
particular edition. The commenter also suggested changing ``Roman
alphabet'' to ``Latin alphabet.'' Commenters noted other problems with
the full legal name requirement, such as naming conventions in other
countries and cultures, conversion of these names onto various
immigration documents, and the ``Americanization'' of foreign names
when living in the United States.
Response: DHS has changed ``Roman'' alphabet to ``Latin'' alphabet
in the final rule. DHS is not requiring any particular transliteration
method, but notes that both AAMVA and ICAO have published standards
that address the issues raised in these comments.
2. Gender
Comment: Two States raised issues about how gender is determined
for transgender individuals and whether gender will be included as a
verifiable identifier through EVVE.
Response: DHS will leave the determination of gender up to the
States since different States have different requirements concerning
when, and under what circumstances, a transgendered individual should
be identified as another gender. Data fields in EVVE are outside the
scope of this rulemaking.
3. Digital Photograph
Comment: A number of States objected to the requirement to take the
applicant's photograph at the beginning of the licensing process
because doing so would require extensive changes to State processes,
facilities, and vendor contracts. According to one commenter, only
seven States currently take an applicant's photo at the beginning of
the process. One State requested a cost-benefit analysis for taking the
photograph at the start of the process. One commenter suggested using
an inexpensive image capture at first, then replacing the image with
the final digital photo on issuance.
Response: Under Sec. 202(d)(3) of the REAL ID Act, States must
subject each person applying for a driver's license or identification
card to a mandatory facial image capture. Submission of an application
for a driver's license occurs at the beginning of the licensing
process, and as such, requires that the photo be taken at the beginning
of the process. Additionally, from a law enforcement and operational
perspective, an up-front image capture process serves as a deterrent to
individuals attempting to present fraudulent documents or to ``office
shop'' within a jurisdiction when their application may have been
already denied in another office.
Comment: A number of commenters objected to the requirement for a
color photograph because it would bar the use of laser engraving. One
commenter stated that photographs are better for checking identities.
However, AAMVA and other States recommended that the required image be
in color.
Response: DHS agrees with those commenters that a black and white
photograph should also be acceptable in order to facilitate the use of
laser engraving technology by States choosing to employ this technology
to deter counterfeiters, and the altering and tampering of their
driver's licenses and identification cards. The final rule has been
changed accordingly.
Comment: One commenter suggested that DHS replace the ICAO 9303
standard's aspect ratio with the AAMVA's aspect ratio, which is the
Universal Camera Aspect Ratio.
Response: DHS believes the proposed ICAO aspect ratio, with an
Image Width: Image Height aspect ratio range of 1:1.25 and 1:1.34, will
accommodate the AAMVA Universal Camera Aspect Ratio of 1:1.33.
Comment: Several commenters wrote that requiring photographs could
burden the free exercise of religion for some groups, such as Amish
Christians and Muslim women. One commenter noted that banning the
wearing of veils and scarves would require new State legislation.
Another commenter asked DHS to clarify that a person may not wear any
garment that affects the reliability of facial recognition
technologies. Another State said the regulation should require States
to refuse a license or ID to anyone who appears in disguise or distorts
the face when photographed.
Response: As DHS stated in the preamble to the NPRM, the REAL ID
Act requires a facial photograph, which serves important security
purposes. Given these security concerns and the clear statutory
mandate, DHS believes that a driver's license or identification card
issued without a photograph could not be issued as a REAL ID-compliant
driver's license or identification card. Many States now issue non-
photo driver's licenses or identification cards based on the
applicant's religious beliefs. States may continue to issue these
driver's licenses or identification cards to such individuals and DHS
recommends that these driver's licenses and identification cards be
issued in accordance with the rules for non-compliant driver's licenses
and identification cards at Sec. 37.71.
While the final rule does not specifically address individuals who
appear in disguise or who distort their face when photographed, DHS
expects that States will implement their own
[[Page 5302]]
procedures to ensure that the photographs are accurate representations
of the individuals.
Comment: Some States objected to the requirement for a profile
photograph for people under 21 years of age because it will defeat
biometric facial recognition systems. One commenter suggested printing
the cards with a different orientation to differentiate under-21
licensees while allowing for facial recognition technologies.
Response: A typographical error in the NPRM left the misimpression
that DHS was requiring a profile photograph for individuals under age
21. The final rule does not require a profile photograph for people
under 21, and instead requires a full facial digital photograph.
Comment: One commenter recommended that States be required to share
their images. Another State commented that the requirement to retain
images of people suspected of fraud would mean that they had to keep
all images because the suspicion of fraud may occur long after the
license is issued, and data storage costs would be significant.
Response: DHS agrees that there would be substantial value in
preventing the acquisition of multiple identity documents if States
were able to exchange images of their license holders with one another.
DHS believes that the States have the same interest and therefore
States must ensure that the same individual does not have multiple
driver's licenses or identification cards from the same State. DHS also
encourages States to participate in AAMVA Fraud Early Warning System
(FEWS) or similar system for exchanging information on fraud or
attempted fraud in the issuance of driver's licenses or identification
cards. DHS believes that the volume of images of individuals who start,
but do not complete the application process, will not be so great as to
impose substantial data storage costs on the States.
4. Address of Principal Residence
Comment: One State noted that it has a ``homeless exception'' to
its proof of residency requirement where proof of residency documents
are waived if the applicant provides a letter, on letterhead, signed by
the director of a homeless shelter, certifying that the individual is
homeless and stays at that shelter. It suggested that this be an
acceptable action under an ``exceptions process'' for the homeless.
Other States voiced concern that the rule does not address the ``truly
homeless,'' those not living in a shelter.
Response: DHS agrees that a letter, on letterhead, signed by the
director of the homeless shelter, certifying that an individual is
homeless and stays at that shelter, should be sufficient to establish
an individual's address of principal residence under a State's
exceptions process. As noted above, States have wide latitude to
address issues concerning an individual's address of principal
residence within their State-specific exceptions process.
Comment: AAMVA, other commenters, and many States commented that
DHS allow States the authority to provide for the confidentiality of
individual's address of principal residence, including the categories
of individuals who would be subject to the address exception. One
commenter suggested that DHS devise standard rules governing address
confidentiality rather than allowing each State to devise separate and
unique requirements. One State claimed that a confidential address
program is unnecessary.
Response: DHS agrees that States should have broad authority to
protect the confidentiality of the address of principal residence for
certain classes of individuals. DHS has added additional clarifying
language in the final rule that should help to alleviate any
uncertainties.
Comment: Numerous commenters claimed that the confidential address
provision in the rule did not address all individuals who may have
legitimate reasons for protecting their addresses from public
disclosure. Commenters noted that Sec. 37.17(f)(1) was too narrow and
would not qualify individuals who would otherwise be protected under
State law. Several States recommended additional address exceptions for
the following categories: sitting and former judges, Federal officials
in limited circumstances, covert law enforcement officers as long as
the officer provides a letter of authorization, State administrative
personnel engaged in law enforcement, participants in the witness
protection program, and victims of domestic violence. One commenter
stated that the exemption should include family members when laws or
court orders suppress the addresses of those individuals.
One commenter claimed that the partial exemption to the principal
address requirement is inadequate by removing the option of not listing
an address and relying solely on State laws that cover a limited number
of individuals. The commenter noted that only 24 States have
confidentiality programs in place, which is a requirement for the
exemption to apply. Victims in the remaining jurisdictions will not be
protected unless they can obtain a court order suppressing their
addresses. Another commenter wrote that States have created formal
address confidentiality programs and have also provided general
measures of residential address privacy and this rule overrides these
substantial protections.
Response: As noted above, DHS agrees that States should have broad
authority to protect the confidentiality of addresses. DHS has
clarified language in the final rule so that it is clear that a DMV may
apply an alternate address on a driver's license or identification card
if the individual's address is entitled to be suppressed under State or
Federal law or suppressed by a court order including an administrative
order issued by a State or Federal court.
Comment: A few States claimed that use of alternative addresses is
justified on the REAL ID cards, but that the principal residence must
be captured and stored in a secure database. They requested
clarification from DHS on how States would meet the requirements
related to the protection of the principal residence addresses. Another
State noted that it has no confidential address program, but it permits
a post office box to be displayed on the identification document if
requested, but again it retains the permanent address in a database.
One commenter stated that the better level of protection would be to
note in the MRZ that the individual's address is protected and provide
a pointer to whatever relevant authority handles those addresses for
that jurisdiction. This process would also serve a secondary purpose in
that anyone seeking the address would make a request that could be
logged and validated.
Response: DHS agrees that an individual's true address must be
captured and stored in a secure manner in the DMV database even if an
alternate address appears on the face and MRZ portions of the driver's
license or identification card.
Comment: One commenter recommended that the final rule allow courts
to issue administrative orders suppressing the collection of REAL ID
information or its display on identification documents in any
jurisdiction where the legislature has not acted to protect privacy.
Response: DHS agrees with this comment and has changed the final
rule to reflect that an address may be suppressed by a court order
including an administrative order issued by a State or Federal court.
[[Page 5303]]
5. Signature
Comment: Two States and another commenter stated that the rule
needs to allow for people who cannot sign the card, such as minors, and
older or disabled persons. If States use a signature match, an
alternative process must be available.
Response: DHS agrees with these comments. Section 37.17(g) now
provides that a State ``shall establish alternative procedures for
individuals unable to sign their names.'' This language gives the
States wide latitude in how to address situations where an individual
is unable to sign his or her driver's license or identification card.
6. Physical Security Features
Comment: Numerous States and other commenters stated that DHS
should provide security objectives or performance standards, and not
specify particular technologies, materials, or methods. AAMVA wrote
that States are using the AAMVA Driver Licensing/Identification Card
Design Specification as the minimum standard and to change direction
now would be costly for States. AAMVA further commented that
restricting all State-issued driver's licenses and identification cards
to a single security configuration could introduce new security
vulnerabilities rather than protect the driver's licenses and
identification cards against fraud. AAMVA wrote that it is not aware of
any jurisdiction that uses all the listed security features with the
proposed card stock in its card design or production. Numerous
commenters stated that the proposed requirements would eliminate over-
the-counter issuance systems and place an unnecessary financial burden
on States.
Response: DHS understands that there are challenges States may face
in producing secure driver's licenses and identification cards. The
final rule removes requirements to use specific technologies, and
provides the flexibility for States to implement solutions using a
combined set of security features that provide maximum resistance to
counterfeiting, alteration, substitution, and the creation of
fraudulent documents from legitimate documents. DHS will work with
stakeholders to develop performance standards and a methodology for
adversarial testing.
Comment: Commenters were concerned that DHS was not targeting its
security enhancement properly, and that increased security features
would not accomplish the goal of reducing fraud. AAMVA and another
State commented that major DMV fraud and abuse issues are not
associated with the cards, but with source documents that cannot be
verified, system breakdowns, and people who breach integrity. Another
State commented that unless airports, Federal facilities, and nuclear
plants have document authentication systems, implementation of REAL ID
is without purpose. One State also stated that unless inspectors are
trained in fraud detection or equipment is available for detection,
fraud will continue. One commenter recommended that the AAMVA
fraudulent document recognition training be used.
Response: DHS agrees, generally, that no single solution eliminates
all fraud relating to an identity document. That is why the NPRM
proposed, and the final rule requires, steps to improve internal
procedures at DMVs as well as the physical driver's license or
identification card issued by the States. DHS agrees that fraud
detection training is an important element in an anti-fraud regime and
endorses the use of AAMVA's fraudulent document recognition training or
equivalent by the States.
Comment: AAMVA stated that States cannot consider making any
changes until existing contracts with card integrators expire or they
will face high penalties for breaking existing contracts; any change
would require States to proceed though the competitive bidding
processes, evaluate proposals, award new contracts, and implement the
complex and expensive process of re-engineering their issuance
processes. Any wholesale change in card design will be costly, complex,
and time consuming. Several States also noted that contractual
processes will slow implementation.
Response: DHS understands that existing vendor contracts make it
difficult for some States to make changes during the term of their card
contracts. The final rule provides flexibility in card solutions. DHS
will require States to take appropriate measures to issue driver's
licenses and identification cards that are resistant to tampering,
alteration or counterfeiting.
Comment: Commenters, particularly States that issue driver's
licenses and identification cards ``over the counter,'' objected to
check digit specification, unique serial number, application of
variable data, and laser printing. One commenter supported associating
card stock serial number with a customer. One State agreed with
incorporation into the card of taggant (a radio frequency
identification chip) and marker, but said that only State employees
need to know if the State is using such embedded technology. One State
noted that it uses seventeen overt, covert, and forensic security
features to make counterfeiting difficult; it recommended that States
use different designs and combinations of security features to deter
counterfeiters. One commenter wrote that the proposed rule includes a
requirement for an optically variable feature and suggests that a
``diffractive optically variable feature'' be included to enhance
protection. The commenter said it is unclear how this feature enhances
protection over existing State-issued driver's licenses and
identification cards as many already use such technology. The commenter
recommended optically variable ink as a security feature. This ink
technology, currently used in U.S. passports and outlined in the FIPS
201 security standards, is not reproducible using commonly used or
available technologies, and requires much less training to authenticate
quickly. No readers or special equipment are required to observe the
color shifting effect, meeting the requirements in the proposed rule
for a Level 1 security feature. Additional forensic security, such as
micro-flakes with etched on numbers, logos or words that are visible
under low-power magnification can be included in the micro-flakes of
the overt optically variable color shift technology, meeting the
requirements in the proposed rule for Level 2 and Level 3 security
features.
Response: The final rule provides for a performance-based, not
prescriptive, approach to card solutions. Specific security
requirements are not mandated in the rule. However, the final rule
includes requirements for three levels of document security designed to
provide maximum resistance to counterfeiting, alteration, substitution,
and the creation of fraudulent documents from legitimate documents that
are not reproducible using common or available technologies. DHS
encourages States to explore the range of existing and still-to-be
developed technologies in this area. The final rule requires States to
use card stock and printing materials that are not widely available
commercially in order to significantly decrease the likelihood that a
driver's license or identification card could be easily counterfeited
or altered.
Comment: One commenter recommended inclusion of a digital signature
as a Level 3 security feature.
Response: The final rule provides for performance-based, not
prescriptive requirements for implementation. While digital signatures
offer a higher level of security, States may choose to invest in other,
similarly secure technologies.
[[Page 5304]]
DHS encourages States to consider the use of this and other security
features.
Comment: States asked for clarification as to the meanings of
``inspector,'' ``microline text,'' ``micro print,'' ``external
surfaces,'' ``taggant,'' and ``marker.''
Response: DHS has removed the requirements involving these terms,
so does not need to clarify these terms.
Comment: Two commenters stated that security features should not
make it impossible to copy or create a digital image of a license, and
that the rule should make it clear that any print on the image must not
obscure the features. One State asked that DHS remove language
forbidding reproducible security features and retain Sec. 37.15(f)(2).
Response: DHS agrees that the security features employed should not
make it impossible to copy or create a digital image of a license. Many
private sector industries, including the banking sector, often need to
reproduce and retain a copy of an individual account holder's driver's
license or identification card. DHS also agrees that print on the image
should not obscure the individual's features.
Comment: One commenter recommended incorporating some security
features in the substrate.
Response: The final rule requires level 1, 2 and 3 security
features that provide multiple layers of security, and States may adopt
security features that meet their needs, including incorporating
security features into the substrate.
Comment: One commenter stated that requiring a color photo and
laser printing means that two printers will be needed.
Response: The final rule allows for either a color or black and
white photograph. Laser engraving, while a very effective security
measure, is not a requirement of this rule.
Comment: One State commented that it currently uses adversarial
testing for its cards and provided detailed information on its process.
AAMVA and several States said that there are no adversarial testing
standards and that DHS should develop them and either take
responsibility for testing the cards or certify the testing
organizations. Another commenter recommended that there should be a
single center for adversarial testing using a single set of criteria to
avoid the undue influence of vendors and disparate standards. Some
States suggested alternatives to adversarial testing, such as card
design security programs or security audits. One commenter suggested
that adversarial testing occur only if the State card has changed
rather than annually. Another commenter recommended testing every five
years or at contract changes.
Response: The development of standards and adversarial analysis and
testing of driver's licenses and identification cards is an effective
approach to ensuring that these documents provide maximum resistance to
counterfeiting, simulation, alteration and creation of fraudulent
driver's licenses and identification cards. DHS will work to develop
performance standards and adversarial analysis and testing.
Independent adversarial testing is an important tool in limiting
the ability of someone to tamper, alter, or counterfeit a driver's
license or identification card. DHS agrees with the comments that there
are no recognized testing standards to date and a lack of available and
accredited testing facilities. Therefore, DHS has removed the
requirement for States to obtain an independent adversarial test of
their card security.
Comment: Numerous commenters objected to the card stock
requirement, stating that the NPRM design specification essentially
calls for polycarbonate material and AAMVA and its members do not
support polycarbonate as the only option for the cards. This material
is not used anywhere in the United States today, is the highest cost
card material in production today, and is only available from a limited
number of vendors, which negates State requirements for competitive
bidding. Another commenter noted an inconsistency between polycarbonate
card stock and the requirement to meet ICAO 9303. The ICAO standard
requires a color photo, but polycarbonate card stock allows only black
and white photos.
Privacy groups supported use of polycarbonate cardstock in
conjunction with laser engraving because laser engraving on other card
stocks may be removable. One commenter indicated that other stocks
would function as well. Another commenter stated that requirements for
card stock durability should be based on the renewal period used by the
State. One State asked to whom missing card stock should be reported.
Response: The final rule reflects a less-prescriptive approach to
card security, and does not mandate the use of a specific card stock
and prescriptive security features. The final rule requires States to
use card stock and printing methods that are not widely available
commercially in order to significantly decrease the likelihood that a
driver's license or identification card can easily be counterfeited or
altered. States should develop and utilize a system of reporting
missing card stock and other secure supplies and equipment related to
the production of driver's licenses and identification cards to other
State DMVs and law enforcement.
7. Machine Readable Technology
Comment: Privacy groups and several States recommended laws
limiting the collection and storage of Machine Readable Zone (MRZ) data
by third parties. Several other States commented on the importance of
accessibility for law enforcement and noted that the same information
is available on the front of the identification cards in human-readable
form. Some commenters wanted MRZ access restricted to law enforcement,
while others supported also providing access for bars and liquor stores
to help prevent underage drinking but limiting their collection and
storage of the personal information. One commenter stated that nothing
in the REAL ID Act authorizes Federal agencies to read and collect
information contained in the MRZ and cited to the Conference Report
statement that the MRZ must only be able to be read by law enforcement
officials. One commenter opposed any indication in the MRZ that a
person was an owner or buyer of firearms or was licensed to carry a
firearm; the commenter also asked that DHS forbid the inclusion of this
information unless required by State law.
Response: The REAL ID Act does not provide DHS with authority to
prohibit third party private-sector uses of the information stored on
the REAL ID card. As noted in the proposed rule and the PIA issued in
conjunction with the rulemaking, at least four States (California,
Nebraska, New Hampshire, and Texas) currently limit third-party use of
the MRZ, and AAMVA has issued a model Act limiting such use. DHS
encourages other States to take similar steps to protect the
information stored in the MRZ from unauthorized access and collection.
In response to commenters urging that the rule limit Federal agency
access to the MRZ, DHS is not aware of any current plans by Federal
agencies to collect and maintain any of the information stored in the
MRZ. If a Federal agency should decide to use the MRZ to collect and
maintain personally identifiable information in the future, any such
information collected from the MRZ will, of course, be subject to the
protections of the Privacy Act and other Federal laws and policies
regulating the use and handling of personally identifiable information.
This final rule does not require (and the NPRM did not propose) that
the MRZ
[[Page 5305]]
contain any information about firearm ownership.
Comment: Many commenters suggested data elements that should or
should not be in the MRZ. AAMVA stated that the final rule should limit
the MRZ elements to those set out in its driver license card design
standard. Another commenter wrote that DHS should set the minimum data
elements in the MRZ at zero and the maximum at full legal name, date of
birth, and license number. Other commenters stated that data on the MRZ
should be limited to what is on the face of the document. One State
recommended inclusion of the issuing State in the MRZ to facilitate the
routing of NCIC inquiries by law enforcement agencies using in-car bar
code reading equipment. Another commenter suggested limiting the MRZ
data to a pointer that does not correspond to the ID number that would
link to a database limited to law enforcement. One commenter
recommended including the digital image in the MRZ using the ISO/IEC
18013-2 standard. Two States opposed including an inventory control
number (ICN). One commenter objected to the PDF standard because the
NPRM preamble had referenced adopting most of the data elements in the
2005 AAMVA Driver's License/Identification Card Design, which includes
coding for race.
Response: The final rule mandates that the States use the PDF417 2D
bar code standard with the following defined minimum data elements:
Expiration date; holder's legal name; issue or transaction date; date
of birth; gender; address; unique identification number; revision date
(indicating the most recent change or modification to the visible
format of the license or identification card); inventory control number
of the physical document; and State or territory of issuance. The
proposal in the NPRM to include the full name history, including all
name changes, has been dropped. Race is not a data element contemplated
in this rulemaking and the reference in the NPRM to the AAMVA standard
was not intended to include race as a data element in the MRZ for REAL
ID.
The majority of commenters on the issue of data elements
recommended limiting the data elements to those needed by law
enforcement and the DMVs to carry out their duties. The final rule sets
the minimum elements to include, but recognizes the authority of the
individual States to add other elements such as biometrics, which some
currently include in their cards.
Changes in technology in the future may enable the States to reduce
the elements to a pointer that would electronically link to a database
and provide only authorized parties access to information that today is
stored in the MRZ. The current technology available to State DMVs and
most law enforcement officers, however, does not provide that
capability.
Comment: Several commenters said the 2D barcode is easily copied
and reproduced. One commenter supported the 2D barcode, but noted that
it is not meant to be a security feature; the 2D barcode does not allow
an upgrade of an encryption scheme, does not employ dynamic forms of
authentication, does not store audit trails, and does not use other
security features. One commenter stated that the rule for the barcode
was insufficient, particularly that there was no barcode standard
specified which would facilitate the common machine readable technology
requirement mandated by the REAL ID Act. Two existing standards could
provide the basis for what is needed: One is the AAMVA format and the
other is the format in the draft of part 2 ISO standard 18012. However,
the proposed rule required fields that are specified differently or are
just not in either of these standards. One commenter objected to the
standard because the selected version includes coding for race. One
commenter stated that mandatory requirements make it difficult to keep
up with technology. A security group and one State stated the bar code
should include a revision date.
Response: DHS recognizes that a 2D barcode may have security
vulnerabilities and technology limitations compared to other available
technologies. However, the PDF417 2D barcode is already used by 45
jurisdictions and law enforcement officials across the country. A
different technology choice could hamper law enforcement efforts and
may pose an additional financial burden on the States. DHS supports
efforts of States to explore additional possible technologies in
addition to the PDF417 2D barcode.
DHS disagrees with the notion that the standard selected should be
rejected because it includes coding for race. DHS has never stated that
race should be encoded on the license, and specifically stated in the
proposed rule that it was not incorporating wholesale the card data
elements currently required by AAMVA.
Comment: One commenter supported the decision to omit an RFID
device. It stated, however, that the NPRM does not discuss what
information from a card should be made available digitally and what
purpose it would serve.
Response: DHS is not requiring that States employ RFID in REAL ID
Act cards; rather the only technology required by the final rule is the
use of the PDF417 bar code, which most States already use on their
cards. The information stored on the MRZ enables law enforcement
officers to compare the information on the MRZ with the information on
the front of the card to determine whether any of the information on
the front has been altered and to automatically populate law
enforcement reports, increasing officer safety. The ability to run the
MRZ through a scanner device also enables an officer to quickly
retrieve the information on the card and request from their dispatch
office additional information on the individual, while maintaining
visual contact with a suspect, a safety consideration for the officer.
8. Encryption of MRZ Information
Comment: Commenters were divided on whether some or all data in the
MRZ should be encrypted. In general, groups concerned with privacy
issues supported encryption, although one commenter argued that
encryption would provide a false sense of security. Three States
supported encrypting MRZ data. Groups supporting encryption cited the
following:
--The capture of data by other users, such as financial, retail, or
commercial institutions that could retain, use, and sell the personal
data.
--The possible inclusion of additional private information in MRZ, such
as residential address, race, [trans]gender, or legal name history that
could expose the holder to harm if captured and revealed.
--Congressional intent to limit use of the data to law enforcement.
Some commenters stated that if DHS does not mandate encryption, it
should at least not prohibit it. Others supported encryption of only
some data, specifically data not available on the front of the card.
One supporter stated that DHS should have done a comprehensive analysis
of encryption systems and their costs and presented that data.
Numerous other commenters, including the States and AAMVA, opposed
encrypting the data. Other commenters were divided among those who
believed it is feasible to encrypt the data, those who considered it
infeasible, and those who offered alternative technologies,
particularly smart cards and public key infrastructure. Commenters
opposing encryption cited the following reasons:
[[Page 5306]]
--The difficulty of managing encryption keys that could be used to
decrypt any REAL ID. If a single key was used, once the key was
compromised, every driver's license issued with the key would be
insecure. If multiple keys are used (e.g., different keys for each
State), then every law enforcement agency would have to be able to
access all of the keys. Multiple keys would limit the threat because
key compromise would affect fewer driver's licenses, but would increase
the difficulty of using the MRZ data across the country. Once a key is
compromised, any license issued using that key would have to be
replaced to be secure.
--The cost of systems for law enforcement. The costs cited included the
cost to replace existing readers plus the cost of setting up an
encryption system and the ongoing costs of managing keys.
--The additional time required for law enforcement. Particularly if
multiple keys are used, law enforcement and DMV officials may need more
time to read the data. This added time requirement would limit the
ability to check the validity of documents quickly, particularly those
from other States.
--The inability of non-law enforcement to use the data to verify the
validity of the information on the face of the card. Businesses also
use the MRZ data to determine if the document is genuine. Eliminating
that ability would harm businesses that rely on the driver's license
and would affect the ability of restaurants and bars to confirm ages.
These businesses can help identify criminal use of false documents
using the MRZ. Some commenters argued that the government should set
limits on the retention and use of the data rather than encrypt the
MRZ.
--The futility of encrypting data present on the front of the card.
Commenters stated that if the data included in the MRZ are readable on
the front of the card, encrypting the MRZ provides no protection
because optical scanning readers are capable of translating the card
data into a database. The information can also be copied or
transcribed.
Response: DHS considered the many comments on this issue and
acknowledges that the skimming of the personally identifiable
information from the MRZ raises important privacy concerns.
Nevertheless, given law enforcement's need for easy access to the
information and the complexities and costs of implementing an
encryption infrastructure, no encryption of the MRZ will be required at
this time. If the States collectively determine that it is feasible to
introduce encryption in the future, DHS will consider such an effort,
as long as the encryption program enables law enforcement to have easy
access to the information in the MRZ. Moreover, DHS, in consultation
with the States, DOT, and after providing for public comment, is open
to considering technology alternatives to the PDF417 2D bar code in the
future to provide greater privacy protections.
J. Validity Period and Renewals of REAL ID Driver's Licenses and
Identification Cards
1. Validity Period
Comment: At least two commenters said that the proposed eight-year
validity period is too long, because it would give counterfeiters and
forgers too much time to learn how to simulate or alter cards in
circulation. The groups recommended that DHS require States to adopt a
validity period of no more than five years. AAMVA and one State said
that State DMVs should be allowed to determine the duration of their
licenses based on business processes and needs. A few States said that
a validity period of no more than eight years would create difficulties
for elderly and some disabled persons who are clearly not national
security risks. These States asked for the flexibility to grandfather
these populations or to issue cards with extended validity periods.
Response: The REAL ID Act establishes a maximum license validity
period of eight years. Nothing in the Act or the rules precludes a
State from adopting a shorter validity period for business, security,
or other needs.
2. Reverification of Source Document Information
Comment: AAMVA and several States expressed strong opposition to
the requirement that States re-verify information and source documents
for renewals and replacements of driver's licenses and identification
cards. They said that this requirement would be costly, burdensome, and
unnecessary in part because of the processes that many States already
have in place for renewals and replacements. In addition, some
commenters claimed that the requirement to re-verify source documents
such as address documentation is impossible to comply with because
there is no electronic system to do so. One State DMV pointed out that
because Federal and State databases are not updated in real time, it is
likely that changes would not be immediately verifiable.
One State supported requiring re-verification of birth certificates
because changes to the birth certificate, such as a name change, could
be made after the original birth certificate verification occurred.
This suggestion would also allow for matching against State death
information to prevent fraud. Another State endorsed the re-
verification of information for temporary REAL ID licenses and for
driver and ID card holders who do not have Social Security numbers.
Response: DHS agrees with the comments that it is not necessary to
re-verify all source documents at renewal. DHS proposed this
requirement in the NPRM since it recognized that the quality of
recordkeeping in both Federal and State databases would improve over
time. Instead DHS has amended the rule to require reverification of SSN
and lawful status prior to renewal and verification of information that
the State was previously unable to verify electronically.
Comment: Several State DMVs asked DHS to clarify exactly what they
would need to do to ``re-verify'' information. For example, one State
asked if States would be required to verify each source document and
imaged piece of information if electronic verification systems were not
available at the time of initial enrollment. One State asked if States
could use original source documents to re-verify applicant information
if the documents have expired since the date of original verification.
Another State asked DHS to explain the difference between ``verified''
and ``validated'' as referenced in Sec. 37.23(b)(1)(ii) of the NPRM.
Response: As noted above, DHS is not requiring States to re-verify
source documents at renewal. However, States must reverify the SSN and
lawful status upon renewal and electronically verify information that
the State was previously unable to verify electronically.
Comment: AAMVA said that DHS should allow States to determine if
they want to re-verify information that has already been verified by
another State. AAMVA said that the new State of residency should be
able to determine whether to ``re-vet'' an applicant's information. One
State requested that DHS allow a license transferred from another State
to be renewed or replaced remotely, even if the new State of residence
does not have electronic copies of the applicant's identity
documentation. One State said that the renewal of a REAL ID-compliant
card should only require the minimum
[[Page 5307]]
combination of a REAL ID document and some proof of address. Another
State suggested that States be allowed to exempt from re-verification
applicants who have been verified at initial enrollment as U.S.
citizens and who have had no changes to name or Social Security
information. A few commenters mentioned that a birth certificate should
not be re-verified if there was a copy of it maintained at the DMV.
Response: The NPRM did not propose any requirements for how a State
should treat a REAL ID issued by another State except to propose that a
REAL ID driver's license or identification card be accepted as an
identity document, to establish name and date of birth. When an
individual moves from one State to another, the new State would still
be required to verify the individual's SSN and ensure that he or she is
lawfully present in the United States
3. Renewals
Comment: AAMVA recommended that Sec. 37.23 be entirely stricken
except for paragraph (b)(2)(iii) of the NPRM, which would require
holders of temporary REAL ID cards to renew them in person each time
and to present evidence of continued lawful status.
Response: DHS disagrees with the comment and believes that it is
necessary to have standards governing the renewal of a REAL ID-
compliant driver's license or identification card.
Comment: One commenter wrote that the rule would make it far more
difficult and expensive for current holders of a commercial driver's
license (CDL) to renew or replace their licenses, that delays and the
expense in having a license renewed or reissued are particularly
important for this segment of the population, and that they might force
drivers to seek other employment altogether.
Response: DHS disagrees with this comment. DHS has not been
presented with evidence that CDL holders will be affected
disproportionately by the REAL ID requirements or that the REAL ID
requirements will force commercial driver's license holders to seek
other employment.
Comment: Commenters expressed strong opposition to the restriction
that remote transactions would be allowed only if ``no source
information has changed since prior issuance'' (Sec. 37.23(b)(1) of
the NPRM). In particular, many States, AAMVA, and other commenters
wrote that applicants should be able to make address changes without
having to appear in a DMV office, and that only material changes (e.g.,
name change) should prompt the need for an in-person visit. In general,
commenters wrote that they do not currently require an office visit for
address changes, and some said they do not issue a new card when
notified of an address change. They said that requiring in-person
visits for address changes would dramatically increase the number of
visitors to DMV offices, with huge cost increases for State agencies
(which some DMVs said the Federal government should cover), without
necessarily improving national security. Some States further commented
that making address changes more difficult for customers will result in
these individuals simply not notifying the motor vehicle department of
new addresses, which creates greater problems for State and local
government and law enforcement.
Response: DHS agrees with these comments and has removed the
requirement that an address change must be accomplished through an in-
person visit to the DMV. Additionally, there is no requirement in the
final rule for States to issue a new card when notified of an address
change.
Comment: DHS received several comments on some of the methods
listed in the preamble for authenticating identity prior to issuing a
renewed license.
Response: Since DHS is only requiring that States establish a
procedure to ensure that the proper individual is receiving a renewed
document and is not requiring any specific method, these comments are
not discussed as they are deemed outside the scope of the regulation.
Comment: AAMVA commented that the requirement that every other
renewal take place in-person to allow for an updated photo would
penalize residents of States with shorter renewal cycles. One State
suggested that Sec. 37.23(b)(2) of the NPRM should be changed to
require in-person renewals and recapture of a digital image once every
sixteen years, regardless of the period of validity of a State's cards.
Two commenters stated that allowing sixteen years between photo updates
might be too long because a person's appearance can change
significantly during that time, and that the usefulness of the photos
for facial recognition (manual or computerized) would greatly diminish
over a sixteen-year time period. One State recommended that DHS adopt a
ten-year in-person renewal cycle. Two States commented that exceptions
to in-person renewals should be established for active military and the
elderly.
Response: DHS disagrees with the comments and is retaining the
requirement that a new photo be taken at every other renewal of a REAL
ID driver's license or identification card. Enabling States to maintain
their own renewal cycles permits States to plan for the flow of people
through the DMVs. While DHS agrees that an individual's appearance can
change significantly over sixteen years, DHS has concluded that an
every-other-cycle photo requirement will meet State needs to reduce in-
person visits at the DMVs while not posing an unacceptable security
risk. States are free to impose a more frequent photo requirement.
4. Reissuance of Documents
Comment: One State said that it would be overly burdensome to
require all applicants for replacement driver's licenses or ID cards
resulting from lost, stolen, or mutilated documents to personally
appear at a DMV office. Another State wrote that, in many instances,
the affected customer will not have the supporting documents readily
available, which may result in some individuals driving without a
license.
Response: DHS agrees with the comments. In the final rule, States
may replace a lost, stolen, or mutilated document without requiring an
in-person transaction. Current State practices will dictate what
documentation needs to be presented for replacement driver's licenses
and identification cards.
Comment: Some States, AAMVA, and several other commenters
recommended against requiring a new card for address changes and asked
that DHS allow States to propose interim methods of tracking address
changes between renewal cycles without the requirement for issuance of
a replacement card (unless State law requires it).
Response: DHS agrees with the comments. The final rule does not
mandate that a State reissue a driver's license or identification card
for an address change unless otherwise required by State law.
Comment: A number of States suggested that the definition of
``reissued'' be changed to indicate that the license contains material
changes to the personal information on the document. An applicant for a
``reissued'' document would be required to personally appear at a DMV
office to provide proof of the change. Furthermore, the State suggested
that DHS create a definition of ``duplicate'' as a card that was issued
subsequent to the original document that bears the same information and
expiration date as the original.
Response: DHS agrees with the comments. The final rule does not
mandate a personal appearance at a
[[Page 5308]]
DMV for a reissued driver's license or identification card unless
material information, such as name or lawful status, has changed. The
final rule adopts the proposed definition for a duplicate card.
K. Source Document Retention
Comment: AAMVA expressed concern about the proposed requirements
dealing with transferring document images and linking document images
to the driver record, and opined that the requirement to color scan and
exchange documents using AAMVA's Digital Image Exchange program is
misplaced. Another commenter stated that this program deals only with
photos and that ``it would be a giant leap to consider its use for
documents.'' Several commenters objected to the costs of purchasing
scanners, using computer storage space, retaining color images, and
integrating the image into the driver record. Some commenters believed
the document retention period should be the same for paper copies and
electronic storage, while others believed that the retention period for
paper copies should be shorter than electronic. A few commenters
pointed out that the Driver Privacy Protection Act and State laws had
their own record retention requirements. Some commenters objected to
the storage of documents containing sensitive personal information as
such documents are attractive target for criminals and hackers, and
thereby pose significant privacy and security risks.
Response: The specific record retention period for imaged documents
and paper documents is required by the REAL ID Act and the final rule
applies those time periods. However, DHS agrees with the comments that
some source documents may contain sensitive personal information and
has modified the document retention requirements for birth
certificates. Under the final rule, a State shall record and retain the
applicant's name, date of birth, certificate numbers, date filed, and
issuing agency in lieu of an image or copy of the applicant's birth
certificate, where such procedures are required by State law and if
requested by the applicant.
L. Database Connectivity
Comment: AAMVA stated that DHS has yet to provide specific
information on how this ``query'' system will work and does not expect
to provide that information until the comment period is over. AAMVA
wrote that final rulemaking should not take place until there is
opportunity for another round of comments and an extension of
compliance dates.
Privacy groups argued that the proposal does not define security
standards or a governance structure for managing any of the shared
databases and systems. In their view, this abdication places the States
in an impossible position: they are being forced to make their own
citizens' personal information available to every other State with no
guarantee of privacy or security.
One commenter recommended that the PCI Data Security Standards that
apply to the credit card industry should be applied to DMV databases.
One group suggested a decentralized query system that allows States to
check all other States to see if an applicant already holds a REAL ID
and returns a yes or no answer, rather than providing detailed data.
One commenter recommended audit logs and audits to ensure compliance
with privacy policies.
Response: DHS has provided a brief overview of the proposed
architecture for data verification and State-to-State data exchange in
the sections above. This architecture will likely build on the existing
architecture of AAMVAnet and the systems design principles of its
hosted applications. The proposed architecture will also build upon the
security, privacy and governance principles that have guided AAMVA and
the States for decades.
In addition, DHS will work with DOT, AAMVA and the States to
reinforce the security and privacy features of this communications and
systems architecture.
Comment: A commenter stated that DHS had exceeded its authority in
the requirement that interstate access must be ``in a manner approved
by DHS.'' This commenter stated that since the rule does not describe,
even in general terms, what the approval is based upon, States are left
to guess at the DHS criteria for approval. Since the database exchange
and the connectivity thereto are of utmost importance to States, the
conditions upon which approval will be based need to be specified in
the rule. They should not be provided by some yet to be developed
guideline issued by DHS after the rule has become final.
Response: DHS will work with DOT, AAMVA, and the States to develop
a path forward for both verification systems and State-to-State data
exchange, including criteria DHS will employ to evaluate the adequacy,
security, and reliability of such data exchanges.
M. Security of DMV Facilities Where Driver's Licenses and
Identification Cards Are Manufactured and Produced
1. Physical Security of DMV Facilities
Comment: A few States said the security requirements would force
closure of many DMV offices. At least one State said that the security
requirements would lead to closure of remote offices, and that this
could lead the State to opt out of complying with REAL ID requirements.
Response: In general, DHS does not agree with comments that
indicate a State would prefer to have a security vulnerability rather
than take the necessary steps to close it. There have been a number of
well-documented instances where DMV offices have been burglarized and
the equipment and supplies to manufacture driver's licenses and
identification cards taken, highlighting the need to ensure that
adequate procedures are in place to protect the equipment and supplies
necessary for the production of REAL ID driver's licenses and
identification cards. Protecting these materials and equipment are
critical to reducing the possibility of fraud and identity theft.
Comment: While a few States supported the proposed ANSI/NASPO-SA-
v3.OP-2005, Level II standard, numerous States said that this standard
was intended to apply to manufacturing facilities, not to the issuance
of driver's licenses. The commenters opposing use of the ANSI/NASPO
standard stated that until a reasonable standard is developed, States
should have the flexibility to determine what works for their issuance
processes. Privacy groups are concerned that without a uniform
standard, States could have 56 different security and privacy policies
with different levels of protection.
One State supported a narrow application of the ANSI/NASPO standard
only to the DMV facility containing the database on license holders,
while another State thought that the standards should apply only to the
DMV production facilities. One commenter wrote that the NASPO standard
needs to be reviewed every two years and that requirements should be
added throughout the supply chain.
Response: DHS agrees with the comments that the proposed NASPO
standard may be more appropriate to manufacturing and production
facilities, as opposed to issuance sites. DHS is not requiring the use
of the ANSI/NASPO standard in the final rule, but commends to the
States the proposed standards as a good practice for securing materials
and printing supplies.
[[Page 5309]]
Comment: One commenter proposed additional requirements for alarm
systems, disposals, and suppliers. Another commenter suggested allowing
DMVs to secure part of a building, rather than the whole building. The
commenter wrote that the standard did not address the security of work
stations and recommended biometric passwords. One commenter noted that
providing the license directly to the person, rather than mailing it,
was more secure; one State noted that the Post Office does not
guarantee delivery.
Response: The final rule specifies what must be addressed in a
security plan, including physical security of the buildings used to
produce driver's licenses and identification cards, storage areas for
card stock and other materials used in card production, and security of
Personally Identifiable Information (PII).
If a DMV is located in a building shared by other offices or
tenants, the area dedicated to the manufacture or issuance of driver's
licenses and identification cards, storage of card stock and related
materials, and PII must be secured in such a fashion to prevent
unauthorized access. This requirement covers any equipment utilized to
produce driver's licenses and identification cards as well as storage,
access and retrieval of PII. States will determine how these items are
protected in their security plans.
The rule does not mandate central issuance versus over-the-counter
issuance.
2. Security Plan
Comment: One State said that DHS had exceeded its authority under
the Act in the requirement that a State's security plan address
``reasonable administrative, technical and physical safeguards to
protect the security, confidentiality, and integrity of * * * personal
information stored and maintained in DMV * * * information systems.''
Another State wrote that the Act does not authorize DHS to compel
States to establish or make available standards or procedures for
safeguarding the information collected by motor vehicle agencies. AAMVA
asserted that tools such as information security audits, individual
employee access audits, employee confidentiality polices, and privacy
and security plans are already used in many DMVs.
Privacy groups commented that the rule must provide meaningful
privacy and security protections and that the lack of clear privacy and
security guidance in the Act does not preclude DHS from providing
strong protections in the regulations. In fact, they urged DHS to
include specific standards or minimum criteria against which the State
plans could be evaluated.
At least two States objected to the provision that DHS could
require ``other information as determined by DHS.'' The States argued
that any further requirements should be agreed upon and clearly
identified in the regulations. One State said that unspecified
requirements should not be left to DHS to develop outside of the
regulatory process. Another State wrote that the access badge
requirement is unrealistic.
Response: DHS believes that it has the authority to require States
to take reasonable measures to safeguard the confidentiality of PII
maintained in DMV information systems pursuant to the REAL ID Act. DHS
believes that inherent in the Act's requirement that States must
provide electronic access to the information contained in their
databases is the principle that such information must be protected, and
this concept is supported in the legislative history for section 202(d)
(12) of the Act which states that ``DHS will be expected to establish
regulations which adequately protect the privacy of the holders of
licenses and ID cards * * *.'' H.R. Rep. No.109-72, at 184 (2005)
(Conf. Rep). Failure to protect the PII held in DMV databases could
result in identity theft and undermine the very purpose of the Act,
which is to strengthen the validity of the cards. DHS also believes
that it can require States to provide other, reasonable information
that DHS determines is necessary in the future without requiring future
rulemaking.
Comment: AAMVA and several States requested guidance on what
``written risk assessment of each facility'' means and a template.
Another State asked for guidance on which law enforcement officials
should be notified. One State recommended that the rule limit the
amount of data in any State's database and create stronger protections
for information to limit the danger of aggregating information on 240
million Americans.
Response: DHS, DOT, AAMVA and the States will work together to
develop best practices for risk and vulnerability assessments as well
as for security plans for DMV facilities.
Comment: A trade association objected to the lack of standards for
the security plan and further stated that because the State databases
must be interconnected, the lack of standards would mean that the
weakest plan implemented by any State would put all States at risk. DHS
should require clear, strong, and verifiable minimum security measures.
An association said that DHS was ignoring the threat posed by insiders,
employees and contractors. According to this association, the rule
should recognize the threat and the importance of training to mitigate
those risks.
Response: The final rule specifies what must be addressed in a
security plan, including: Physical security of the buildings used to
produce driver's licenses and identification cards, storage areas for
card stock and other materials used in card production; security of
personally identifiable information including reasonable
administrative, technical, and physical safeguards, a privacy policy,
and limits on disclosure; document and physical security features for
the face of the driver's license or ID card, including a description of
the State's use of biometrics and the technical standards utilized (if
any); access control, including employee identification and
credentialing, employee background checks, and controlled access
systems; periodic training requirements in fraudulent document
recognition for covered employees; emergency/incident response plan;
internal audit controls; and affirmation that the State possesses both
the authority and the means to produce, revise, expunge and protect the
confidentiality of REAL ID driver's licenses and identification cards
issued in support of Federal, State or local criminal justice agencies
or similar programs that require the safeguard of a person's identity
in the performance of their official duties. Such requirements shall
also apply to contractors involved in the manufacture or issuance of
REAL ID-compliant driver's licenses and identification cards.
3. Background Checks for Covered Employees
Comment: Generally, States did not support the proposed background
check provisions. A few States objected to these provisions as too
broad and impractical. AAMVA stated that these requirements are a
Federal intervention into State personnel rules and one commenter
stated that these provisions are a particularly invasive intrusion on
State autonomy to decide the qualifications and conditions of persons
within its employ, which is a fundamental attribute of State
sovereignty. States also objected to Sec. 37.45(c), the provision
instructing the States to notify persons of unfavorable checks and
provide them appeal rights, and claimed that this provision may grant
rights nonexistent in State law.
Numerous States said that background checks and the standards
applied should be at the discretion of the State and not required.
AAMVA and several
[[Page 5310]]
States suggested that existing employees should be grandfathered in to
allow States to determine whether they want to do complete background
checks on such employees.
Response: DHS disagrees that it cannot require background checks of
covered employees. Such checks are a necessary step to protect against
insider fraud, one of many vulnerabilities to a secure licensing
system. DHS also disagrees with the concept of ``grandfathering''
existing personnel since there is no way to know in most States whether
employees who have not been subject to a background check would satisfy
this important requirement. Further, Sec. 202(d)(8) expressly directs
States to ``[s]ubject all persons authorized to manufacture or produce
driver's licenses and identification cards to appropriate security
clearance requirements.'' The background checks required under this
final rule are authorized by and consistent with that statutory
mandate. The statute does not provide for an exemption for personnel
employed by a State DMV before the effective date of the Act or this
final rule and thus DHS cannot include a grandfather clause in this
rule.
Comment: Some States believed that DHS has exceeded the authority
granted by the Act on background check provisions because of its
expansive definition of ``covered employees.'' These States asserted
that DHS is without authority to extend the background check
requirements beyond employees who ``manufacture or produce'' cards.
Similarly, one State asked that employees at branch offices who are not
involved in the production and manufacture of driver's licenses or
identification cards be exempt from the background check requirements.
One State noted that the rule attempts to subject ``covered
employees,'' ``prospective employees,'' and ``applicants'' to the
criminal history record check, yet only defines the term ``covered
employee.''
Response: DHS disagrees that its definition of a covered employee
is too expansive. DHS, the agency charged with interpreting and
enforcing the Act, interprets ``persons authorized to manufacture or
produce'' REAL ID cards to include those individuals who collect and
verify required source documents and information from applicants as
such information is a necessary part of the production of a REAL ID
card. It would be illogical to cover only those DMV employees and
contractors who carry out only the physical act of cutting or printing
a license while exempting those individuals who interact with the
public and may be most able to introduce fraudulent information into
the system and thus thwart the intent of the Act.
Comment: Commenters wrote that States currently only undertake
background investigations at the time of hiring, and that since
existing employees are not applicants, it is entirely reasonable for
labor organizations and permanent State employees not covered by
collective bargaining agreements to argue that non-probationary
employees fall outside the scope of the background check provisions.
Some commenters claimed that the requirement that all designated
employees, including those who are already employed, undergo background
investigations is contrary to many State labor contracts and personnel
practices. Numerous employees were hired under terms and conditions not
requiring a security clearance. Should these employees be disqualified
under the new regulations, States may be obligated to provide them with
alternative employment or severance.
Response: As noted above, DHS believes that it would be a
significant security vulnerability to exempt current DMV employees from
a background check.
Comment: One commenter claimed that the use of the phrases
``applicant'' and ``application'' in the rule governing interim
disqualifying criminal offenses poses a practical problem, since the
time periods are defined in terms of the date of the application.
Existing employees would have been considered applicants on the date
they filed the application for the position in which they are currently
employed, which may be well outside the time period that applies to
interim disqualifying offenses (five years from the date of
application). Thus, commenters argued, the time period for interim
disqualifications should start from the date of employment, not
application. With regard to the proposed list of disqualifiers, AAMVA
and some States wrote that States should determine their own
disqualifying crimes and could outline those disqualifiers in the DHS
certification package. Several States objected to the disqualification
of people who have not been convicted on the grounds that such person
should be considered innocent until found guilty.
Response: DHS agrees that the time period for interim
disqualifications for existing employees should start at the date of
employment, not application. DHS agrees that States may supplement the
list of disqualifying offenses with their own lists, but those lists
cannot replace the Federal list. Finally, DHS agrees that States may
make different decisions about whether to move an individual from a
covered to a non-covered position even though the individual has not
been convicted, and can exercise his or her waiver authority for this
purpose under Sec. 37.45(b)(1)(v).
Comment: A few States argued that States should have the option to
give employees provisional clearance pending background check results,
and that States could outline the procedures for provisional clearance
in their certification packages.
Response: As discussed above, DHS believes that it would be a
significant security vulnerability to exempt current DMV employees from
a background check. DHS has included language that substantially
similar background checks (i.e., those that use a fingerprint-based
CHRC check and have applied the same disqualifiers as this rule; that
include an employment eligibility determination; and that include a
reference check) conducted on current employees on or after May 11,
2006, need not be re-conducted.
Comment: One commenter wrote that, of the twenty-nine States that
currently carry out some level of employee background checks, only two
conduct credit checks. AAMVA and many States objected to the credit
check as costly and in conflict with State personnel rules. One State
noted that the Equal Employment Opportunity Commission (EEOC) has
determined that unless justified by business necessity, it is unlawful
to reject candidates based on poor credit ratings.
One State asserted that this requirement is a Federal encroachment
into an area historically reserved to States. Some States questioned
the link between an employee's financial history and the propensity to
commit a crime and posited that implementing this provision as written
would cause many union-related issues affecting existing and future
employees. Other States pointed out that many law enforcement personnel
are not subject to this level of checking. Another commenter objected
to the financial check as an invasion of privacy that would not provide
useful information, and if DHS requires a financial history check, it
should provide standards on how the results of that check should be
used by the States.
Response: DHS agrees that it would be difficult to make conclusive
judgments about an employee or prospective employee's vulnerability to
bribery based on a financial history check alone. Since the financial
history check would not be determinative, DHS is eliminating the
requirement for a
[[Page 5311]]
financial history check from the final rule.
Comment: AAMVA said that lawful status checks are unnecessary and
excessive because States already conduct such checks as part of the
hiring process. One State noted that the requirement differs from
current Federal requirements for completion of the Form 1-9. Other
States pointed out that SAVE only covers immigrants, not native born
Americans. AAMVA and several States noted that lawful status checks are
often addressed in union bargaining contracts, and are covered by State
personnel laws.
Response: In response to these comments and further consideration
of this matter DHS has revised the final rule. Employment eligibility
verification using Form I-9 procedures is required for all employees
(whether U.S. citizens or aliens) hired for employment at DMVs (or any
other U.S. employer) on or after November 7, 1986. REAL ID defines
lawful status in a way that is not synonymous with employment
eligibility under the INA. Thus, the final rule now cross-references
current Form I-9 requirements under section 274A of the INA rather than
requiring employees to be checked through SAVE. As part of its
background check process, the State must ensure that it has fully
complied with Form I-9 requirements with respect to covered employees
(including reverification in the case of expired employment
authorization), but additional status checks are not required. Nothing
in this rule in any way modifies any Form I-9 requirement; rather, the
background check, if done at a later time than the initial hire,
provides another opportunity for the State to check its previous
compliance and correct any deficiencies. Form I-9 completion is, of
course, required no later than three days subsequent to the first day
of employment for all employees.
USCIS operates, in partnership with the Social Security
Administration (SSA), an electronic employment eligibility verification
program called E-Verify (formerly known as the Basic Pilot program).
Participants in E-Verify can query SSA and DHS databases to verify the
documentation provided by new employees when completing the Form I-9.
States are strongly encouraged to enroll in this program, but,
consistent with the voluntary nature of the E-Verify program as
provided by the statutory provisions authorizing the program, it is not
required by the final rule.
Comment: One commenter stated that background check processes are
flawed, misidentifying people five percent of the time. According to
this commenter, in half the States, forty percent of the arrest records
have not been updated in five years to indicate disposition of the
case. Another State wrote that it would be easier to run checks if they
could interface with the FBI database. One State wrote that States
should not have to repeat FBI checks if done within the past five
years. One commenter asked that the FBI not charge States for accessing
their systems.
Response: DHS believes that a fingerprint-based background check is
the most efficient way to determine if an individual is subject to a
disqualifying offense. FBI checks conducted on or after May 11, 2006
would not need to be conducted again.
Comment: One commenter said that workers subject to a background
check deserve a clear and quick process to clear their names and win
their jobs back with full restitution of any lost wages. Another
commenter suggested that TSA should incorporate provisions from the
HAZMAT rules which provide instructions for applicants on how to clear
criminal records into the REAL ID rule.
Response: DHS believes that an individual denied employment based
on the results of a background check should have the ability to
challenge the accuracy of those records. States should make
instructions available on how best to contest any inaccurate records or
results.
N. State Certification Process; Compliance Determinations
1. Certification Process
Comment: Several commenters requested that DHS receive input and
collaborate with States and other organizations on certification
guidance and standards. One commenter requested that DHS provide
certification packets outlining specific requirements as well as a
clear definition of ``until all requirements are met.'' AAMVA and
several States recommended that States work with DHS in the development
of a streamlined self-certification process to meet the requirements of
the Act. One commenter suggested that risk assessment and mitigation
plans be included in States' self-certification, and that States
participating in the Driver's License Agreement should be able to
substitute their compliance review process for DHS audit requirements.
One commenter recommended that DHS establish a committee composed of
Federal and State officials and representatives of groups which face
unique challenges with respect to the REAL ID Act to recommend proposed
content for the guidance documents on certification. Some States asked
DHS to clarify the requirement for States to provide DHS with any
changes to the information requiring certification. Regarding guidance
requests, a few States requested a template for the certification
document and the security declaration as well as a quarterly reporting
standardized format.
Response: DHS has streamlined the certification process, and
includes a compliance checklist with this rule. The Material Compliance
Checklist will document State progress toward meeting DHS security
benchmarks and will serve as the basis for DHS approval of additional
extensions until no later than May 10, 2011.
Comment: Several States argued that the certification requirements
are too burdensome, citing staffing issues as well as the need for
ample preparation time and flexibility to comply with regulations.
Similarly, many States argued that the frequency of certification
reporting is too burdensome and questioned the need for quarterly
certification reporting. One State recommended a triennial review.
Other States thought the requirement to track all exceptions and to
notify DHS 30 days before program changes were over-reaching and not
authorized by statute. One State recommended that the DHS establish a
system of measuring performance instead of recertification.
Response: As documented above, DHS has simplified the certification
process.
Comment: Some States suggested allowing States whose DMVs fall
under a jurisdiction other than the Governor the ability for the
relevant public official to certify compliance. AAMVA and one State
argued that the rule should provide that certification be signed by the
highest-ranking State official overseeing the DMV, including the DMV
Administrator, and not require additional certification from the
Attorney General.
Response: DHS agrees that requiring the Governor of each State to
personally certify State compliance is too burdensome and has amended
the requirement to allow either the Governor or the highest-ranking
executive official with oversight responsibility over the operations of
the DMV to certify State compliance.
2. Compliance Determination
Comment: One State argued that unless and until a State loses a
judicial review, it should be considered in compliance. Another State
recommended that DHS recognize States that have implemented a number of
[[Page 5312]]
requirements and plan to continue making substantial progress as
compliant. A State asked DHS to allow for the Governor to indicate that
the State will remain in compliance until it withdraws from the
program. Some States argued that a phased approach was the only viable
means to bring States into compliance. One State recommended that DHS
convene a working group with AAMVA to develop a phasing plan for
compliance.
Response: As documented above, DHS has adopted a compliance process
that significantly lessens the burden of REAL ID implementation on the
States.
Comment: Various State and non-State commenters addressed
noncompliance issues. One State asked how licenses issued during a
compliant period would be treated if a State later fell out of
compliance. Another State requested that DHS provide written
notification of preliminary non-compliance determination and notice of
final determination of noncompliance which would not be effective for
30 business days following receipt. A State indicated it would not
agree with non-compliance issues until the standards are clearly
identified and agreed upon. One commenter opposed DHS's ability to
withdraw a State's certification to issue REAL ID driver's licenses and
identification cards on short notice, noting that decertification would
negatively impact truck driver communities, government facilities, and
the overall economy of the State.
Response: REAL ID driver's licenses and identification cards issued
when a State was in compliance with REAL ID will remain acceptable for
official purposes until they expire, even if the State subsequently
becomes non-compliant. The REAL ID certification process will provide a
standardized means of measuring and monitoring the DMVs' compliance
with REAL ID requirements. DHS will not withdraw a State's compliance
on short notice, as certification reporting dates will be established
in advance.
Comment: A commenter requested that DHS provide written statements
of notice prior to inspections, interviews, or any noncompliance
determinations. Some States asked for flexibility and reasonable prior
notice when scheduling site visits and REAL ID compliance audits, in
order to have appropriately trained staff available to answer questions
and to prevent audit overlaps. Commenters believed that States should
have ample opportunity for review and appeal of decisions regarding
self-certification.
Response: DHS agrees with these comments. Language has been added
to Sec. 37.59(a) to indicate that DHS will provide written notice of
inspections, interviews and audit visits. States will be provided with
a sufficient opportunity for review and appeal of decisions regarding
their self-certification.
Comment: Commenters addressed various training issues. One
recommended that DHS allow the current AAMVA fraudulent document
recognition training program to be used to meet the REAL ID Act's
requirements. This program has been used by States and ``is widely
recognized as comprehensive, directly related to and easily
comprehended by DMV staff.'' One commenter objected to the requirement
for DHS approval of fraudulent document training. Another commenter
emphasized the need for ongoing evaluator/authenticator training.
Without specific requirements for the training, States lack notice as
to whether or not the training will comply with the regulations and
will be subject to the unfettered discretion of DHS.
Response: DHS agrees that AAMVA's training program on fraudulent
document recognition will be acceptable to meet the requirement of the
Act and the final rule. The majority of States currently utilize
AAMVA's program.
Comment: One commenter requested a definition of ``expedited
consideration'' of a request for an extension. Other States requested
opportunity for input, justification, and consulting in the extension
process and assistance with development of the quarterly and annual
reports. One non-State commenter requested standards for the issue of
redress, and another suggested that DHS develop standards and plans to
audit States' security plans.
Response: The final rule spells out a simple and straightforward
process for States to request an extension to the REAL ID
implementation deadline. DHS will also allow States to receive an
additional extension based on achievement of certain benchmarks
established by DHS until no later than May 10, 2011. DHS will notify a
State of its determination on a request for extension no later than 45
days of receipt of the request. DHS will work with States and
territories throughout the implementation process to assist as
required.
The input DHS receives from its stakeholders has been of tremendous
value in crafting a final rule that the States may implement and that
achieves a greater level of security and confidence in the State-issued
driver's licenses and identification cards. DHS will continue engaging
its valued stakeholders to shape the exceptions processes as well as
other requirements of the rule.
O. Driver's License and Identification Cards That Do Not Meet the
Standards of the REAL ID Act
Comment: One commenter did not agree with DHS that foreign
nationals denied REAL ID licenses, even though they are lawfully
present but do not yet have the documentation required to demonstrate
such status, can simply obtain a non-REAL ID alternative. The commenter
wrote that a driver's license increasingly has become a ticket to daily
living, and a non-REAL ID license will unfairly and improperly tag the
holder as ``illegal'' and result in discrimination. One commenter wrote
that it is not a valid assumption that most States will issue some
other kind of license for immigrants who cannot obtain a REAL ID
license. Another commenter wrote that marking non-REAL ID cards would
divide the country into two groups and that those with other cards
would instantly be suspect and subject to delay, harassment, and
discrimination.
One commenter noted that many people such as the elderly or
disabled will not need a REAL ID and asked that the State be able to
issue a non-compliant identification card to them. By excluding them
from the REAL ID process, it will be easier for the State to process
those who do need a REAL ID within the time allowed.
AAMVA stated that although DHS has argued that States do not have
to comply with the Act, the Act and DHS still impose requirements on
States for the issuance of noncompliant licenses. AAMVA wrote that this
requirement forces States to be in compliance and that the rulemaking
goes well beyond Congressional intent in prescriptively outlining State
requirements for ``non-compliant'' REAL ID cards. One State and one
individual commenter noted that requiring States to follow these
standards imposes a cost on States that choose not to comply, a
violation of the 10th Amendment. Another State said that the Federal
government cannot require a redesign of documents if the State is not
complying. The Federal government should acknowledge the sovereignty of
States' rights and respect the traditional State function of licensing
drivers.
Response: DHS does not agree that an individual carrying a non-
compliant driver's license or identification card from a State issuing
REAL ID-compliant driver's licenses or identification cards would be
subject to discrimination. States will make their own business and
policy decisions about whether to issue
[[Page 5313]]
noncompliant cards under 202(d)11 of the Act.
DHS has clarified in the rule that it interprets Sec. 202(d)(11)
of the REAL ID Act, which provides requirements for the issuance of
driver's licenses and identification cards that will not be accepted by
Federal agencies for official purposes, as applying only to States
participating in the Act that choose to also make these types of
documents available. This might apply, for example, to individuals with
a religious objection to having their photos taken. DHS does not
interpret this section to apply to States that choose not to
participate in the Act.
P. Section 7209 of the Intelligence Reform and Terrorism Prevention Act
of 2004
Comment: AAMVA, some States, and several additional commenters
support the development of REAL ID cards that are WHTI-compliant. AAMVA
stated that this is an important direction to ensure the free flow of
commerce and travel between the United States and Canada. Some States
said that they already collected citizenship data and adding this to
REAL ID cards will have little to no additional cost impact.
Several States argued against development of a WHTI-compliant/REAL
ID-compliant card. One State said that citizenship is the purview of
the Federal government and not that of States, and making a State DMV
responsible for verifying citizenship places State employees in a
Federal role. This State also noted that citizens with no desire to
cross the border will derive no additional benefit from obtaining a
REAL ID card that also denotes citizenship. A few States made similar
arguments that very few of their residents would find it useful to have
a WHTI-compliant REAL ID card. These States also argued that the
expense to implement a WHTI-compliant solution would be cost
prohibitive.
One commenter emphasized that REAL ID cards must not include
citizenship information because of the potential of discrimination
against those who choose not to carry a national identification card.
Another commenter said that the creation of a dual-use driver's license
should be a decision that is made by individuals, after they are fully
informed of the benefits, risk, costs, and other details of the
programs consistent with the Fair Information Principles.
A few commenters stated that they did not support States listing
citizenship information on the REAL ID card or using a REAL ID card as
an immigration/border document. These individuals believed that that
WHTI-compliant REAL IDs would be significantly more useful to criminals
and terrorists and therefore targeted for theft, counterfeiting, and
fraud. One individual suggested that DHS could mitigate some concerns
that the Department is trying to create a Federal ID by not requiring
DMV to denote citizenship on REAL ID cards.
All of the organizations that responded to the question on where
citizenship should be listed on the card stated that it should be on
the machine-readable zone (MRZ) portion of the card. There were no
supporters for listing the citizenship information on the face of the
card. These organizations all claimed that placing citizenship
information on the face of the card could result in discrimination
against the bearer of the card; placing it on the MRZ portion of the
card could prevent this from happening.
One commenter described in great detail the need to develop two
encrypted MRZs on the card; one zone that can only be accessed and used
by DMV and law enforcement officials, and another zone that can only be
accessed and used by border and immigration officials. A few
organizations commented that placing the WHTI information on a card may
be challenging without increasing the size of the card itself. However,
increasing the size of the card would be extremely costly.
Response: DHS welcomes the various helpful comments submitted in
response to DHS's questions in the NPRM relating to WHTI. In June 2007,
DHS published a NPRM to implement the land and sea phases of WHTI.
While DHS acknowledges the desire of some, but not all, States and
other commenters to use a REAL ID-compliant driver's license or
identification card as a WHTI-compliant border crossing document, DHS
did not propose that a REAL ID-compliant driver's license or
identification card serve as a WHTI-compliant document in that NPRM and
does not propose such in this rulemaking. While the proposed REAL ID
requirements include proof of legal status in the U.S., the EDL will
require that the cardholder be a U.S. citizen. In addition, EDLs will
include technologies that facilitate electronic verification and
legitimate movement of travelers through land and sea ports-of-entry.
Comment: A few commenters provided suggestions on the types of
business processes and procedures that a State DMV could adopt to
create a REAL ID that is also WHTI-compliant. One group suggested that
citizens who desire to have a REAL ID that allows for WHTI border entry
should be vetted by the State Department in the same manner as a person
applying for a passport. The State Department would verify that the
individual is eligible to receive WHTI identification and inform the
appropriate State DMV that the individual has been approved to obtain a
WHTI-compliant REAL ID. The State DMV should create the license/ID card
as it normally would and then send it to the State Department to add
the WHTI MRZ. There should be two machine-readable zones; one zone
would only be able to be used and accessed by law enforcement and DMVs,
and another MRZ that would only be able to be accessed and used by
immigration/border officials.
One organization commented that State DMVs will need to be able to
utilize the State Department's citizenship adjudication process or
create a similar process for adjudicating citizenship.
One State opposed storing citizenship data on the MRZ, preferring
to store this information centrally and access it via electronic means.
Response: DHS welcomes the comments submitted concerning potential
business practices a DMV could follow to issue both a REAL ID and WHTI-
compliant driver's license or identification card, including issues
surrounding the adjudication of citizenship for WHTI purposes. As noted
above, DHS published a NPRM to implement the land and sea phases of
WHTI. At this time, DHS has decided not to incorporate requirements
necessary for a WHTI-compliant document into the REAL ID rulemaking.
Comment: Many commenters said that RFID technology, the proposed
technology for WHTI documents, should not be used on REAL IDs. Because
RFID can be read from up to thirty feet away there are significant
privacy and security risks. A few commenters noted that the DHS Data
Privacy and Integrity Advisory Committee and the Government
Accountability Office both advised against using RFID technology. One
organization felt strongly that the use of RFID technology without the
use of Basic Access Control and other safeguards would contravene the
basic security features that the Department of State has included in
new U.S. passports.
Another group believed that States can leverage the same
infrastructure that they will need to purchase for REAL ID to
incorporate MRZ, proximity chips, and vicinity chip technology onto a
driver's license. The only difference
[[Page 5314]]
would be the cardstock and the quality assurance processes to ensure
that electronics within the card are functioning properly. Another
organization suggested that its product can turn the wireless function
on or off as needed.
One State suggested that DHS not identify a specific technology to
be used, but leave it up to the States to decide.
Response: The use of RFID is essential to the WHTI program in order
to ensure facilitation at crowded U.S. land and sea crossing points.
Similar concerns are not implicated by REAL ID, which is one of the
factors that led DHS to select the 2D bar code as the common machine
readable technology on driver's licenses and identification cards. DHS
encourages States to explore alternative technologies on their driver's
licenses and identification cards in order to promote security and
technology advances as well as e-government initiatives a State may
wish to explore.
Comment: There were several other comments related to the issue of
creating WHTI-compliant REAL ID cards. One commenter requested
clarification on why REAL IDs themselves would not be sufficient
documentation to re-enter the United States. The commenter noted that
REAL ID issuance standards require proof of lawful residence status
within the United States, and the overall higher standards will make
the cards more resistant to tampering and counterfeiting. Therefore,
the commenters argued, it may be presumed that a holder of a REAL ID
license has the right to re-enter the United States. Another commenter
requested clarification on whether ``enhanced'' driver's license (EDLs)
and ID cards that are issued through pilot programs will also have to
be REAL ID-compliant. The commenter also requested clarification on how
DHS will respond to States, like Washington State, that have passed
legislation refusing to comply with the REAL ID Act unless the Federal
government fully funds the State's implementation of the Act.
One commenter requested that DHS consult with tribal governments on
how to best implement the REAL ID Act and that DHS consult with tribal
leaders on the development of an Indigenous Identification Card for
international border crossing.
One individual urged DHS to allow Canadians who are residents of
the United States to be allowed to obtain REAL ID/WHTI-compliant
driver's licenses or ID cards, as these individuals make up a
significant portion of individuals who cross the border frequently.
Response: DHS acknowledges the desire of some, but not all, States
and other commenters to use a REAL ID-compliant driver's license or
identification card as a WHTI-compliant border crossing document. In
the WHTI NPRM, DHS included a specific discussion of its ongoing
efforts with Washington State regarding the issuance and use of an EDL
as a WHTI-compliant document. EDLs can only be issued to U.S. citizens
since the EDL would serve as the functional equivalent of a passport or
passport card at land and sea border crossings. In addition, EDLs must
also incorporate the technology specified by DHS to facilitate the
legitimate movement of travelers through land and sea ports of entry.
With respect to other holders of REAL ID-compliant driver's licenses or
identification cards, any assumption that lawful status as defined for
REAL ID purposes equates to a right to reenter the United States is
incorrect. For example, applicants for adjustment of status typically
must obtain advance parole in order to depart the United States and
lawfully return. DHS has decided not to incorporate requirements
necessary for a WHTI-compliant document into the REAL ID rulemaking at
this time.
Q. Responses to Specific Solicitation of Comments
Question 1: Whether the list of documents acceptable for
establishing identity should be expanded. Commenters who believe the
list should be expanded should include reasons for the expansion and
how DMVs will be able to verify electronically with issuing agencies
the authenticity and validity of these documents.
Comment: Several commenters did not think the list of documents
acceptable for establishing identity needed to be expanded, at least
for U.S. citizens, and they were concerned that expanding the list
would place a burden on State DMVs. One State did not know of any
additional documents that would be electronically verifiable. Another
State recommended that the list should not be included in the rule, so
that future changes can be easily made. One commenter favored the use
of the ``acceptable verifiable resource list'' of identity documents
approved by AAMVA. Another State suggested that the rule should only
specify criteria and procedures rather than a list of specific
documents for establishing identity.
Response: As noted above, DHS has decided not to alter the list of
acceptable documents proposed and discussed in the NPRM.
Comment: One commenter thought that Sec. 37.11 should require non-
citizen applicants to provide their alien registration documents so
that State officials can compare it to the name on other documents.
Various commenters pointed out that foreign applicants would have
documents that are not on the list but may have been issued by DHS or
the courts to prove immigration status. Some commenters supported other
immigration forms, such as Form I-94 (which may indicate lawful status
in the United States) and I-797 (which may be evidence of a pending
application). Refugees and asylees are more likely to have these
documents before they receive a Form I-766 Employment Authorization
Document (EAD). Canadians present in the United States might have these
forms rather than a visa. Two States suggested that any document that
can be electronically verified through SAVE should be acceptable.
Others argued for refugee status paperwork, expired foreign passports
if USCIS documentation is current, as well as passports with expired
visas and Immigration Court documents. One group recommended that DHS
expand the list of acceptable documentation to include family members
in the United States on derivative visas. Another group suggested that
USCIS consider issuing a temporary refugee photo ID card that could be
used to apply for a REAL ID.
Response: State DMVs will use the SAVE system to verify whether an
applicant for a driver's license or identification card is lawfully
present in the United States. Part of the information required in order
to query SAVE is the name of the individual, which can be confirmed
through one of the source documents for proving identity. Applicants
are free to use any other documentation available, including an I-94 or
an I-797, in order to demonstrate lawful status and assist the State in
making a SAVE check. DHS also agrees with the commenters who suggested
that any document that can be electronically verified through SAVE
should be acceptable, since the purpose of providing that document is
to prove lawful status, not identity. Neither the I-94 nor the I-797,
for example, is sufficient to prove identity. DHS believes that
refugees and asylees are issued EADs within a reasonable amount of time
such that they are able to obtain REAL ID driver's licenses and
identification cards, and so there is no reason to include other
refugee or asylee paperwork or documentation to the list of documents
used to establish identity.
[[Page 5315]]
Applicants who need an immediate driver's license can obtain a non-REAL
ID document from States issuing such cards.
Canadians, however, will need to use their Canadian passport or
obtain a U.S.-issued document in order to establish identity for a REAL
ID license, as neither DHS nor the States can verify in a timely way
that the document has been issued by the issuing agency (a foreign
government in this case) as the statute requires. Canadians, however,
can typically drive using their Canadian driver's license in the United
States and can also obtain a non-REAL ID driver's license from States
issuing such cards.
Comment: Some commenters had specific thoughts about the proposed
provisions on birth certificates. A State agency suggested that a
delayed birth certificate should be specifically named as an acceptable
document. Other commenters argued for acceptance of hospital records or
baptismal certificates within a year of birth and adoption papers.
Another State noted that many births in rural areas are not recorded,
and suggested that States should be able to use other documents. Many
commenters wrote that the proposed requirement for a certified copy
would place a hardship on poor persons and the homeless.
Response: If State law permits the use of a delayed birth
certificate, that document can be used by a State. Hospital and
baptismal records are not acceptable documents to establish identity,
though, in appropriate circumstances, can be used in a State's
exceptions process to establish date of birth or lawful status in the
United States.
Comment: Two commenters recommended that current State-issued non-
compliant driver's licenses and identification cards and bank-issued
credit cards be included on the list of documents acceptable to prove
identity because technology exists to verify and authenticate these
documents. Commenters were divided on the acceptance of Native American
Tribal Documents, with a few commenters, some Tribes, AAMVA, and two
States supporting acceptance of the documents (particularly for birth
records), and a few States opposing acceptance of these documents.
Response: DHS does not believe that non-compliant driver's licenses
or credit cards are acceptable documents to establish identity. No
identity verification has taken place with respect to these documents.
Tribal documents are addressed elsewhere in the responses to comments.
Question 2: Whether the data elements currently proposed for
inclusion in the machine readable zone of the driver's license should
be reduced or expanded; whether the data in the machine-readable
portion of the card should be encrypted for privacy reasons to protect
the data from being harvested by third parties; and whether encryption
would have any effect on law enforcement's ability to quickly read the
data and identify the individual interdicted. What would it cost to
build and manage the necessary information technology infrastructure
for State and Federal law enforcement agencies to be able to access the
information on the machine readable zone if the data were encrypted?
See full discussion of comments and responses to this question in
section I.
Question 3: Whether individuals born before 1935 who have
established histories with a State should be wholly exempt from the
birth certificate verification requirements of this regulation, or
whether, as proposed, such cases should be handled under each State's
exceptions process.
Comment: Numerous commenters favored the premise that individuals
born before 1935 with established histories should be exempt from the
birth certificate verification requirements. Some States added that
States should be allowed to establish alternative documents acceptable
for ID verification in this circumstance. AAMVA and some States
acknowledged that many in this age group may not be able to obtain a
birth certificate or related documents. AAMVA also said that citizens
born before 1951 with ten or more years of history with the State DMV
and who have passed State-approved verifications should be exempt.
Several States said that electronic verification would likely be
incomplete and non-electronic verification would be too burdensome for
persons born before 1935. Another commenter said jurisdictions should
be allowed to segregate the population by risk assessment to enable a
managed approach to enrollment in REAL ID. One commenter added that it
explicitly proposes using the term ``American citizens born before
1935'' rather than the term ``individuals.'' A couple of States
suggested granting an exemption based on the age of the applicant
instead of an exemption based on a fixed date, with one suggesting 62
years of age, based on eligibility to receive social security benefits,
for those persons with established histories with the State.
Response: DHS has determined that it will not allow a broad birth
certificate exemption for those persons born before 1935, and allows
States to accommodate such persons as necessary in their exceptions
process.
Comment: States requested clarification regarding ``established
histories with a State'' i.e., whether this means individuals who
already have a license or identification card in the State where they
are seeking a product. One commenter suggested a history with the State
for a minimum period of time, such as twenty to thirty years. This
exemption should be part of each State's security plan so risks can be
further mitigated through the overall REAL ID plan at the
jurisdictional level. A couple of States also said that individuals
without established histories should be handled through the State
exceptions process, enabling qualified drivers to obtain a compliant
license or identification card. A number of organizations said that
these cases should be handled under the State exceptions process. One
commenter wrote that DHS should establish a standard to which all
States should conform in issuance of birth certificates. Another wrote
that the process should be thoroughly documented, reviewed, and updated
on an on-going basis. One commenter wrote that the process should
substitute some form of identity verification that precludes imposter
fraud. Another commenter wrote that this elaborate process is itself
another argument in favor of restricting the Federal role in licensing
altogether.
Response: DHS has taken a different approach to reducing the number
of people that a State DMV must process. DHS consulted with
intelligence analysts and experts about how best to target preventive
efforts against an individual attempting to fraudulently obtain an
identification document to gain access to a Federal facility, nuclear
facility, or commercial aircraft.
DHS has determined that, based on information it has reviewed,
there is a higher risk that individuals under age 50 will obtain
fraudulent identification. As a result, the rule requires States to
focus enrollment first on individuals born on or after May 11, 1965
when issuing REAL ID cards. DHS has further determined that there is an
acceptable level of risk in deferring the REAL ID enrollment
requirements until December 1, 2017 for those individuals who are older
than age 50 as of December 1, 2014.
Comment: Two States said that customers born before 1935 should
make every attempt to comply with REAL ID rather than being granted a
blanket exemption. If compliance is not possible, exceptions procedures
(along
[[Page 5316]]
with other documents to reasonably prove identity) should be the next
step.
Response: DHS agrees with these comments and has decided not to
adopt an exemption for individuals born before 1935, as discussed
above.
Comment: AAMVA and several States said that individuals born before
1935 should not only be exempted from the birth certificate
requirements, but also wholly exempt from the entire enrollment process
since these individuals do not pose any potential threat. However, one
State said it lacks the expertise to opine on the risk of terrorism
this exemption would pose.
Response: As noted above, DHS is not proposing to exempt any
individuals from the REAL ID enrollment process.
Comment: Other commenters suggested the following exemptions from
reenrollment: individuals for whom proof of identity, residency, lawful
status and SSN can be proven electronically, and citizens who are
elderly, disabled, in nursing homes or mental institutions and who will
not be getting on an airplane or entering a Federal facility.
Response: As noted above, DHS is not proposing to exempt any
individuals from the REAL ID enrollment process. DHS urges States to
make appropriate accommodations for handling the elderly, disabled, and
those in nursing homes or mental institutions. Section 202(d)(11) of
the Act gives States the opportunity to issue non-compliant licenses
that are not accepted for official purposes and may not necessarily
require an in-person enrollment, depending on the State's issuance
process.
Question 4: If a State chooses to produce driver's licenses and
identification cards that are WHTI-compliant, whether citizenship could
be denoted either on the face or machine-readable portion of the
driver's license or identification card, and more generally on the
procedures and business processes a State DMV could adopt in order to
issue a REAL ID driver's license or identification card that also
included citizenship information for WHTI compliance. DHS also invites
comments on how States would or could incorporate a separate WHTI-
compliant technology, such as an RFID-enabled vicinity chip technology,
in addition to the REAL ID PDF417 barcode requirement.
See full discussion of comments and responses to this question in
section P.
Question 5: How DHS can tailor the address of principal residence
requirement to provide for the security of classes of individuals such
as Federal judges and law enforcement officers.
See full discussion of comments and responses to this question in
section I.
Question 6: What benchmarks are appropriate for measuring progress
toward implementing the requirements of this rule and what schedule and
resource constraints will impact meeting these benchmarks.
Comment: AAMVA listed ten criteria for measuring a State's progress
towards implementation of the REAL ID requirements--procurement
practices, process changes, contractual arrangements, funding,
legislative authority, personnel, facilities, computer systems, new
verification systems, and existing verification systems. Some States
suggested variations on these themes, proposing that a set of
standardized benchmarks was not realistic. Rather, each State should be
able to determine appropriate benchmarks depending on what they had to
do to implement REAL ID. Progress could be measured against
implementation plans States submitted to DHS and should be based on a
phased approach. One State suggested that DHS create a matrix that
could be used to show progress for the major components of REAL ID.
Another State argued that it is difficult to establish benchmarks
before all regulatory requirements have been finalized. One State
recommended a ``strategic'' rather than ``prescriptive'' implementation
approach.
One privacy group stated that the final rule must include robust
security standards for national querying systems. A vendor association
provided detailed recommendations on access control and authentication
practices. One State made very detailed recommendations on privacy
standards including a pre-defined audit requirement. A vendor
association recommended strong sanctions for violations of procedures
to deter the insider threat and notification of anyone whose
information is breached.
Response: The final rule specifies the elements necessary to be
REAL ID-compliant, and DHS has proposed a checklist process for States
to demonstrate completion of certain compliance benchmarks, and full
compliance with the Act and these regulations.
Question 7: Adoption of a performance standard for the physical
security of DMV facility, including whether DHS should adopt the ANSI/
NASPO ``Security Assurance Standards for the Document and Product
Security Industries,'' ANSI/NASPO-SA-v3.OP-2005, Level II as the
preferred standard.
See comments and responses to this question in section M.
Question 8: How DHS can better integrate American Samoa and the
Commonwealth of the Northern Marianas into the REAL ID framework.
Comment: Several States indicated that individuals from American
Samoa and the Commonwealth of the Northern Marianas should be issued a
REAL ID if they provided acceptable documents like birth certificates,
valid passports, unexpired driver's license, or U.S. issued immigration
documents.
In addition, a few States supported an exception process for these
territories. One State said that without Federal funds, it would be
difficult if not impossible for both territories to comply due to
complexity, cost and timing issues. Some States questioned whether
American Samoa would be able to issue driver's licenses and
identification cards under the REAL ID Act and regulations. Other
States claimed that without evidence of U.S. citizenship, Northern
Marianas residents would not be able to obtain a license or card. One
State recommended that DHS accept the Northern Mariana Card (I-873) to
establish identity and residency. Customers without this card could be
assisted under current State exceptions processes. Another State also
suggested acceptance of the Re-entry Permit/Refugee Travel Document (I-
327, I-571).
AAMVA and some States requested clarification as to the specific
issue caused by these groups of applicants.
Response: DHS believes that American Samoa and the Commonwealth of
the Northern Marianas will be capable of complying with the REAL ID
requirements in the same time frame as other States and Territories.
Question 9: Whether the physical security standards proposed in
this rule are the most appropriate approach for deterring the
production of counterfeit or fraudulent documents, and what contractual
issues, if any, the States will face in satisfying the document
security requirements proposed in this rule.
Comment: See comments and responses to this question in section I.
Also, AAMVA commented that States will face significant contractual
conflicts if the document security standards in this NPRM remain in the
final rule. States are using the AAMVA Driver Licensing and
Identification Card Design Specification as the model to prepare bid
packages for new contracts or renewals. Contract periods for card
vendors vary by State and are driven by procurement rules. One State,
for example, has a contract in place for the next seven years. Most
States have at least five year contracts. AAMVA
[[Page 5317]]
recommended that DHS use the AAMVA Driver Licensing and Identification
Card Design Specification as the minimum card security standard,
allowing States to build on its provisions. States should not be
expected to break or amend existing contracts and should not be
expected to implement any changes to card security until their existing
contracts expire.
Response: See comments and responses to this question in Section I.
Question 10: The Federalism aspects of the rule, particularly those
arising from the background check requirements proposed herein.
Comment: Several commenters said that REAL ID was beyond Congress's
enumerated powers because the States have a valid immunity claim.
Another commenter wrote that REAL ID usurped States' traditional
authority. One commenter wrote that it is a violation of the tribal-
Federal relationship to require a tribal government official to go to a
State government official in order to obtain proof of identification in
order to travel and conduct official tribal-Federal government
business. One commenter said that State DMVs cannot revoke licenses or
identification cards issued by another State. One State found no
Federalism issues as States are able to control the design, and,
potentially, the security features of its cards. However, other States
voiced a number of Federalism concerns.
One State presented a list of impacts flowing from the REAL ID
program: Procurement practices, process changes, existing contractual
arrangements that cannot be altered without significant penalty, fund
appropriations, laws, facilities, computer systems, requirement of new
verification systems. Similarly, some States argued that the REAL ID
regulation could not survive a challenge brought under the 10th
Amendment of the Constitution. It continued, ``Given an affidavit
issued by the Governor of the Commonwealth, DHS would have universal,
unfettered access to employees and systems that are dedicated to a
traditionally State function.'' Another State wrote that DHS should not
intrude into the traditional State function of licensing drivers and
issuing identification cards by attempting to prescribe the processes
for creating, issuing, and administering REAL ID cards, and that DHS
should specify the security, performance, and quality characteristics
that REAL ID participating jurisdictions must achieve. Some commenters
believed that the REAL ID Act violates both the spirit and the letter
of Federalism law. The commenters wrote that the REAL ID Act aims to
conscript the States into creating a national ID system, and that it is
``this kind of scheme'' that the Framers expected Federalism to guard
against. Because of this, many States have passed anti-REAL-ID
resolutions and legislation.
Response: The REAL ID Act provides the Secretary of Homeland
Security with authority to issue regulations. DHS understands that
there is a balance between Executive discretion in interpreting the
REAL ID Act through regulation, while also respecting the States'
autonomy to govern an inherently State function--the driver's license
and identification card issuance process. DHS has attempted to preserve
State autonomy wherever possible, while remaining consistent with the
Act, and believes these regulations represent a logical interpretation
of the Act and Congressional intent.
Comment: One commenter argued that States should have discretion to
determine whether to conduct background checks on State employees. One
State DMV said that because it conducts a fingerprint-based background
check on its employee-applicants, implementing the REAL ID requirement
would have ``minimal'' impact. In contrast, one State said that in
requiring a background check for State employees, DHS is
``overreaching.'' Because the requirement includes several checks, only
one of which a DMV could use to disqualify an employee from performing
certain REAL-ID-related activities, a State argued that the rule
impacts both the individuals a State may hire and retain in certain
positions. It also requires a collection of information for no stated
reason. Another State DMV wrote that DHS goes beyond the statutory
language in requiring a background check, and suggested that DHS strike
the provision.
With regard to the financial history check, one State noted that
this aspect of the draft regulation would intrude into the relationship
that State governments have with their employees. It argued that DHS
could avoid Federalism issues by having its regulations ``express the
security characteristics that a State would need to achieve rather than
prescribe how State processes should operate.'' The Federal government,
it said, should not regulate hiring practices for State employees. One
State wrote that it has discontinued credit checks because it was not
an adequate indicator of a person's behavior or ethics.
Response: As noted above, DHS believes it has the authority to
require background checks. Based on the comments received, DHS has
decided to eliminate the financial history check of DMV covered
employees and prospective employees.
Comment: Although one State agreed that DHS has authority to review
State compliance within the scope and criteria of the auditing granted
by the statute, this State asserted that DHS exceeded the scope of its
authority in promulgating Sec. 37.59(a), which lacks a check on
seemingly unlimited Federal authority to inspect State processes.
Response: DHS does not believe the language of Sec. 37.59(a)
provides DHS with unfettered authority to oversee the actions of State
government. Indeed, the section provides the opportunity for States to
challenge a DHS determination of non-compliance, rather than a Federal
authority with no right of appeal. DHS has also relaxed the reporting
requirements in this final rule in response to comments that the
reporting requirements in the NPRM were too burdensome.
Comment: One State asserted that it is beyond DHS's authority to
compel non-participating States to maintain a motor vehicle database
with the minimum required REAL ID information and to share access to
any such database with other States.
Response: DHS is not compelling non-participating States to meet
any of the requirements of these rules.
Comment: A State objected to the requirement that a REAL ID
cardholder's address change requires the person to report and document
the change in person at a DMV office. The State says it is apprehensive
that the proposed rules erode the important principles of Federalism,
especially regarding managing elections. When a driver applies for
voter registration, the State automatically checks to see whether the
address given on that card is the same as the address on a State-issued
driver's license or identification card. If there is a mismatch, State
law requires automatically changing the license or identification card
address to match that on the voter application form. This State
requested that DHS give serious consideration to allowing this
automatic updating practice to continue. Another commenter said DHS
should ensure that the final regulations continue to provide States
maximum flexibility to determine which employees are subject to the
requirements of this section.
Response: As noted elsewhere, the final rules do not require an
individual to have an in-person transaction with the DMV to change
their address.
Comment: One commenter said that because direct regulation of the
States would be unconstitutional, the REAL ID
[[Page 5318]]
Act inappropriately conditions Federal acceptance of State-issued
identification cards and driver's licenses on their meeting certain
Federal standards. The commenter was also concerned that DHS was using
State machinery to implement a Federal program. However, the commenter
asserted that it is within Federal power for DHS to condition
acceptance of identification cards and driver's licenses on priorities
closely related to national security, including meeting standards for
privacy and data security.
Response: Congress passed the REAL ID Act to implement a
recommendation of the 9/11 Commission Report to increase the security,
credibility and confidence in identification documents. Congress, in
drafting the law, and understanding the Constitutional concern of
directly regulating the States, made the law binding on Federal
agencies in specifying that only REAL ID-compliant driver's licenses
would be accepted by Federal agencies for official purposes after the
law is implemented. DHS agrees with the commenter that the Federal
government has the authority to condition acceptance of driver's
licenses and identification cards on the meeting of certain standards
and requirements as defined in the REAL ID Act and the implementing
regulations.
Comment: One commenter concluded that Congress and DHS could have
supported meaningful Federalism by supporting States' pre-REAL ID
initiatives to produce an interstate compact to achieve
interoperability of State databases.
Response: This comment is outside the scope of the rulemaking.
Question 11: How the Federal government can better assist States in
verifying information against Federal databases.
Comment: Several States and other commenters had a number of
suggestions including the following:
--Develop and test or enhance Federal databases to meet States' needs.
--Establish standards for system performance and connectivity.
--Ensure that matches can be made with as little manual intervention as
possible.
--Establish standard naming conventions.
--Put security standards in place.
--Fund system development and assist States financially in performing
verifications.
Response: DHS is collaborating with its Federal partners, AAMVA and
the States to design and implement verification systems to support the
requirements of the REAL ID Act and regulations. DHS is working on
improving the reliability, usability and accuracy of existing systems
like SSOLV and SAVE to meet States' needs to minimize the manual
intervention necessary.
In addition, DHS will work with DOT, AAMVA and the States to
reinforce the security and privacy features of this communications and
systems architecture to include practices consistent with fair
information and Federal Information Security Management Act principles.
In partnership with DOT, AAMVA, and the States, DHS will issue best
practices to guide future systems design, development and operation.
DHS is also working with Federal, State, and nongovernmental
organizations to identify and improve name formats and matching
algorithms used by identify verification.
Question 12: In addition to security benefits, what other ancillary
benefits could REAL ID reasonably be expected to produce? For example,
could REAL ID be expected to reduce instances of underage drinking
through use of false/fraudulent identification. If so, please provide
details about the expected benefit and how it would be achieved through
REAL ID.
Comment: Several commenters wrote that REAL ID will decrease
identity theft. Several other commenters thought that a decrease in
theft might not be attributed to REAL ID but be due to the fact that
many States are implementing more stringent rules for obtaining a
driver's license.
A few commenters claimed that REAL ID will have little to no impact
on identity theft. One commenter noted that most instances of identify
theft are a result of a stolen social security numbers or credit cards,
and that REAL ID does not address these types of thefts. Another
organization stated that ``loopholes'' in the source documentation
requirements for those without a permanent addresses or birth
certificates take away any perceived REAL ID benefit.
Most of the commenters thought that REAL ID would increase identity
theft. Commenters wrote that the NPRM did not propose sufficient
protection and security controls to ensure that the information being
collected and stored will be immune to theft or misuse. Several
commenters said that the databases storing digital images of social
security numbers, bank statements, and birth certificates will be an
identity-thief's dream target. These images, once in the hands of
criminals, will be easy to counterfeit. If systems are linked, a single
breach in security will potentially compromise 240 million individuals.
Several commenters also highlighted that threat to this information may
come from within DMVs. One organization quoted that over 100 million
records of U.S. residents have been exposed due to security breaches.
Response: DHS provided a detailed analysis on the ancillary
benefits of the proposed rule on REAL ID. We noted, as the comments
suggested, that the proposed rule may have only a small impact on
reducing identity theft. REAL ID will only have the ability to impact
those types of identity theft that require a drivers license for
successful implementation and only to the extent that the rulemaking
leads to incidental and required use of REAL ID documents in everyday
transactions, which is an impact that also depends critically on
decisions made by State and local governments and the private sector.
With the current costs of identity theft being high, we believe that
even if the ancillary benefits associated with identity theft are low,
when these benefits are combined with other benefits of this
rulemaking, that this rule is cost-beneficial.
Many commenters believe that REAL ID would increase identity theft.
We find, at the current time, that it would be difficult to draw any
conclusions such as this since the effort or cost to individuals to
obtain and use a passable fraudulent identification card is expected to
be much higher than it is at present. Only those people who believe
that they will reap substantial benefits would be willing to incur the
cost of creating and using a fraudulent identification card.
With regard to the general comment that REAL ID is expected to
reduce instances of underage drinking through the use of false/
fraudulent identification, DHS believes that REAL ID may reduce on the
margin the rate at which underage drinking occurs. The rate at which it
does so partly depends on State and local authority and/or private
employer decisions as to what form of identification is acceptable for
particular purposes, and the effectiveness with which identification
checks are implemented. DHS is not willing to quantify, at this time,
the expected benefits that would be achieved from a reduction in
underage drinking.
Comment: Regarding the ancillary benefits of REAL ID, some States
supported DHS's suggestion that REAL ID could reduce underage drinking
and purchase of cigarettes by making it easier for vendors to identify
fake identification cards. Other commenters wrote that REAL ID could
also promote
[[Page 5319]]
highway safety by allowing law enforcement officers to process
vehicular accidents and traffic citations faster and more accurately,
and potentially aid other law enforcement efforts.
Several commenters noted that one of the possible ancillary effects
of a REAL ID is that commercial entities will be able to market to
individuals without the individual's permission. The MRZ and the 2-D
barcode technology discussed in the NPRM makes it easier for third
parties to obtain sensitive information about the holder of the cards.
Several commenters gave examples of how commercial entities will make
REAL ID the default document for everyday transactions and thus will be
able to obtain, store, and track individual's age, address, and
purchases.
Three organizations noted that State transactions, such as the
issuance of professional/occupational licenses (for example, licensing
for doctors, lawyers, nurses, real estate brokers) and hunting and
fishing licenses, could be done with a higher level of assurance that
the license is being given to the right person. Two other organizations
also said that health-related and financial companies would also
receive security benefits associated with more trust in the validity of
the identification cards. One commenter stated that all employers would
benefit because they would be better able to determine employment
eligibility.
Response: DHS believes that the potential ancillary benefits of
this rulemaking would be in many areas. Should acceptance of REAL ID
cards become widespread, such ancillary benefits may include reduction
in fraudulent access to public subsidies and benefits programs, illegal
immigration, unlawful employment, unlawful access to firearms, voter
fraud, underage drinking, and underage smoking. DHS believes that REAL
ID may reduce on the margin, the rate at which these fraudulent
activities take place. The degree to which they do so will partly
depend on State and local authority and/or private employer decisions
as to what form of identification is acceptable for particular
purposes, and the effectiveness with which identification checks are
implemented. DHS cannot, at this time, measure these benefits
quantitatively.
With regards to organizations, businesses, etc., DHS is not
preventing the use of REAL ID in State transactions and the individual
who is having the document presented to him can place any level of
trust he/she wants in the REAL ID document.
Question 13: The potential environmental impacts of the physical
security standards and other requirements proposed under this rule.
Comment: A State recommended that DHS seek out U.S. EPA or a
similar group to evaluate the potential environmental impacts. One
State DMV wrote that the environmental impacts of the rule would be
minimal. States may have to perform the required environmental impact
analysis if changes to issuance facilities are necessary. AAMVA
suggested that environmental impacts associated with retrofitting the
facilities to meet physical security standards will result in some
environmental risks such as asbestos removal.
One State asserted that the increased visits by individuals to
renew their licenses and corresponding activities associated with
creating a license (for example, increased usage of electricity,
scanners, copiers, printers, and paper) will impact air, ground, and
water quality, and result in unnecessary waste disposal and consumption
of natural resources, electricity, and other fuels and add to traffic
congestion. This State recommended that DHS revise the rule to employ a
phased approach which could allow States to certify and renew on
schedules that will not adversely impact the normally occurring renewal
cycle.
One commenter suggested that the durability provided by longer life
driver's licenses and identification cards could result in less
material going into the waste stream resulting in an environmental
benefit.
Response: DHS carefully evaluated those comments along with other
potential environmental impacts of this rule. The comments show that,
if the States choose to create a REAL ID process, any potential
environmental impacts which might be significant, can be mitigated. DHS
concludes that the rule's potential impacts are minimal and notes that
the rule does not force an immediate action but only lays the
foundation for subsequent action. If States seek follow-on DHS grant
funding, approval, or other activity for implementation of the rule,
then the potential environmental impacts associated with the follow on
activity must be reviewed.
Question 14: Whether other Federal activities should be included in
the scope of ``official purpose.''
See comment and response to this question in section B.
Question 15: How the REAL ID Act can be leveraged to promote the
concept of ``one driver, one record, one record of jurisdiction'' and
prevent the issuance of multiple driver's licenses.
Comment: Most commenters supported the ``one driver, one record
concept,'' and most States said Federal funding for an ``all drivers''
system would promote the concept. A couple of States specifically
endorsed DRIVerS (Driver Record Information Verification System). Many
States joined AAMVA in endorsing a State's initiative to enter into a
Driver License Agreement to develop ``a nationwide pointer system with
the driver record and driver history transferred to a `change State
record' when the driver moves to a new State.'' AAMVA and many States
also endorsed basing any such pointer system on the Commercial Driver
License Information System (CDLIS).
One State said that any ``all drivers'' verification system must
include ``reciprocity rules'' so that an individual who is required to
move frequently across States need not undergo a complete REAL ID check
every time. However, one commenter said a CDLIS-type system is a
concern because it is a ``one person one license (or ID card) one
record system'' with no regulatory or statutory limitations on who can
access information and for what purpose. To protect privacy and ensure
driver safety across States, the commenter said the existing Problem
Driver Pointer System/National Driver Register is better.
A few commenters also joined AAMVA in endorsing the AAMVA/National
Highway Traffic Safety Administration joint initiative to develop a
digital image exchange project to identify multiple State license
holders. Some States echoed a comment from AAMVA that because a
driver's license applicant must surrender his or her current license
from another State as a condition of receiving a new license, the
States already follow a policy of one driver, one license. Another
State said that States should require a driver's license applicant to
self-declare the existence of a prior compliant or non-compliant
license or card and require confiscation and notification to cancel
before the new State issues a document. Several commenters endorsed
using the Driver License Agreement compact as an extant system for
promoting ``one driver, one record.''
Other process recommendations included the suggestion that a
national business process standard be developed to let jurisdictions
know of the theft or loss of a REAL ID card and forming an agreement
similar to the DLA that both REAL ID and non-REAL ID States can use to
ensure cross-checking before a jurisdiction issues any driver's
license.
[[Page 5320]]
Requiring ``cleaning'' of existing databases and comparing legacy
databases used to issue a REAL-ID compliant card was also recommended.
One commenter said that having only one license for multiple
purposes would better promote the concept than having non-REAL ID and
REAL ID driver's licenses. It also said that the United States must
accept standards nationwide to be used with confidence of driver's
license exchange to move across boundaries and should encourage/mandate
reciprocity of like licenses.
Some commenters noted problems with implementing the ``one driver,
one record'' concept, stating that, without participation by all
States, the system is fundamentally flawed in that a person could hold
multiple non-REAL ID driver licenses and a REAL ID-compliant card. One
State said that DHS lacked authority to compel a non-REAL ID State to
participate in systems that promote the concept. It suggested that the
``one driver, one record concept'' should only apply to the REAL ID-
compliant system.
Other States said the rules should allow a person to hold both a
REAL ID-compliant card and a non-REAL ID card in any combination ``with
the limitation that a driver has no more than one license and one card
at a time.'' One State suggested that a person not hold more than two
REAL ID-compliant cards at a time: a driver's license and an
identification card. This commenter said a person might wish to carry a
REAL ID-compliant card and keep another at home. One State said that it
issues identification cards to individuals who may hold a license in
another State.
Some States said that DHS's proposal and the REAL ID Act impede
``one driver, one record.'' That would happen, these commenters said,
where these authorities require ``a State DMV to take measures to
confirm that an applicant has terminated or has taken steps to
terminate a REAL ID driver's license or identification card issued in
another State.'' One State proposed that DHS change Sec. 37.33(c) to
state that a person who applies for a REAL ID in his or her State of
residence has ``taken steps to terminate the prior card.'' One State
wanted to know how DHS would define ``terminate.''
One State said that because there is no system through which a
State could check whether a person already holds a REAL ID driver's
license or identification card in another jurisdiction, DHS should
eliminate the requirement that States must make such a check. Another
State asserts that such a capability should exist now across all fifty
States.
Several commenters remarked on the use of technology to promote the
``one driver, one record'' concept. One commenter endorsed smart card-
enabled REAL ID documents requiring a one-to-one match. A consulting
group described a biometric identifier as the only known manner to
prevent one individual from procuring more than one license or
identification document. This commenter said DHS should identify and
standardize a suitable biometric property and create a privacy-
sensitive solution for performing the necessary biometric comparisons.
One commenter said that DHS should have presented and analyzed in
detail different architecture models (other than CDLIS) for the system
States can use to check whether a REAL ID applicant already holds a
REAL ID card issued by another jurisdiction. Noting that a system
promoting ``one driver, one record'' must promote privacy, security,
and accuracy, another commenter said CDLIS is not a federated query
system, but a national database. It commented that simply scaling up
this system will not establish a federated query service, but will
create a national ID.
One commenter wrote that it is concerned about DHS's failure to
articulate what defines a person's unique driver's license or
identification card number; the proposed rule is silent on the form
this unique number will take and does not specify whether the number
will be unique nationally or solely within a single State.
Response: Section 202(d) of the REAL ID Act prohibits States from
issuing REAL ID cards to a person who holds a driver's license in
another State without confirmation that the person has terminated, or
is taking steps to terminate, the other license. We have amended this
final rule to clarify this statutory requirement. See Sec. 37.33. DHS
supports the concept of one driver, one license. DHS is not, however,
authorized under the REAL ID Act to use this final rule to prohibit
States from issuing non-REAL ID driver's licenses to persons who hold
licenses in other States or to find that a State is not in compliance
with the minimum standards of the REAL ID Act if such State issues
driver's licenses to persons holding licenses in other States. DHS is
limited under its authority in the REAL ID Act to prohibiting States
from issuing REAL ID cards to persons who hold licenses in other States
or who hold another REAL ID card.
Question 16: Whether DHS should standardize the unique design or
color required for non-REAL ID under the REAL ID Act for ease of
nationwide recognition, and whether DHS should also implement a
standardized design or color for REAL ID licenses.
Comment: A few States said that although a REAL ID should be
recognizable as such, a standardized appearance would facilitate
counterfeiting. Another State suggested that States should only have to
mark REAL ID-compliant cards, not mark non-compliant cards. Other
commenters supported the use of an identifier for non-compliant
licenses and cards, as DHS would need a mechanism to tell if a license
issued before the Act was compliant. NGA recommended placing a
restriction code on the front of the license with text on the back to
denote whether the license was REAL ID-compliant. AAMVA, several
States, and another commenter all argued against standardizing a unique
design or color for the non-Real ID cards. Some commenters wrote that
DHS had no authority to require States to adopt a standard design or
color for the non-REAL ID cards, citing Federalism. One commenter wrote
that mandating distinct designs or colors for both REAL ID and regular
license and ID cards and requiring non-REAL ID driver's licenses to
have an ``invalid for Federal purposes'' designation turns the
voluntary card into a mandatory national ID. Several also expressed
concern that standardization would make counterfeiting of the cards
easier, since counterfeiters would only have to focus on one document.
The consequences of successful counterfeiting would be more severe,
they said, since the whole system would be compromised and all States
would then have to change their cards. Some commenters said that
diversity in security features, as long as they met a common
performance standard, would be best. Commenters said that a
standardized design would increase the perception that a national
identification system was being created.
Response: While cards that do not satisfy the requirements of the
Act must clearly state on their face that they are not acceptable for
official purposes, DHS is not mandating a specific design or color for
such cards. DHS agrees with States that recommended marking compliant
cards and as such, requires compliant cards to be marked with a DHS-
approved security marking.
Comment: Many commenters opposed a REAL ID standard design. One
commenter wrote that requiring a single standard configuration will
limit the ability of jurisdictions to adapt to changing threats in
their particular environment and could drive up costs
[[Page 5321]]
unnecessarily. Many States expressed concern about increasing the
threat and consequences of counterfeiting. Several States said they
should be allowed to continue to use unique designs for their driver's
licenses and ID cards (one noting it held great value for State
identity), while others argued that States should be allowed to
maintain control of the design of their licenses to the greatest extent
possible. AAMVA noted that its current Card Design Specification does
not require a similar color for all States, although it standardizes
security features. AAMVA recommended that ``branding'' be applied to
the REAL ID, but it also recognized that this would lead some
individuals to believe this was a step toward a national ID card. State
commenters wrote that a benefit of a standard color would be to ease
training of screeners and help ensure that screeners could easily
identify a compliant REAL ID-compliant card.
One commenter wrote that REAL ID should mandate a standardized
color or design. However, other commenters wrote that DHS should not
mandate a standard design or color, that a standard design is not
authorized by the REAL ID Act, that a standardized design is strictly
prohibited by the Intelligence Reform and Terrorism Prevention Act of
2004, Public Law 108-458, and that a uniform REAL ID design would be an
``enormous'' security risk.
Response: DHS is not mandating a single design or color for REAL
ID-compliant driver's licenses or identification cards, and recognizes
a State's right to have a unique design. However, in response to
several commenters, DHS is requiring that cards issued in compliance
with REAL ID be marked with a DHS-approved security marking.
V. Regulatory Analyses
A. Paperwork Reduction Act
The Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501 et seq.)
requires that DHS consider the impact of paperwork and other
information collection burdens imposed on the public and, under the
provisions of PRA section 3507(d), obtain approval from the Office of
Management and Budget (OMB) for each collection of information it
conducts, sponsors, or requires through regulations.
This rule contains the following new information collection
requirements. Accordingly, DHS submitted a copy of these sections to
OMB for its review. OMB has not yet approved the collection of this
information.
This final rule will require States participating in the REAL ID
program to meet certain standards in the issuance of driver's licenses
and identification cards, including security plans and background
checks for certain persons who are involved in the manufacture or
production of driver's licenses and identification cards, or who have
the ability to affect the identity information that appears on the
license (covered employees). This rule will support the information
needs of: (a) The Department of Homeland Security, in its efforts to
oversee security measures implemented by States issuing REAL ID
driver's licenses and identification cards; and (b) other Federal and
State authorities conducting or assisting with necessary background and
immigration checks for covered employees.
The likely respondents to this proposed information requirement are
States (including the District of Columbia, Puerto Rico, the Virgin
Islands, Guam, American Samoa, and the Commonwealth of the Northern
Mariana Islands) and State agencies (such as Departments of Motor
Vehicles).
DHS estimates that each State will submit a certification of
compliance or request for extension, together with a security plan.
Subsequently, each State will be required to re-certify its compliance
with the REAL ID Act every three years on a rolling basis. As part of
the certification package, States will be required to submit (1) A copy
of their security plan; (2) their documented exceptions and waivers
procedures; and (3) a written report on card security and integrity
(which must be updated whenever a security feature is modified, added
or deleted). DHS estimates that States will spend approximately 42,000
burden hours in the first year to complete the certification
requirements. DHS projects that the burden hours will rise to 56,000
hours annually in subsequent years. DHS estimates the cost to the
States will be $1.11 million in the first year and $1.48 million every
year thereafter, for an annualized cost estimate (over three years) of
$1.35 million.
States must subject covered employees to a background check, which
includes a name-based and fingerprint-based criminal history records
check (CHRC). DHS estimates States will incur costs for employee
background checks of $1.44 million in the first year, $0.61 million in
the second year, and $0.37 million in the third year, for an annualized
cost estimate of $0.80 million.
Finally, States must maintain photographs of applicants and records
of certain source documents. DHS estimates that States will incur
2,275,000 hours for information technology (IT) in the first year, and
348,000 hours in subsequent years, for an annualized hour burden
estimate (over three years) of 990,333. DHS estimates that ten percent
of all IT costs is related to the recordkeeping requirements. Thus, DHS
estimates that out of a total one time cost of $601.9 million for all
State systems, ten percent, or $60.2 million, will be incurred in the
first year, and $9.3 million in the second and third years as a result
of this collection of information, for an annualized cost of $26.26
million.
DHS received no comments directed to the information collection
burden.
As protection provided by the Paperwork Reduction Act, as amended,
an agency may not conduct or sponsor, and a person is not required to
respond to, a collection of information unless it displays a currently
valid OMB control number.
B. Economic Impact Analyses
Regulatory Evaluation Summary
Changes to Federal regulations must undergo several economic
analyses. First, Executive Order 12866, Regulatory Planning and Review
(58 FR 51735, October 4, 1993), directs each Federal agency to propose
or adopt a regulation only upon a reasoned determination that the
benefits of the intended regulation justify its costs. Second, the
Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq., as amended by
the Small Business Regulatory Enforcement Fairness Act (SBREFA) of
1996) requires agencies to analyze the economic impact of regulatory
changes on small entities. Third, the Trade Agreements Act (19 U.S.C.
2531-2533) prohibits agencies from setting standards that create
unnecessary obstacles to the foreign commerce of the United States.
Fourth, the Unfunded Mandates Reform Act of 1995 (UMRA, 2 U.S.C. 1531-
1538) requires agencies to prepare a written assessment of the costs,
benefits, and other effects of proposed or final rules that include a
Federal mandate likely to result in the expenditure by State, local, or
tribal governments, in the aggregate, or by the private sector, of $100
million or more annually (adjusted for inflation).
Although Congress recognized that States will have to expend monies
in order to comply with REAL ID, it explicitly stated that the REAL ID
Act is binding on the Federal government, and not the States. Moreover,
by its terms, UMRA does not apply to regulations ``necessary for the
national security''
[[Page 5322]]
and those which impose requirements ``specifically set forth in law.''
Thus, as a matter of law, the UMRA requirements do not apply to this
final rulemaking even though States will be expending resources.
However, the analyses that would otherwise be required are similar to
those required under Executive Order 12866, which have been completed
and may be found in the detailed Regulatory Evaluation placed in the
public docket.
Executive Order 12866 Assessment
DHS has determined that this rule will have an impact of over $100
million and that it raises novel or complex policy issues. Accordingly,
this rule is economically significant under Section 3(f)(1) of
Executive Order 12866 and therefore has been reviewed by the Office of
Management and Budget.
DHS has assessed the costs, benefits and alternatives of the
requirements finalized by this rule. A complete regulatory impact
assessment, as required under Executive Order 12866 and OMB Circular A-
4, will be set forth in a separate document in the docket for this
regulatory action at http://www.regulations.gov at Docket Number DHS-
2006-0030. The details of the estimated costs and benefits, including
potential ancillary benefits realized by the requirements set forth in
this rule, follow the A-4 Accounting Statement. The uncertainty
analyses are being recomputed and will be published in the forthcoming
final regulatory impact assessment.
The Department of Homeland Security (DHS) is conducting a
Regulatory Evaluation of the benefits and costs of the final minimum
standards for State-issued driver's licenses and non-driver
identification cards pursuant to the REAL ID Act of 2005. These
standards will impact the lives of approximately 240 million people and
the operations of all 56 State and territorial jurisdictions.
Assumptions
This Regulatory Evaluation covers the eleven-year costs of REAL ID
Program deployment and operations. This includes:
Years One through Four--the three and one-half year period
from January 2008 to May 11, 2011 during which States will have time to
make the business process changes and investments to meet the standards
of REAL ID. In addition, States meeting the interim standards of
Material Compliance with the rule must begin enrolling their
populations in REAL ID beginning no later than January 1, 2010.
Years Four through Eleven--the seven year period during
which States will continue and complete enrollment of their populations
in REAL ID. States will begin issuing fully compliant REAL ID licenses
no later than May 11, 2011. Moreover, DHS has adopted an age-based
approach to REAL ID enrollment. By December 1, 2014 all individuals
born on or after December 1, 1964 (that is, 50 years of age or under)
will be required to present a REAL ID if they use a State-issued
document for official purposes. Thus, individuals born on or after
December 1, 1964 will have a minimum of four years to obtain a REAL ID.
Individuals born before December 1, 1964 will have an additional three
years to enroll before the final enforcement deadline of December 1,
2017.
The final rule incorporates significant changes to the Notice of
Proposed Rulemaking. As a result, we have revised some of the
assumptions upon which the original Regulatory Evaluation was based.
The revised assumptions are detailed below:
(1) That All States Will Comply in Accordance With the Revised Timeline
DHS recognizes that most, if not all States will be unable to
comply by May 2008 and will file requests for extensions that will
result in compliance implementation schedules that could mitigate some
of the startup costs examined below. Hence, the costs allocated to the
period prior to May 2008 will be redistributed to subsequent years.
(2) That 75 Percent of the Nation's DL/ID Holders Will Seek a REAL ID
Credential
The original NPRM assumed that 100% of the candidate population
would seek to obtain REAL IDs. This assumption was combined with two
additional assumptions, namely that:
1. States will not require all individuals to obtain a REAL ID;
2. Some States will continue to issue non-compliant licenses along
with REAL IDs.
The Department has reviewed the 100% assumption and concluded that
it is unrealistic in light of the latter two assumptions. If States do
not require all applicants to obtain REAL IDs, it is highly improbable
that 100% of the population will apply. It is difficult to cite any
example of a truly voluntary course of action that results in 100%
compliance. If States offer a choice of either compliant or non-
compliant licenses to applicants, some portion of the population will
choose to receive a non-compliant license because:
1. They do not need a REAL ID for Federal official purposes.
2. They already possess a substitute document--for example, a U.S.
passport--that will serve the same purpose as a REAL ID.
Thus, the Department has reconsidered and eliminated the assumption
that every individual 16 or older will seek to obtain a REAL ID within
the timeframe of this analysis.
The difficult question, therefore, is what level of participation
in REAL ID can be realistically expected? What should be the primary
estimate for participation by the American public in REAL ID?
The Regulatory Evaluation utilizes a primary estimate of 75% based
upon the following analysis:
1. A significant number of States will not require that all
residents seeking driver's licenses or identification card obtain a
REAL ID. Eight states currently issue licenses to individuals who
cannot demonstrate lawful states and a significant number of States are
likely to make REAL IDs an option.
2. 25% of the population already holds a valid passport and the
Department of State anticipates that this figure will increase to
approximately 33% in the next few years.\3\ Individuals with valid
passports do not need to obtain a REAL ID as passports are likely to
also be accepted for the same official purposes (i.e., boarding
commercial aircraft) as a REAL ID.
---------------------------------------------------------------------------
\3\ Testimony of Maura Harty, Assistant Secretary of State for
Consular Affairs, before the Senate Foreign Relations Committee,
International Operations and Organizations Subcommittee, June 19,
2007, at http://travel.state.gov/law/legal/testimony/testimony_806.html.
---------------------------------------------------------------------------
3. 20% of the population has never flown on a commercial airplane
and 47% flies ``rarely or never.'' \4\ This second group is unlikely to
need a REAL ID and members of this group are highly unlikely to belong
to the group of valid passport holders.
---------------------------------------------------------------------------
\4\ Statistics reported in The Airline Handbook, issued by the
Air Transport Association and located at http://members.airlines.org/about/d.aspx?nid=7954 and by the Gallup
Organization at http://www.gallup.com/poll/1579/Airlines.aspx.
---------------------------------------------------------------------------
4. These two groups, combining to constitute a group of at least
40% of the population, should not need to obtain a REAL ID as
acceptance of identification for official purposes. Assuming that a
large proportion of this group will seek to obtain a REAL ID regardless
of imminent need, we believe that 25% of the candidate population will
not seek to obtain a REAL ID.
(3) States Will Issue Both REAL IDs and Non-REAL IDs
DHS anticipates that States will offer an alternative DL/ID (not
acceptable for official purposes) to those who are
[[Page 5323]]
unwilling or unable to obtain a compliant one. A number of States issue
or plan to issue licenses to individuals that cannot document lawful
status. Other States are expected to allow individuals to hold both a
driver's license and identification card. Finally, a number of States
have evaluated or expressed interest in offering REAL IDs as an
additional, voluntary license. This Regulatory Evaluation assumes that
States will deploy a two-tier or multi-tier licensing system. States
instead may choose to issue only REAL ID-compliant driver's licenses
and identification cards, thereby reducing their operational and system
costs.\5\
---------------------------------------------------------------------------
\5\ Eight states currently issue licenses to undocumented
immigrants and will--most likely--continue to do so. These States
are: Michigan, Maryland, Hawaii, New Mexico, Oregon, Utah,
Washington, and Maine.
---------------------------------------------------------------------------
(4) That All IT Systems Will Be Functional by May 11, 2011
The NPRM assumed that all IT systems would be functional by May 11,
2008. DHS now recognizes that this assumption was overly optimistic.
Therefore, DHS has extended the deadline for compliance with the rule
until May 11, 2011 to give the States, Federal agencies, and non-
governmental organizations like AAMVA the time to complete the
communications and IT infrastructure needed to implement REAL ID.
Therefore, DHS has recalculated the costs assuming that all required
verification data systems be operational and fully populated by May 11,
2011, the deadline for full compliance by States. DHS is working to
bring these systems on-line and up to standards as soon as possible and
will work with the States to develop alternative procedures.
(5) That State Impact Is Not Uniform Due to Progress Already Made in
Some States
States that have already invested in improving the security of
their licenses will have to invest far less per capita than States with
less secure licenses and issuance processes. Those States that are more
advanced will incur lower compliance costs than other States.
(6) The Typical Validity Period of Driver's Licenses in a Given State
is the Validity Period for All DL/IDs in That State
DHS is aware that within a State DL/IDs often have varying validity
periods but was unable to determine how many people held each of these
varying types of credentials and when they were issued. (For more
details, see the discussion of Validity Periods in the Status Quo
section.) Also, the final regulation creates a one-year license for
certain aliens. DHS was able to determine that some people already hold
such licenses, but not how many people hold them. DHS was also unable
to determine how many people will hold them under the REAL ID rule.
While this methodology has limitations, using the typical validity
period of DL/IDs was the most reliable method available to estimate
future issuances.
(7) Those Drivers Who Would Be Required To Comply Later in the Issuance
Cycle Will Take Advantage of This Delayed Compliance
DHS has computed the costs for the over age 50 drivers by moving
that segment of renewals towards the 2017 deadline. DHS assumes the
distribution over time for renewals is similar to the rest of the
population. Therefore these license renewals are not bunched up but
entered as the same distribution as other drivers but with the last of
the pool completing in 2017.
(8) The Cost of Lost/Stolen DLs/IDs and Central Issuance Is Included in
the Cost of This Final Rule
The regulatory evaluation for the proposed rule assigned the cost
of having to replace a lost or stolen legacy ID with a REAL ID as being
a regulatory compliance cost. This means that if an individual loses
his/her legacy license, the burden of replacing it with a REAL ID
requiring an in-person visit was attributed to this rulemaking. The
regulatory evaluation for the final rule employs the assumption that
individuals who replace their lost or stolen legacy license will choose
to obtain a REAL ID and pay the additional opportunity costs of an in-
person visit to the DMV with the required source documents. After
careful consideration, we believe that this assumption may be
conservative based upon the revised requirements of the final rule. The
enrollment periods of REAL ID have been designed to enable DMVs to
enroll individuals with REAL IDs on their normal renewal cycles to the
maximum extent possible. Individuals simply replacing a lost or stolen
license are likely to want a replacement license as quickly as possible
and delay the process of obtaining a REAL ID until their scheduled
renewals. However, we maintain the original assumption in this economic
analysis because we cannot estimate the different rate at which lost or
stolen licenses will be replaced with REAL IDs. Therefore, we assume
the rate to be 75% or the same as that for renewals.
The regulatory evaluation still assumes that States will move to
central issuance because of the high cost of printing equipment for
REAL ID cards. However, the final rule provides added flexibility and
therefore States may not have to do this. We are not adjusting this
regulatory evaluation to account for this due to uncertainties in
States' behavior under the revised provisions of this final rule, and
because there are remaining requirements in this final rule that may
still make central issuance the most efficient response.
(9) The Cost of Security Markings on REAL ID Cards
Based on discussions with State driver's license card vendors, we
have estimated the cost for a security marking for compliant cards to
be $0.25 per card, and have included this cost estimate in the card
production analysis later in this document.
The final rule also requires that if a State issues a license that
is not in compliance with REAL ID, the State must by statute and
regulation indicate on the document that it is not valid for official
Federal purposes. According to U.S. license vendors contacted by DHS,
\6\ there is typically an upfront one time set up fee for the State,
which may include license redesign, system reconfiguration, and other
related costs. Based on our analysis of information received from
vendors and States, DHS estimates that the added cost would be about
$10,000 per State, or $.01 per document. The actual cost will vary
depending on the State, vendor and any existing contractual agreement
they may have concerning design changes. DHS believes that the added
cost of no more than $0.01 per document will be indirectly incurred by
those individuals who will be acquiring REAL IDs.
---------------------------------------------------------------------------
\6\ Based upon conversations between the REAL ID program office
and U.S. license vendors, December, 2007.
---------------------------------------------------------------------------
Summary of Major Differences Between the Final Rule and NPRM
Based upon the many comments received, the Final Rule incorporates
major changes from the NPRM. The major changes impacting the economic
analysis include:
(1) Extension of Deadlines
In the NPRM, DHS proposed that States that would not be able to
comply by May 11, 2008, should request an extension of the compliance
date no later than February 10, 2008, and encouraged States to submit
requests for extension as early as October 1, 2007. During the public
comment period, DHS
[[Page 5324]]
received numerous comments from States and Territories, State
associations, and others, noting that almost all States would be unable
to meet the May 2008 compliance deadline. Accordingly, to allow more
time for States to implement the provisions of the rule in general and
verification systems in particular, DHS is also providing in the final
rule the opportunity for States to request extensions of the compliance
date beyond the initial extension of December 31, 2009. To obtain a
second extension, States must file a Material Compliance Checklist by
October 11, 2009. This checklist will document State progress in
meeting certain benchmarks toward full compliance with the requirements
of this rule. States meeting the benchmarks shall be granted a second
extension until no later than May 10, 2011. This would give States
making significant progress additional time to meet all of the
requirements of this rule.
(2) Extended Enrollment Periods and Risk-Based Enrollment
The NPRM proposed that States determined by DHS to be in full
compliance with the REAL ID Act and these implementing regulations by
May 11, 2008, would have a five-year phase-in period--until May 11,
2013--to replace all licenses intended for use for official purposes
with REAL ID cards.
During the public comment period, a number of States and State
associations commented that States obtaining an initial extension of
the compliance date until December 31, 2009, would still be required to
enroll their existing driver population (estimated to be approximately
240 million) by May 11, 2013--essentially halving the phase-in period.
Several commenters suggested that DHS employ a risk-based approach that
would permit States and DMVs to focus first on perceived higher-risk
individuals while deferring lower-risk individuals to a date beyond May
11, 2013.
DHS agrees with both these comments. Accordingly, in this final
rule, DHS is extending the deadline for enforcing the provisions of the
Act for all driver's licenses and identification cards until no later
than December 1, 2017, but requiring REAL ID-compliant driver's
licenses and identification cards for individuals 50 years of age or
under (that is, individuals born on or after December 1, 1964) when
used for official purposes beginning on December 1, 2014. This will
effectively give States an eight-year enrollment period beginning in
January 1, 2010 when Materially Compliant States can begin the
enrollment process, thus avoiding an unnecessary operational burden on
State DMVs from a crush of applicants on or before the original May 11,
2013 compliance date.
(3) Physical Card Security
DHS has modified the proposed card security requirements in
response to comments which stated that the requirements were too
prescriptive and placed an undue burden on the States. Instead, DHS has
proposed a performance-based approach that provides the flexibility for
States to implement solutions using a well-designed balanced set of
security features for cards that, when effectively combined, provide
maximum resistance to counterfeiting, alteration, substitution, and the
creation of fraudulent documents from legitimate documents.
(4) Marking of Compliant REAL ID Documents
Based on an analysis of feedback from several commenters, DHS has
determined that it would be in the best interest of the nation's
security for States to place a security marking on driver's licenses
and identification cards that are issued in compliance with the REAL ID
Act. Such a marking would facilitate the verification of the
authenticity of such documents by Federal agencies requiring
identification for official purposes.
(5) Certification and Security Plan Documentation
Based on feedback from commenters, DHS has eased the reporting and
documentation requirements placed upon States by circumscribing the
scope of security plans and requiring submission of updated plans and
certification packages on a rolling, triennial basis.
(6) Address Change and Documentation Requirements
Based on numerous responses, DHS has removed the requirement that
an address change must be accomplished through an in-person visit to
the DMV. Additionally, there is no requirement in the final rule for
States to issue a new card when notified of an address change.
Moreover, DHS now allows States fuller discretion over the acceptance
of address documents by removing specific requirements that documents
used to demonstrate address of principal residence be issued
``monthly'' and ``annually.''
(7) Financial Check
DHS agreed with comments that the financial history check would not
be determinative. Therefore, DHS has eliminated the requirement for a
financial history check from the final rule.
Costs and Benefits
This Regulatory Evaluation attempts to quantify or monetize the
economic benefits of REAL ID. In spite of the difficulty, most everyone
understands the benefits of secure and trusted identification. The
final minimum standards seek to improve the security and
trustworthiness of a key enabler of public and commercial life--State-
issued driver's licenses and identification cards. As detailed below,
these standards will impose additional burdens on individuals, States,
and even the Federal government. These costs, however, have been
weighed against the quantifiable and nonquantifiable but no less real
benefits to both public and commercial activities achieved by secure
and trustworthy identification.
Economic Costs
Implementing the REAL ID Act will impact all 56 jurisdictions, more
than 240 million applicants for and holders of State DL/IDs, private
sector organizations, and Federal government agencies.
Figure 1: summarizes the estimated marginal economic costs of the
final rule over an eleven year period.
Figure 1: Estimated marginal economic cost of REAL ID final rule.
----------------------------------------------------------------------------------------------------------------
$ million $ million $ million (2006 Percent total
---------------------------------- dollars) ----------------
Estimated costs (11 years) -----------------
7% discounted 3% discounted Undiscounted Undiscounted
----------------------------------------------------------------------------------------------------------------
Costs to States............................. 2,879 3,413 3,965 39.9
Customer Services....................... 636 804 970 9.8
Card production......................... 690 822 953 9.6
Data Systems & IT....................... 1,171 1,352 1,529 15.4
[[Page 5325]]
Security & Information Awareness........ 365 415 490 4.9
Data Verification....................... 5 7 8 0.1
Certification process................... 11 13 16 0.2
Costs to Individuals........................ 3,808 4,814 5,792 58.3
Opportunity Costs........................... 3,429 4,327 5,215 52.5
Application Preparation (125.8 million 2,186 2,759 3,327 33.5
hours).................................
Obtain Birth Certificate (20.1 million 348 440 530 5.3
hours).................................
Obtain Social Security Card (1.6 million 31 37 44 0.4
hours).................................
DMV visits (49.8 million hours)......... 864 1,091 1,315 13.2
Expenditures: Obtain Birth Certificate...... 379 479 577 5.8
Cost to Private Sector...................... 8 9 9 0.1
Costs to Federal Government................. 128 150 171 1.7
Social Security card issuance........... 36 43 50 0.5
Data Verification--SAVE................. 9 11 14 0.1
Data Systems & IT....................... 65 74 82 0.8
Certification & training................ 17 21 25 0.3
-------------------------------------------------------------------
Total Costs......................... 6,853 8,406 9,939 100.0
----------------------------------------------------------------------------------------------------------------
Figure 1 shows the primary estimates calculated in both
undiscounted 2006 dollars and discounted dollars at both the 3% and the
7% discounted rates. The total, undiscounted eleven-year cost of the
final rule is $9.9 billion. Based on a total of 477.1 million issuances
over the 11-years of the analysis, the average marginal cost per
issuance for States is $8.30. Individuals will incur the largest share
of the costs as shown in Figure ES-2. More than 58 percent of the costs
(discounted or undiscounted) are associated with preparing
applications, obtaining necessary documents, or visiting motor vehicle
offices.
The costs shown in Figure ES-2 show a substantial decrease in those
reported in the NPRM. In particular, the costs for States are 27% of
those estimated for the NPRM. This substantial decrease in costs can be
attributed to a number of factors, including a revised assumption that
only 75% of DL/ID holders will apply for a REAL ID as well as a less
prescriptive, performance-based, and balanced approach to REAL ID
implementation. As many commenters suggested, providing additional time
for implementation and enrollment of DL/ID holders will allow States to
accommodate the enrollment process without disrupting their normal
renewal cycles, resulting in a decrease in total REAL ID issuances from
813 million to 477 million issuances. In addition, the undiscounted
estimates for card production costs have decreased substantially from
$5.8 billion in the NPRM to $953 million in the final rule based on the
performance-based approach to card security standards recommended by
numerous commenters.
DHS recognizes that many States have made significant progress in
improving the integrity of their licenses. DHS also recognizes that the
prescriptive technology standards included in the NPRM, compared to the
final rule, provided relatively few additional security benefits at
great cost to States. Moreover, the estimated opportunity costs to
individuals have been reduced from $7.1 to $5.8 billion in undiscounted
dollars primarily as a result of the changed assumption that only 75%
of DL/ID holders will seek REAL IDs. Individuals will still have to
obtain source documents and visit their DMVs under this analysis.
Finally, the undiscounted costs to States for data systems and IT have
actually increased from $1.4 billion in the NPRM to $1.5 billion in the
final rule. This slight increase reflects the critical role of
information technology and verification systems in reducing identity
theft and identity fraud in the issuance of DL/IDs.
The four largest cost areas, in descending order (in undiscounted
dollars) are:
Opportunity costs to individuals ($5.2 billion),
Maintaining the necessary data and interconnectivity
systems ($1.5 billion),
Customer service ($970 million), and
Card production and issuance ($953 million)
The largest impact category is the cost to individuals of obtaining
source documents, preparing applications, and visiting DMVs. The
magnitude of this category is driven largely by the fact that all
applicants for a REAL ID will need to complete an application process
similar to those of a first-time driver or a driver moving from one
State to another.
The second largest impact category is the creation and maintenance
of necessary data and interconnectivity systems. These systems will
require substantial up-front effort to create but are likely to require
smaller marginal increases in maintenance costs.
The third largest impact is customer service. While the extension
of the enrollment period in the final rule will minimize marginal
increases in the number or flow of transactions, the rule accounts for
costs that increased transaction and wait times will produce. REAL ID
should not substantially accelerate the rate of transactions, but the
per transaction costs to States will increase.
The fourth largest impact is the production and issuance of the
REAL IDs themselves. The final minimum standards are intended to make
counterfeit production, tampering and other fraud more difficult. While
some State cards may already meet the standards of the final rule, many
States may have to upgrade their cards and production processes in
response to the rule. These upgrades will also require a substantial
up-front effort followed by smaller marginal costs for subsequent
years.
Estimated Benefits
The final REAL ID regulation will strengthen the security of
personal identification. Though difficult to quantify, nearly all
people understand the benefits of secure and trusted identification and
the economic, social, and personal costs of stolen or fictitious
identities. The REAL ID final rule seeks to improve the security and
trustworthiness of a key enabler of public and commercial life--State-
[[Page 5326]]
issued driver's licenses and identification cards.
The primary benefit of REAL ID is to improve the security and
lessen the vulnerability of federal buildings, nuclear facilities, and
aircraft to terrorist attack. The rule gives States, local governments,
or private sector entities an option to choose to require the use of
REAL IDs for activities beyond the official purposes defined in this
regulation. To the extent that States, local governments, and private
sector entities make this choice, the rule may facilitate processes
which depend on licenses and cards for identification and may benefit
from the enhanced security procedures and characteristics put in place
as a result of this final rule.
DHS provides a ``break-even'' analysis based on the rule having an
impact on the annual probability of the United States experiencing a 9/
11 type attack in the 11 years following the issuance of the rule. It
is exceedingly difficult to predict the probability and consequences of
a hypothetical terrorist attack. DHS believes that those factors cannot
be determined for purposes of this benefit analysis. However, for the
purposes of this analysis, it is not necessary to assume that there is
a probability of being attacked in any particular year.
By making some generalized but conservative assumptions about the
costs of attack consequences, DHS determined the reduction in
probability of attack that REAL ID will need to bring about so that the
expected cost of REAL ID equals its anticipated security benefits. DHS
posed the following question: what impact would this rule have to have
on the annual probability of experiencing a 9/11 type attack in order
for the rule to have positive quantified net benefits? This analysis
does not assume that the United States will necessarily experience this
type of attack, but rather is attempting to provide the best available
information to the public on the impacts of the rule.
DHS also developed an analysis based on the discounted cost of a
single terrorist attack comparable to the 9/11 attacks on New York City
and Washington, DC taking place sometime over an eleven-year span. The
agency determined at what point the final rule would be cost-beneficial
given the likelihood of an attack and the effectiveness of preventing
the attack.
The final rule on REAL ID is likely to produce potential ancillary
benefits as well. It will be more difficult to fraudulently obtain a
legitimate license and more costly to create a false license, which
could reduce identity theft, unqualified driving, and fraudulent
activities facilitated by less secure driver's licenses such as
fraudulent access to government subsidies and welfare programs, illegal
immigration, unlawful employment, unlawful access to firearms, voter
fraud and possibly underage drinking and smoking. DHS assumes that REAL
ID will bring about changes on the margin that will potentially
increase security and reduce illegal behavior. Because the size of the
economic costs that REAL ID serves to reduce on the margin are so
large, however, a relatively small impact of REAL ID may lead to
significant benefits.
Regulatory Flexibility Act Assessment
The Regulatory Flexibility Act of 1980 \7\ (RFA), as amended, was
enacted by Congress to ensure that small entities (small businesses,
small not-for-profit organizations, and small governmental
jurisdictions) are not unnecessarily or disproportionately burdened by
Federal regulations. The RFA requires agencies to review rules to
determine if they have ``a significant economic impact on a substantial
number of small entities.'' The following analysis suggests that the
rule will not have a significant economic impact on a substantial
number of small entities.
---------------------------------------------------------------------------
\7\ Regulatory Flexibility Act, Pub. L. 96-354, 94 Stat. 1164
(codified at 5 U.S.C. Sec. 601).
---------------------------------------------------------------------------
The Department is implementing the regulations in order to enact
the requirements outlined in the REAL ID Act.\8\ This rule establishes
minimum standards for the issuance of State-issued driver's licenses
and non-driver identification cards (DL/IDs). These minimum standards
will:
---------------------------------------------------------------------------
\8\ REAL ID Act of 2005. Pub. L. 13, 109th Cong., 1st Sess. (May
11, 2005), 201, 202.
---------------------------------------------------------------------------
Enhance the security features of DL/IDs, rendering them
more difficult to counterfeit, tamper with, or cannibalize;
Ensure that holders of unexpired REAL IDs are lawfully
present in the United States;
Enhance physical security of materials and production
locations to reduce the likelihood of theft of materials and
infiltration of DMVs by nefarious individuals;
Enhance identity source document requirements and
verifications to reduce the number of DL/IDs issued by DMVs to persons
committing identity fraud; and,
Ensure that a REAL ID driver's license holder is licensed
in only one State.
In short, these standards are designed to ensure that holders of
unexpired REAL IDs are who they say they are and that they are lawfully
present in the United States.
DHS did not receive any public comments on the Initial Regulatory
Flexibility Analysis that was issued in support of the NPRM during the
public comment period. All public comments are available for the public
to view at the Federal Docket Management System: http://www.regulations.gov.
As part of this rulemaking effort, DHS has summarized and responded
to all public comments relating to the Regulatory Evaluation issued
with the NPRM. Comment summaries and responses are located in the
preamble to the final rule, which is also available at http://www.regulations.gov and in the Federal Register.
The rule directly regulates States, which by definition are not
small entities. The rule indirectly regulates entities that accept
State-issued DL/IDs for official purposes. The rule defines those
purposes as accessing Federal facilities, entering nuclear power plants
and boarding federally regulated commercial aircraft. The entities that
accept DL/IDs for those purposes include the Federal Government,
operators of nuclear power plants and entities examining personal
identity documents of people boarding federally regulated commercial
aircraft. The rule does not require action from any of these three
entities. However, these entities are likely to engage in some activity
to ensure that they comply with the Act. The remainder of this section
estimates the number of small entities that are affected in this
indirect way.
The Federal Government is not a small entity. Therefore, no small
entities are affected by the prohibition on accepting State-issued DL/
IDs that are not REAL IDs to access Federal facilities.
[[Page 5327]]
Nuclear power plants, though not directly regulated, may experience
indirect impacts from this regulation. A nuclear power plant qualifies
as a small entity if ``including its affiliates, it is primarily
engaged in the generation, transmission, and/or distribution of
electric energy for sale and its total electric output for the
preceding fiscal year did not exceed 4 million megawatt hours.'' \9\
With only three exceptions, every nuclear power plant in the United
States produced more than 4 million megawatt hours in fiscal year
2005.\10\ However, companies producing more than 12 million megawatt
hours own each of those three plants.\11\ None of the nuclear power
plants qualifies as small businesses using the SBA definition.
Therefore, no small entities are affected by the prohibition on
accepting State-issued DL/IDs that are not REAL IDs to enter nuclear
power plants.
---------------------------------------------------------------------------
\9\ Small Business Administration. Small Business Size Standards
Matched to North American Industrial Classification System. Footnote
1. Available at http://www.sba.gov/size/sizetable2002.html#fn1. Accessed July 14, 2006.
\10\ Calculations based on data from the Energy Information
Administration. U.S. Department of Energy. Monthly Nuclear Utility
Generation by State and Reactor, 2004 and Monthly Nuclear Utility
Generation by State and Reactor, 2005. Available at http://www.eia.doe.gov/cneaf/nuclear/page/nuc_generation/gensum.html.
Accessed July 14, 2006.
\11\ Conclusion based on an Internet search conducted on July
14, 2006 of the three specific power plants and the companies that
own and operate them.
---------------------------------------------------------------------------
Entities examining identity documents of people who are boarding
federally regulated commercial aircraft will not be directly regulated
by the rulemaking. However, they may experience indirect effects.
Different types of entities examine personal identity documents of
people boarding federally regulated commercial aircraft. Currently,
this responsibility falls on the entity with whom passengers check
their luggage, the entity examining boarding passes and IDs immediately
in front of TSA screening checkpoints, and, when completed to fulfill
federal requirements, the entities examining IDs directly before
allowing passengers to board aircraft. The easiest group of entities to
identify in this category is the airlines that enplane from and/or
deplane into the sterile area of an airport.\12\ The Small Business
Administration considers companies operating either scheduled or non-
scheduled chartered passenger air transportation to be small entities
if they have fewer than 1,500 employees.\13\ Using these criteria, DHS
has identified 24 specific small entities that offer scheduled or non-
scheduled air passenger transportation and that enplane from or deplane
into an airport sterile area. Other federally regulated commercial
aircraft include charter flights, air taxis, scenic air tours and other
similar operations where the transportation of passengers for
compensation comprises the majority of their revenues. Many of these
entities would qualify as small entities under the SBA definition. SBA
data show that, overall, 2,719 of the 2,877 firms engaged in air
transportation (NAICS 481) had fewer than 500 employees in 2004.\14\
Nearly all firms in the air transportation industry fall well below the
1,500-employee size standard to qualify as a small entity. (Note that
the federal requirements may not require all of these firms to examine
passenger identity documents prior to boarding.)
---------------------------------------------------------------------------
\12\ ``Sterile area'' is defined in 49 CFR 1540.5 and generally
means an area with access limited to persons who have undergone
security screening by TSA. Therefore, only TSA-regulated airports
have sterile areas.
\13\ U.S. Small Business Administration. Small Business Size
Standards Matched to North American Industrial Classification
System. NAICS 481111 and 481211. Available at http://www.sba.gov/size/sizetable2002.html. Accessed July 14, 2006.
\14\ U.S. Small Business Administration. U.S. Data Classified by
Employment Size of Firm: All industries, 2003-2004. Available at
http://www.sba.gov/advo/research/data.html. Accessed 4 Oct 2006.
---------------------------------------------------------------------------
DHS estimates that each employee accepting DL/IDs for official
purposes will require two hours of training. This training will assist
personnel in identifying the differences between REAL IDs and other
State-issued DL/IDs. The training will also inform personnel about
which States are or are not compliant during the enrollment period. In
order to assess the cost of this training, DHS calculated the fully
loaded wage rate of $22.95 per hour for airline ticket counter agents
and $22.50 per hour for airport checkpoint staff. Multiplying the wage
rates by the estimated two hours to complete the training yields
estimates of $45.90 and $45.01 per-employee for ticket counter agents
and checkpoint staff, respectively. The next step to determine if
firms' action will have a significant impact is to divide the summed
products of wage rates and trained employees by firm revenue. Doing so
yields the impact on the firm as a percent of their total receipts.
However, data on how many employees firms will train do not exist on an
industry level, much less at the firm level throughout the industry.
Alternatively, a threshold analysis can determine at what point the
revenue to trained employee ratio would constitute a one or three
percent impact for a firm.
The Department has determined threshold levels that will cause an
indirect impact equal to or less than one percent and equal to or
greater than three percent of an entity's total revenue. If a firm's
ratio is higher than the one percent threshold, the economic impact for
that firm is not significant. If the ratio is lower than the three
percent threshold, the economic impact will be larger than three
percent of the firm's revenue. The threshold values are measured as the
ratio of total revenue to the number of employees to be trained
regarding REAL ID. If the amount of a firm's revenue per trained
counter agent is more than $4,590, then the effect is less than one
percent of total revenue. If one percent requires revenue per agent of
$4,590, then the three percent threshold revenue per agent lies at
$1,530. If a firm's revenue per counter agent is less than $1,530, then
the effect will be greater than three percent. The same approach can be
applied to airport checkpoint staff yielding $4,501 at one percent and
$1,500 at three percent. (See Figure 2)
[[Page 5328]]
[GRAPHIC] [TIFF OMITTED] TR29JA08.001
Applying the one percent threshold--the most stringent--to the 24
scheduled service firms specifically identified as small entities
suggests that training employees regarding REAL ID will not impose a
significant economic impact on a substantial number of small entities.
Dividing a firm's total 2005 revenue by $4,590 yields an estimate of
how many employees would need to be trained before the indirect impact
reaches the one percent of total revenue threshold. Comparing that
estimate to the number of employees at each firm in 2005 reveals that
companies would need to train anywhere from 6 to 56 times their total
number of employees, including those who will not examine
identification documents.\15\
The aggregated nature of industry-wide data does not allow for a
firm-by firm analysis of the more than 2,719 small firms involved in
air transportation. However, analysis of firms grouped by receipts in
2002 provides insight into the likelihood that entities will experience
a significant indirect impact. Dividing receipts by the one percent
threshold of $4,590 for each group estimates the number of employees
that would result in a one percent impact on each group. The ratio of
actual reported employees to threshold employees reveals that every
group for which data is available would need to train multiple times
more employees regarding REAL ID than they actually employ. The
smallest ratio (largest impact) is for scheduled passenger air
transportation (NAICS 48111) that earned less than $100,000, implying
that they would need to train more than 11 times the number of people
than they employed before the impact would reach one percent of their
receipts.\16\ The largest ratio (smallest impact in terms of percent of
revenues) would fall on nonscheduled chartered passenger firms (NAICS
481211) earning more than $100 million. These firms would need to train
more than 85 times the size of their workforce to reach the one percent
impact threshold.
The combination of the firm specific analysis and the analysis of
aggregated firms within receipt categories suggests that the indirect
impact of training agents regarding REAL ID for the official purpose of
boarding federally regulated commercial aircraft will not constitute a
significant economic impact on a substantial number of small entities.
---------------------------------------------------------------------------
\15\ Data from BTS (Form 41, Schedule P10); Duns and Bradstreet;
Yahoo! Finance, and; Hoovers.com.
\16\ Data from U.S. Small Business Administration. U.S. All
Industries by Receipt Size: 2002. Available online at http://www.sba.gov/advo/research/data.html. Accessed 4 Oct 2006.
---------------------------------------------------------------------------
The above analyses show that it is unlikely that the prohibition on
accepting State-issued DL/IDs unless they are REAL IDs will have a
significant economic impact on a substantial number of small entities.
Further, the only directly regulated entities are States, which by
definition are not small entities. Therefore, the Department concludes
that this rule will not have a significant economic impact on a
substantial number of small entities.
International Trade Impact Assessment
The Trade Agreement Act of 1979 prohibits Federal agencies from
engaging in any standards or related activities that create unnecessary
obstacles to the foreign commerce of the United States. Legitimate
domestic objectives, such as safety, are not considered unnecessary
obstacles. The statute also requires consideration of international
standards and, where appropriate, that they be the basis for U.S.
standards. There is no international standard for State-issued driver
licenses or non-driver identification cards. DHS has determined that
this rule will not have an impact on trade.
Unfunded Mandates Assessment
Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA)
requires Federal agencies to prepare a written assessment of the costs,
benefits, and other effects of proposed or final rules that include a
Federal mandate likely to result in the expenditure by State, local, or
tribal governments, in the aggregate, or by the private sector, of more
than $100 million in any one year (adjusted for inflation with base
year of 1995). Before promulgating a rule for which a written statement
is needed, section 205 of the UMRA generally requires agencies to
identify and consider a reasonable number of regulatory alternatives
and adopt the least costly, most cost-effective, or least burdensome
alternative that achieves the objective of the rule. Agencies are also
required to seek input from the States in the preparation of such
rules.
The provisions of section 205 do not apply when they are
inconsistent with applicable law. Moreover, section 205 allows DHS to
adopt an alternative other than the least costly, most cost-effective,
or least burdensome alternative if the agency publishes with the final
rule an explanation why that alternative was not adopted.
As set forth in section 202(a)(1) of the REAL ID Act, the law is
binding on Federal agencies--not on the States.
[[Page 5329]]
Indeed, in the Conference Report, Congress specifically stated that the
``application of the law is indirect, and hence States need not comply
with the listed standards.'' Conf. Rep. at 177.
Moreover, as indicated above, UMRA excludes from its scope,
regulations which are required for national security reasons. National
security was a primary motivator for the REAL ID Act; indeed, the Act
itself is an effort to implement recommendations of the 9/11
Commission, and Congress took pains to explain the connection between
REAL ID and national security, with over a dozen references to
``terrorists'' or ``terrorism'' in the Conference Report. See 9/11
Commission Public Report, Chapter 12.4; Conf. Rep., 179--183.
Notwithstanding the voluntary nature of the REAL ID Act, DHS
assumes that States will willingly comply with the regulation to
maintain the conveniences enjoyed by their residents when using their
State-issued driver's licenses and non-driver identity cards for
official purposes, particularly as it pertains to domestic air travel.
While, for the reasons set forth above, DHS believes that the REAL ID
Act does not constitute an unfunded mandate, DHS nevertheless believes
that many States may find noncompliance an unattractive option.
Based on that knowledge, DHS has taken steps to comply with the
requirements of UMRA. Specifically, DHS has analyzed the estimated cost
to States and considered appropriate alternatives to, and benefits
derived from, the final regulation. Moreover, DHS has solicited input
from State and local governments in the preparation of this final rule.
C. Executive Order 13132, Federalism
Executive Order 13132 requires each Federal agency to develop a
process to ensure ``meaningful and timely input by State and local
officials in the development of regulatory policies that have
Federalism implications.'' The phrase ``policies that have Federalism
implications'' is defined in the Executive Order to include regulations
that have ``substantial direct effects on the States, on the
relationship between the national government and the States, or on the
distribution of power and responsibilities among the various levels of
government.''
Executive Order 13132 lists as a ``Fundamental Federalism
Principle'' that ``[f]ederalism is rooted in the belief that issues
that are not national in scope or significance are most appropriately
addressed by the level of government closest to the people.'' The issue
covered by this final rule is, without question, national in scope and
significance. It is also one in which the States have significant
equities.
While driver's licenses and identification cards are issued by
States, they are also the most widely-used identification documents.
Not surprisingly, they are very frequently used by individuals to
establish their identities in the course of their interactions with the
Federal Government (e.g., when entering secure Federal facilities or
passing through Federally-regulated security procedures at U.S.
airports). The fact that the use of driver's licenses as identity
documents is an issue that is ``national in scope'' is illustrated by
the events of September 11, 2001. A number of the terrorists who
hijacked U.S. aircraft on that day had, through unlawful means,
obtained genuine driver's licenses; these documents were used to
facilitate the terrorists' operations against the United States.\17\
---------------------------------------------------------------------------
\17\ See 9/11 Commission Report, Chapter 12.4.
---------------------------------------------------------------------------
1. DHS has Considered the Federalism Implications of the REAL ID Rule
Section 3 of the Executive Order sets forth certain ``Federalism
Policymaking Criteria.'' In formulating or implementing policies with
``Federalism implications,'' agencies are required, to the extent
permitted by law, to adhere to certain criteria. DHS has considered
this action in light of the criteria set forth in Executive Order 13132
Sec. 3(a)-(d) and submits the following:
(a) Constitutional Principles and Maximizing the Policymaking
Discretion of the States
The rule is being promulgated in strict adherence to constitutional
principles, and the limits of DHS's constitutional and statutory
authority have been carefully considered. Congress, through the REAL ID
Act, has mandated that Federal agencies refuse to accept for official
purpose, State-issued driver's licenses or identification cards unless
DHS has determined that the issuing State is in compliance with the
statutorily-mandated minimum standards for such identification
documents. Notwithstanding the clear statutory mandate directing this
rulemaking action, DHS has taken steps, in consultation with the
States, to maximize policymaking discretion at the State level wherever
possible. For example, States may establish an exceptions process that
would allow each State participating in REAL ID to exercise maximum
discretion in responding to exigencies arising in the course of
verifying an individual's identity.
DHS also recognizes that each State's unique situation mandates
that the maximum possible latitude be allowed to States in fulfilling
the statutory mandate that certain employees undergo background
investigations. The final rule provides parameters for use by the
States in determining which employees are ``covered employees'' and
thus subject to the statutory background check requirements, but allows
the individual States to determine which employees fall into categories
deemed to be covered as defined under this final rule (e.g. DMV
``employees or contractors who are involved in the manufacture or
production of REAL ID driver's licenses and identification cards, or
who have the ability to affect the identity information that appears on
the driver's license or identification card.'').
States are also given the discretion to find the best way to
determine an individual driver's license or identification card
applicant's address of principal residence, and provides greater
latitude in accepting alternatives or making exceptions based on State
practices.
In other aspects of the regulation DHS has prescribed baseline
requirements while allowing States the discretion to impose more
stringent standards, the greatest example of which is in the area of
protecting personally identifiable information collected for REAL ID
purposes. Most significantly, each State retains the discretion to opt
out of REAL ID in its entirety.
(b) Action Limiting the Policymaking Discretion of the States
As indicated above, the final rule strives to maximize State
policymaking discretion on two levels: First, because a State's
participation in REAL ID is optional; and second, because of the
policymaking discretion incorporated into the regulation for States
that do choose to participate. DHS believes that it has incorporated
the maximum possible State discretion consistent with the purposes of
the statute into this action.
(c) Avoiding Intrusive Federal Oversight
Consistent with Congress' vision for REAL ID (see Sec. 202(a)(2)
of the Act), States that choose to participate in the program will be
responsible for monitoring their own compliance. Under the Act and the
final regulations, the Secretary of Homeland Security will determine
whether a State is meeting the requirements of the Act based on
certifications made by the State and
[[Page 5330]]
DHS has adopted a certification process similar to that used by DOT in
its regulations governing State administration of commercial driver's
licenses. States receiving adverse determinations will have the
opportunity for an internal appeals process as well as judicial review.
(d) Formulation of Policies With Federalism Implications
DHS recognizes both the important national interest in secure
identity documents and the Federalism implications of the policies
which underpin this rule. Accordingly, DHS has welcomed and encouraged
State participation in this process and has sought, where possible, to
draft this regulation in such a way as to maximize State discretion.
Where the exigencies of national security and the need to prevent
identity fraud have militated in favor of a uniform national standard
(e.g., baseline security features on identity cards and background
check requirements), DHS has, as reflected above, consulted with States
in order to ensure that the uniform standards prescribed could be
attained by the States and would reflect the accumulated security
experience of State motor vehicles administrations.
2. The REAL ID Final Rule Complies With the Regulatory Provisions of
Executive Order 13132
Under Sec. 6 of Executive Order 13132, an agency may not issue a
regulation that has Federalism implications, that imposes substantial
direct compliance costs, and that is not required by statute, unless
the Federal Government provides the funds necessary to pay the direct
compliance costs incurred by State and local governments, or consults
with State and local officials early in the process of developing the
proposed regulation. Moreover, an agency may not issue a regulation
that has Federalism implications and that preempts State law, unless
the Agency consults with State and local officials early in the process
of developing the regulation.
(a) The Final Rule Does Not Preempt State Law
As detailed elsewhere in this document, the REAL ID Act is binding
on Federal agencies, rather than on States. The rule would not formally
compel any State to issue driver's licenses or identification cards
that will be acceptable for Federal purposes. Importantly, under this
scheme, ``[a]ny burden caused by a State's refusal to regulate will
fall on those [citizens who need to acquire and utilize alternative
documents for Federal purposes], rather than on the State as a
sovereign.'' \18\ In other words, the citizens of a given State--not
Congress--ultimately will decide whether the State complies with this
regulation and the underlying statute. DHS has concluded that the rule
is consistent with the Tenth Amendment to the U.S. Constitution and
does not constitute an impermissible usurpation of State sovereignty.
Rather, it is a permissible ``program of cooperative Federalism'' in
which the Federal and State governments have acted voluntarily in
tandem to achieve a common policy objective.\19\
---------------------------------------------------------------------------
\18\ New York v. U.S., 505 U.S. 144, 173 (1992).
\19\ See id. at 167.
---------------------------------------------------------------------------
(b) DHS Has Engaged in Extensive Consultations With the States
The statutory mandate and the lack of preemption both satisfy the
requirements of Executive Order 13132. Nevertheless, in the spirit of
Federalism, and consistent with Sec. 205(a) of the REAL ID Act, DHS
has engaged in extensive consultations with the States prior to issuing
this final rule. As set forth earlier in this preamble of this rule,
DHS held meetings and solicited input from various States and such
stakeholders as the National Governors Association and the National
Conference of State Legislatures.
In particular, during the comment period, DHS hosted sessions that
were available via webcast across the country to engage State
Governors' chiefs of staff, homeland security directors in the States,
and motor vehicles administrators, as well as a separate session with
State legislators. DHS also convened the various stakeholder
representatives that were identified as participants in the negotiated
rulemaking group established under section 7212 of the Intelligence
Reform and Terrorism Prevention Act. Further, DHS held a public meeting
in Sacramento, California that was available nationwide via webcast and
received comments from the public on a variety of topics, including
consumer and personal impacts, privacy/security, electronic
verification systems, funding/implementation, and law enforcement.
(c) DHS Recognizes the Burdens Inherent in Complying With the
Regulations
Notwithstanding both the statutory mandate and the Federal (rather
than State) focus of the REAL ID Act, DHS recognizes that, as a
practical matter, States may view noncompliance with the requirements
of REAL ID as an unattractive alternative. DHS also recognizes that
compliance with the rule carries with it significant costs and
logistical burdens, for which Federal funds are generally not
available. The costs (to the States, the public and the Federal
Government) of implementing this rule are by no means inconsiderable
and have been detailed in the regulatory evaluation accompanying this
rule.
As indicated above, Executive Order 13132 prohibits any agency from
implementing a regulation with Federalism implications which imposes
substantial direct compliance costs on State and local governments
unless the regulation is required by statute, the Federal Government
will provide funds to pay for the direct costs, or the agency has
consulted with State and local officials. In such a case, the agency
must also incorporate a Federalism statement into the preamble of the
regulation and make available to the Office of Management and Budget
any written communications from State and local officials. See
Executive Order 13132, section 6(b).
This rule is required by the REAL ID Act. DHS has (as detailed
above) consulted extensively with State and local officials in the
course of preparing this regulation. Finally, DHS has incorporated this
Federalism Statement into the preamble to assess the Federalism impact
of its REAL ID regulation.
3. REAL ID and Federalism
The issuance of driver's licenses has traditionally been the
province of State governments; DHS believes that, to the extent
practicable, it should continue as such. However, given the threat to
both national security and the economy presented by identity fraud, DHS
believes that certain uniform standards should be adopted for the most
basic identity document in use in this country. DHS has, in this final
rule, attempted to balance State prerogatives with the national
interests at stake.
D. Environmental Impact Analysis
At the time of the proposed rule, DHS sought and received comment
on the potential environmental impact of the physical standards and
other proposed requirements under this rule. DHS carefully considered
those comments in its evaluation of the potential environmental impacts
of the rule. DHS concludes that the rule's potential impacts are
minimal and this rule is a part of a category of actions that do not
individually or cumulatively have a significant impact on the human
environment and do not require a more
[[Page 5331]]
extensive evaluation under the requirements of the National
Environmental Policy Act of 1969 (NEPA), 42 U.S.C. 4321 et seq. and
Council on Environmental Quality (CEQ) regulations, 40 CFR parts 1501-
1508. DHS Categorical Exclusion A3 (Table 1 Management Directive
5100.1). Categorical Exclusion A3 applies to the promulgation of this
rule, since it is of an administrative and procedural nature that does
not force an immediate action but only lays the foundation for
subsequent action. The categorical exclusion applies only to the
promulgation of the REAL ID rule. Environmental impacts that may be
associated with any follow-on DHS activity, such as approval of grant
funding, must be reviewed if and when the subsequent program actions
create the potential for environmental impact.
E. Energy Impact Analysis
The energy impact of this rule has been assessed in accordance with
the Energy Policy and Conservation Act (EPCA), Public Law 94-163, as
amended (42 U.S.C. 6362). We have determined that this rulemaking is
not a major regulatory action under the provisions of the EPCA.
F. Executive Order 13175 (Tribal Consultation)
DHS has analyzed this final rule under Executive Order 13175
(entitled ``Consultation and Coordination with Indian Tribal
Governments'', issued November 6, 2000). Executive Order 13175 states
that no agency shall promulgate regulations that have tribal
implications, that impose substantial direct compliance costs on Indian
tribal governments, or that are not required by statute unless the
agency first consults with tribal officials and prepares a tribal
summary impact statement.
DHS has determined that this final rule will not have a substantial
direct effect on one or more Indian tribes and will not impose
substantial direct compliance costs on Indian tribal governments. This
rule also does not seek to preempt any tribal laws. This final rule
does not satisfy the tribal implications requirement in that it is a
rule of general applicability that establishes minimum standards for
State-issued driver's licenses and identification cards that Federal
agencies will accept for official purposes on or after May 11, 2008, a
statutory mandate under the REAL ID Act of 2005. Therefore, tribal
consultation and a tribal summary impact statement are not required.
List of Subjects in 6 CFR Part 37
Document security, driver's licenses, identification cards,
incorporation by reference, motor vehicle administrations, physical
security.
The Amendments
0
For the reasons set forth above, the Department of Homeland Security
amends 6 CFR Chapter I by adding a new Part 37 as follows:
TITLE 6--HOMELAND SECURITY
CHAPTER I--DEPARTMENT OF HOMELAND SECURITY, OFFICE OF THE SECRETARY
PART 37--REAL ID DRIVER'S LICENSES AND IDENTIFICATION CARDS
Subpart A--General
Sec.
37.1 Applicability.
37.3 Definitions.
37.5 Validity periods and deadlines for REAL ID driver's licenses
and identification cards.
Subpart B--Minimum Documentation, Verification, and Card Issuance
Requirements
37.11 Application and documents the applicant must provide.
37.13 Document verification requirements.
37.15 Physical security features for the driver's license or
identification card.
37.17 Requirements for the surface of the driver's license or
identification card.
37.19 Machine readable technology on the driver's license or
identification card.
37.21 Temporary or limited-term driver's licenses and identification
cards.
37.23 Reissued REAL ID driver's licenses and identification cards.
37.25 Renewal of REAL ID driver's licenses and identification cards.
37.27 Driver's licenses and identification cards issued during the
age-based enrollment period.
37.29 Prohibition against holding more than one REAL ID card or more
than one driver's license.
Subpart C--Other Requirements
37.31 Source document retention.
37.33 DMV databases.
Subpart D--Security at DMVs and Driver's License and Identification
Card Production Facilities
37.41 Security plan.
37.43 Physical security of DMV production facilities.
37.45 Background checks for covered employees.
Subpart E--Procedures for Determining State Compliance
37.51 Compliance--general requirements.
37.55 State certification documentation.
37.59 DHS reviews of State compliance.
37.61 Results of compliance determination.
37.63 Extension of deadline.
37.65 Effect of failure to comply with this Part.
Subpart F--Driver's Licenses and Identification Cards Issued Under
Section 202(d)(11) of the REAL ID Act
37.71 Driver's licenses and identification cards issued under
section 202(d)(11) of the REAL ID Act.
Authority: 49 U.S.C. 30301 note; 6 U.S.C. 111, 112.
PART 37--REAL ID DRIVER'S LICENSES AND IDENTIFICATION CARDS
Subpart A--General
Sec. 37.1 Applicability.
(a) Subparts A through E of this part apply to States and U.S.
territories that choose to issue driver's licenses and identification
cards that can be accepted by Federal agencies for official purposes.
(b) Subpart F establishes certain standards for State-issued
driver's licenses and identification cards issued by States that
participate in REAL ID, but that are not intended to be accepted by
Federal agencies for official purpose under section 202(d)(11) of the
REAL ID Act.
Sec. 37.3 Definitions.
For purposes of this part:
Birth certificate means the record related to a birth that is
permanently stored either electronically or physically at the State
Office of Vital Statistics or equivalent agency in a registrant's State
of birth.
Card means either a driver's license or identification card issued
by the State Department of Motor Vehicles (DMV) or equivalent State
office.
Certification means an assertion by the State to the Department of
Homeland Security that the State has met the requirements of this Part.
Certified copy of a birth certificate means a copy of the whole or
part of a birth certificate registered with the State that the State
considers to be the same as the original birth certificate on file with
the State Office of Vital Statistics or equivalent agency in a
registrant's State of birth.
Covered employees means Department of Motor Vehicles employees or
contractors who are involved in the manufacture or production of REAL
ID driver's licenses and identification cards, or who have the ability
to affect the identity information that appears on the driver's license
or identification card.
[[Page 5332]]
Data verification means checking the validity of data contained in
source documents presented under this regulation.
DHS means the U.S. Department of Homeland Security.
DMV means the Department of Motor Vehicles or any State Government
entity that issues driver's licenses and identification cards, or an
office with equivalent function for issuing driver's licenses and
identification cards.
Determination means a decision by the Department of Homeland
Security that a State has or has not met the requirements of this Part
and that Federal agencies may or may not accept the driver's licenses
and identification cards issued by the State for official purposes.
Digital photograph means a digital image of the face of the holder
of the driver's license or identification card.
Document authentication means determining that the source document
presented under these regulations is genuine and has not been altered.
Domestic violence and dating violence have the meanings given the
terms in section 3, Universal definitions and grant provisions, of the
Violence Against Women and Department of Justice Reauthorization Act of
2005 (Pub. L. 109-162, 119 Stat. 2960, 2964, Jan. 5, 2006); codified at
section 40002, Definitions and grant provisions, 42 U.S.C. 13925, or
State laws addressing domestic and dating violence.
Driver's license means a motor vehicle operator's license, as
defined in 49 U.S.C. 30301.
Duplicate means a driver's license or identification card issued
subsequent to the original document that bears the same information and
expiration date as the original document and that is reissued at the
request of the holder when the original is lost, stolen, or damaged and
there has been no material change in information since prior issuance.
Federal agency means all executive agencies including Executive
departments, a Government corporation, and an independent establishment
as defined in 5 U.S.C. 105.
Federally-regulated commercial aircraft means a commercial aircraft
regulated by the Transportation Security Administration (TSA).
Full compliance means that the Secretary or his designate(s) has
determined that a State has met all the requirements of Subparts A
through E.
Full legal name means an individual's first name, middle name(s),
and last name or surname, without use of initials or nicknames.
IAFIS means the Integrated Automated Fingerprint Identification
System, a national fingerprint and criminal history system maintained
by the Federal Bureau of Investigation (FBI) that provides automated
fingerprint search capabilities.
Identification card means a document made or issued by or under the
authority of a State Department of Motor Vehicles or State office with
equivalent function which, when completed with information concerning a
particular individual, is of a type intended or commonly accepted for
the purpose of identification of individuals.
INS means the former-Immigration and Naturalization Service of the
U.S. Department of Justice.
Lawful status: A person in lawful status is a citizen or national
of the United States; or an alien: lawfully admitted for permanent or
temporary residence in the United States; with conditional permanent
resident status in the United States; who has an approved application
for asylum in the United States or has entered into the United States
in refugee status; who has a valid nonimmigrant status in the United
States; who has a pending application for asylum in the United States;
who has a pending or approved application for temporary protected
status (TPS) in the United States; who has approved deferred action
status; or who has a pending application for lawful permanent residence
(LPR) or conditional permanent resident status. This definition does
not affect other definitions or requirements that may be contained in
the Immigration and Nationality Act or other laws.
Material change means any change to the personally identifiable
information of an individual as defined under this part.
Notwithstanding the definition of personally identifiable information
below, a change of address of principal residence does not constitute a
material change.
Material compliance means a determination by DHS that a State has
met the benchmarks contained in the Material Compliance Checklist.
NCIC means the National Crime Information Center, a computerized
index of criminal justice information maintained by the Federal Bureau
of Investigation (FBI) that is available to Federal, State, and local
law enforcement and other criminal justice agencies.
Official purpose means accessing Federal facilities, boarding
Federally-regulated commercial aircraft, and entering nuclear power
plants.
Passport means a passport booklet or card issued by the U.S.
Department of State that can be used as a travel document to gain entry
into the United States and that denotes identity and citizenship as
determined by the U.S. Department of State.
Personally identifiable information means any information which can
be used to distinguish or trace an individual's identity, such as their
name; driver's license or identification card number; social security
number; biometric record, including a digital photograph or signature;
alone, or when combined with other personal or identifying information,
which is linked or linkable to a specific individual, such as a date
and place of birth or address, whether it is stored in a database, on a
driver's license or identification card, or in the machine readable
technology on a license or identification card.
Principal residence means the location where a person currently
resides (i.e., presently resides even if at a temporary address) in
conformance with the residency requirements of the State issuing the
driver's license or identification card, if such requirements exist.
REAL ID Driver's License or Identification Card means a driver's
license or identification card that has been issued by a State that has
been certified by DHS to be in compliance with the requirements of the
REAL ID Act and which meets the standards of subparts A through D of
this part, including temporary or limited-term driver's licenses or
identification cards issued under Sec. 37.21.
Reissued card means a card that a State DMV issues to replace a
card that has been lost, stolen or damaged, or to replace a card that
includes outdated information. A card may not be reissued remotely when
there is a material change to the personally identifiable information
as defined by the Rule.
Renewed card means a driver's license or identification card that a
State DMV issues to replace a renewable driver's license or
identification card.
SAVE means the DHS Systematic Alien Verification for Entitlements
system, or such successor or alternate verification system at the
Secretary's discretion.
Secretary means the Secretary of Homeland Security.
Sexual assault and stalking have the meanings given the terms in
section 3, universal definitions and grant provisions, of the Violence
Against Women and Department of Justice Reauthorization Act of 2005
(Pub. L. 109-162, 119 Stat. 2960, 2964, Jan. 5, 2006); codified at
section 40002, Definitions and grant provisions, 42
[[Page 5333]]
U.S.C. 13925, or State laws addressing sexual assault and stalking.
Source document(s) means original or certified copies (where
applicable) of documents presented by an applicant as required under
these regulations to the Department of Motor Vehicles to apply for a
driver's license or identification card.
State means a State of the United States, the District of Columbia,
Puerto Rico, the Virgin Islands, Guam, American Samoa, and the
Commonwealth of the Northern Mariana Islands.
State address confidentiality program means any State-authorized or
State-administered program that--
(1) Allows victims of domestic violence, dating violence, sexual
assault, stalking, or a severe form of trafficking to keep, obtain, and
use alternative addresses; or
(2) Provides confidential record-keeping regarding the addresses of
such victims or other categories of persons.
Temporary lawful status: A person in temporary lawful status is a
person who: has a valid nonimmigrant status in the United States; has a
pending application for asylum in the United States; has a pending or
approved application for temporary protected status (TPS) in the United
States; has approved deferred action status; or has a pending
application for LPR or conditional permanent resident status.
Verify means procedures to ensure that:
(1) The source document is genuine and has not been altered (i.e.,
``document authentication''); and
(2) The identity data contained on the document is valid (``data
verification'').
Sec. 37.5 Validity periods and deadlines for REAL ID driver's
licenses and identification cards.
(a) Driver's licenses and identification cards issued under this
part, that are not temporary or limited-term driver's licenses and
identification cards, are valid for a period not to exceed eight years.
A card may be valid for a shorter period based on other State or
Federal requirements.
(b) On or after December 1, 2014, Federal agencies shall not accept
a driver's license or identification card for official purposes from
individuals born after December 1, 1964, unless such license or card is
a REAL ID-compliant driver's license or identification card issued by a
State that has been determined by DHS to be in full compliance as
defined under this subpart.
(c) On or after December 1, 2017, Federal agencies shall not accept
a driver's license or identification card for official purposes from
any individual unless such license or card is a REAL ID-compliant
driver's license or identification card issued by a State that has been
determined by DHS to be in full compliance as defined under this
subpart.
(d) Federal agencies cannot accept for official purpose driver's
licenses and identification cards issued under Sec. 37.71 of this
rule.
Subpart B--Minimum Documentation, Verification, and Card Issuance
Requirements
Sec. 37.11 Application and documents the applicant must provide.
(a) The State must subject each person applying for a REAL ID
driver's license or identification card to a mandatory facial image
capture, and shall maintain photographs of individuals even if no card
is issued. The photographs must be stored in a format in accordance
with Sec. 37.31 as follows:
(1) If no card is issued, for a minimum period of five years.
(2) If a card is issued, for a period of at least two years beyond
the expiration date of the card.
(b) Declaration. Each applicant must sign a declaration under
penalty of perjury that the information presented on the application is
true and correct, and the State must retain this declaration. An
applicant must sign a new declaration when presenting new source
documents to the DMV on subsequent visits.
(c) Identity. (1) To establish identity, the applicant must present
at least one of the following source documents:
(i) Valid, unexpired U.S. passport.
(ii) Certified copy of a birth certificate filed with a State
Office of Vital Statistics or equivalent agency in the individual's
State of birth.
(iii) Consular Report of Birth Abroad (CRBA) issued by the U.S.
Department of State, Form FS-240, DS-1350 or FS-545.
(iv) Valid, unexpired Permanent Resident Card (Form I-551) issued
by DHS or INS.
(v) Unexpired employment authorization document (EAD) issued by
DHS, Form I-766 or Form I-688B.
(vi) Unexpired foreign passport with a valid, unexpired U.S. visa
affixed accompanied by the approved I-94 form documenting the
applicant's most recent admittance into the United States.
(vii) Certificate of Naturalization issued by DHS, Form N-550 or
Form N-570.
(viii) Certificate of Citizenship, Form N-560 or Form N-561, issued
by DHS.
(ix) REAL ID driver's license or identification card issued in
compliance with the standards established by this part.
(x) Such other documents as DHS may designate by notice published
in the Federal Register.
(2) Where a State permits an applicant to establish a name other
than the name that appears on a source document (for example, through
marriage, adoption, court order, or other mechanism permitted by State
law or regulation), the State shall require evidence of the name change
through the presentation of documents issued by a court, governmental
body or other entity as determined by the State. The State shall
maintain copies of the documentation presented pursuant to Sec. 37.31,
and maintain a record of both the recorded name and the name on the
source documents in a manner to be determined by the State and in
conformity with Sec. 37.31.
(d) Date of birth. To establish date of birth, an individual must
present at least one document included in paragraph (c) of this
section.
(e) Social security number (SSN). (1) Except as provided in
paragraph (e)(3) of this section, individuals presenting the identity
documents listed in Sec. 37.11(c)(1) and (2) must present his or her
Social Security Administration account number card; or, if a Social
Security Administration account card is not available, the person may
present any of the following documents bearing the applicant's SSN:
(i) A W-2 form,
(ii) A SSA-1099 form,
(iii) A non-SSA-1099 form, or
(iv) A pay stub with the applicant's name and SSN on it.
(2) The State DMV must verify the SSN pursuant to Sec. 37.13(b)(2)
of this subpart.
(3) Individuals presenting the identity document listed in Sec.
37.11(c)(1)(vi) must present an SSN or demonstrate non-work authorized
status.
(f) Documents demonstrating address of principal residence. To
document the address of principal residence, a person must present at
least two documents of the State's choice that include the individual's
name and principal residence. A street address is required except as
provided in Sec. 37.17(f) of this part.
(g) Evidence of lawful status in the United States. A DMV may issue
a REAL ID driver's license or identification card only to a person who
has presented satisfactory evidence of lawful status.
(1) If the applicant presents one of the documents listed under
paragraphs
[[Page 5334]]
(c)(1)(i), (c)(1)(ii), (c)(1)(iii), (c)(1)(iv), (c)(1)(vii) or
(c)(1)(viii) of this section, the issuing State's verification of the
applicant's identity in the manner prescribed in Sec. 37.13 will also
provide satisfactory evidence of lawful status.
(2) If the applicant presents one of the identity documents listed
under paragraphs (c)(1)(v) or (c)(1)(vi), or (c)(1)(ix) of this
section, the issuing State's verification of the identity document(s)
does not provide satisfactory evidence of lawful status. The applicant
must also present a second document from Sec. 37.11(g)(1) or
documentation issued by DHS or other Federal agencies demonstrating
lawful status as determined by USCIS. All documents shall be verified
in the manner prescribed in Sec. 37.13.
(h) Exceptions Process. A State DMV may choose to establish a
written, defined exceptions process for persons who, for reasons beyond
their control, are unable to present all necessary documents and must
rely on alternate documents to establish identity or date of birth.
Alternative documents to demonstrate lawful status will only be allowed
to demonstrate U.S. citizenship.
(1) Each State establishing an exceptions process must make
reasonable efforts to establish the authenticity of alternate documents
each time they are presented and indicate that an exceptions process
was used in the applicant's record.
(2) The State shall retain copies or images of the alternate
documents accepted pursuant to Sec. 37.31 of this part.
(3) The State shall conduct a review of the use of the exceptions
process, and pursuant to subpart E of this part, prepare and submit a
report with a copy of the exceptions process as part of the
certification documentation detailed in Sec. 37.55.
(i) States are not required to comply with these requirements when
issuing REAL ID driver's licenses or identification cards in support of
Federal, State, or local criminal justice agencies or other programs
that require special licensing or identification to safeguard persons
or in support of their other official duties. As directed by
appropriate officials of these Federal, State, or local agencies,
States should take sufficient steps to safeguard the identities of such
persons. Driver's licenses and identification cards issued in support
of Federal, State, or local criminal justice agencies or programs that
require special licensing or identification to safeguard persons or in
support of their other official duties shall not be distinguishable
from other REAL ID licenses or identification cards issued by the
State.
Sec. 37.13 Document verification requirements.
(a) States shall make reasonable efforts to ensure that the
applicant does not have more than one driver's license or
identification card already issued by that State under a different
identity. In States where an individual is permitted to hold both a
driver's license and identification card, the State shall ensure that
the individual has not been issued identification documents in multiple
or different names. States shall also comply with the provisions of
Sec. 37.29 before issuing a driver's license or identification card.
(b) States must verify the documents and information required under
Sec. 37.11 with the issuer of the document. States shall use systems
for electronic validation of document and identity data as they become
available or use alternative methods approved by DHS.
(1) States shall verify any document described in Sec. 37.11(c) or
(g) and issued by DHS (including, but not limited to, the I-94 form
described in Sec. 37.11(c)(vi)) through the Systematic Alien
Verification for Entitlements (SAVE) system or alternate methods
approved by DHS, except that if two DHS-issued documents are presented,
a SAVE verification of one document that confirms lawful status does
not need to be repeated for the second document. In the event of a non-
match, the DMV must not issue a REAL ID driver's license or
identification card to an applicant, and must refer the individual to
U.S. Citizenship and Immigration Services for resolution.
(2) States must verify SSNs with the Social Security Administration
(SSA) or through another method approved by DHS. In the event of a non-
match with SSA, a State may use existing procedures to resolve non-
matches. If the State is unable to resolve the non-match, and the use
of an exceptions process is not warranted in the situation, the DMV
must not issue a REAL ID driver's license or identification card to an
applicant until the information verifies with SSA.
(3) States must verify birth certificates presented by applicants.
States should use the Electronic Verification of Vital Events (EVVE)
system or other electronic systems whenever the records are available.
If the document does not appear authentic upon inspection or the data
does not match and the use of an exceptions process is not warranted in
the situation, the State must not issue a REAL ID driver's license or
identification card to the applicant until the information verifies,
and should refer the individual to the issuing office for resolution.
(4) States shall verify documents issued by the Department of State
with the Department of State or through methods approved by DHS.
(5) States must verify REAL ID driver's licenses and identification
cards with the State of issuance.
(6) Nothing in this section precludes a State from issuing an
interim license or a license issued under Sec. 37.71 that will not be
accepted for official purposes to allow the individual to resolve any
non-match.
Sec. 37.15 Physical security features for the driver's license or
identification card.
(a) General. States must include document security features on REAL
ID driver's licenses and identification cards designed to deter forgery
and counterfeiting, promote an adequate level of confidence in the
authenticity of cards, and facilitate detection of fraudulent cards in
accordance with this section.
(1) These features must not be capable of being reproduced using
technologies that are commonly used and made available to the general
public.
(2) The proposed card solution must contain a well-designed,
balanced set of features that are effectively combined and provide
multiple layers of security. States must describe these document
security features in their security plans pursuant to Sec. 37.41.
(b) Integrated security features. REAL ID driver's licenses and
identification cards must contain at least three levels of integrated
security features that provide the maximum resistance to persons'
efforts to--
(1) Counterfeit, alter, simulate, or reproduce a genuine document;
(2) Alter, delete, modify, mask, or tamper with data concerning the
original or lawful card holder;
(3) Substitute or alter the original or lawful card holder's
photograph and/or signature by any means; and
(4) Create a fraudulent document using components from legitimate
driver's licenses or identification cards.
(c) Security features to detect false cards. States must employ
security features to detect false cards for each of the following three
levels:
(1) Level 1. Cursory examination, without tools or aids involving
easily identifiable visual or tactile features, for rapid inspection at
point of usage.
(2) Level 2. Examination by trained inspectors with simple
equipment.
(3) Level 3. Inspection by forensic specialists.
(d) Document security and integrity. States must conduct a review
of their card design and submit a report to DHS with their
certification that indicates the
[[Page 5335]]
ability of the design to resist compromise and document fraud attempts.
The report required by this paragraph is SSI and must be handled and
protected in accordance with 49 CFR part 1520. Reports must be updated
and submitted to DHS whenever a security feature is modified, added, or
deleted. After reviewing the report, DHS may require a State to provide
DHS with examination results from a recognized independent laboratory
experienced with adversarial analysis of identification documents
concerning one or more areas relating to the card's security.
Sec. 37.17 Requirements for the surface of the driver's license or
identification card.
To be accepted by a Federal agency for official purposes, REAL ID
driver's licenses and identification cards must include on the front of
the card (unless otherwise specified below) the following information:
(a) Full legal name. Except as permitted in Sec. 37.11(c)(2), the
name on the face of the license or card must be the same as the name on
the source document presented by the applicant to establish identity.
Where the individual has only one name, that name should be entered in
the last name or family name field, and the first and middle name
fields should be left blank. Place holders such as NFN, NMN, and NA
should not be used.
(b) Date of birth.
(c) Gender, as determined by the State.
(d) Unique Driver's license or identification card number. This
cannot be the individual's SSN, and must be unique across driver's
license or identification cards within the State.
(e) Full facial digital photograph. A full facial photograph must
be taken pursuant to the standards set forth below:
(1) States shall follow specifically ISO/IEC 19794-5:2005(E)
Information technology--Biometric Data Interchange Formats--Part 5:
Face Image Data. The Director of the Federal Register approves this
incorporation by reference in accordance with 5 U.S.C. 552(a) and 1 CFR
part 51. You may obtain a copy of these incorporated standards from
http://www.ansi.org, or by contacting ANSI at ANSI, 25 West 43rd
Street, 4th Floor, New York, New York 10036. You may inspect a copy of
the incorporated standard at the Department of Homeland Security, 1621
Kent Street, 9th Floor, Rosslyn, VA (please call 703-235-0709 to make
an appointment) or at the National Archives and Records Administration
(NARA). For information on the availability of material at NARA, call
202-741-6030, or go to www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html.
These standards include:
(i) Lighting shall be equally distributed on the face.
(ii) The face from crown to the base of the chin, and from ear-to-
ear, shall be clearly visible and free of shadows.
(iii) Veils, scarves or headdresses must not obscure any facial
features and not generate shadow. The person may not wear eyewear that
obstructs the iris or pupil of the eyes and must not take any action to
obstruct a photograph of their facial features.
(iv) Where possible, there must be no dark shadows in the eye-
sockets due to the brow. The iris and pupil of the eyes shall be
clearly visible.
(v) Care shall be taken to avoid ``hot spots'' (bright areas of
light shining on the face).
(2) Photographs may be in black and white or color.
(f) Address of principal residence, except an alternative address
may be displayed for:
(1) Individuals for whom a State law, regulation, or DMV procedure
permits display of an alternative address, or
(2) Individuals who satisfy any of the following:
(i) If the individual is enrolled in a State address
confidentiality program which allows victims of domestic violence,
dating violence, sexual assault, stalking, or a severe form of
trafficking, to keep, obtain, and use alternative addresses; and
provides that the addresses of such persons must be kept confidential,
or other similar program;
(ii) If the individual's address is entitled to be suppressed under
State or Federal law or suppressed by a court order including an
administrative order issued by a State or Federal court; or
(iii) If the individual is protected from disclosure of information
pursuant to section 384 of the Illegal Immigration Reform and Immigrant
Responsibility Act of 1996.
(3) In areas where a number and street name has not been assigned
for U.S. mail delivery, an address convention used by the U.S. Postal
Service is acceptable.
(g) Signature. (1) The card must include the signature of the card
holder. The signature must meet the requirements of the March 2005
American Association of Motor Vehicle Administrators (AAMVA) standards
for the 2005 AAMVA Driver's License/Identification Card Design
Specifications, Annex A, section A.7.7.2. This standard includes
requirements for size, scaling, cropping, color, borders, and
resolution. The Director of the Federal Register approves this
incorporation by reference in accordance with 5 U.S.C. 552(a) and 1 CFR
part 51. You may obtain a copy of these standards from AAMVA on-line at
http://www.aamva.org, or by contacting AAMVA at 4301 Wilson Boulevard,
Suite 400, Arlington, VA 22203. You may inspect a copy of these
incorporated standards at the Department of Homeland Security, 1621
Kent Street, 9th Floor, Rosslyn, VA (please call 703-235-0709 to make
an appointment) or at the National Archives and Records Administration
(NARA). For information on the availability of material at NARA, call
202-741-6030, or go to http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html.
(2) The State shall establish alternative procedures for
individuals unable to sign their name.
(h) Physical security features, pursuant to Sec. 37.15 of this
subpart.
(i) Machine-readable technology on the back of the card, pursuant
to Sec. 37.19 of this subpart.
(j) Date of transaction.
(k) Expiration date.
(l) State or territory of issuance.
(m) Printed information. The name, date of birth, gender, card
number, issue date, expiration date, and address on the face of the
card must be in Latin alpha-numeric characters. The name must contain a
field of no less than a total of 39 characters, and longer names shall
be truncated following the standard established by International Civil
Aviation Organization (ICAO) 9303, ``Machine Readable Travel
Documents,'' Volume 1, Part 1, Sixth Edition, 2006. The Director of the
Federal Register approves this incorporation by reference in accordance
with 5 U.S.C. 552(a) and 1 CFR part 51. You may obtain a copy of ICAO
9303 from the ICAO, Document Sales Unit, 999 University Street,
Montreal, Quebec, Canada H3C 5H7, e-mail: [email protected]. You may
inspect a copy of the incorporated standard at the Department of
Homeland Security, 1621 Kent Street, 9th Floor, Rosslyn, VA (please
call 703-235-0709 to make an appointment) or at the National Archives
and Records Administration (NARA). For information on the availability
of material at NARA, call 202-741-6030, or go to http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html.
(n) The card shall bear a DHS-approved security marking on each
[[Page 5336]]
driver's license or identification card that is issued reflecting the
card's level of compliance as set forth in Sec. 37.51 of this Rule.
Sec. 37.19 Machine readable technology on the driver's license or
identification card.
For the machine readable portion of the REAL ID driver's license or
identification card, States must use the ISO/IEC 15438:2006(E)
Information Technology--Automatic identification and data capture
techniques--PDF417 symbology specification. The Director of the Federal
Register approves this incorporation by reference in accordance with 5
U.S.C. 552(a) and 1 CFR part 51. You may obtain a copy of these
incorporated standards at http://www.ansi.org, or by contacting ANSI at
ANSI, 25 West 43rd Street, 4th Floor, New York, New York 10036. You may
inspect a copy of the incorporated standard at the Department of
Homeland Security, 1621 Kent Street, 9th Floor, Rosslyn, VA (please
call 703-235-0709 to make an appointment) or at the National Archives
and Records Administration (NARA). For information on the availability
of material at NARA, call 202-741-6030, or go to http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html. The PDF417 bar code standard must have the following
defined minimum data elements:
(a) Expiration date.
(b) Full legal name, unless the State permits an applicant to
establish a name other than the name that appears on a source document,
pursuant to Sec. 37.11(c)(2).
(c) Date of transaction.
(d) Date of birth.
(e) Gender.
(f) Address as listed on the card pursuant to Sec. 37.17(f).
(g) Unique driver's license or identification card number.
(h) Card design revision date, indicating the most recent change or
modification to the visible format of the driver's license or
identification card.
(i) Inventory control number of the physical document.
(j) State or territory of issuance.
Sec. 37.21 Temporary or limited-term driver's licenses and
identification cards.
States may only issue a temporary or limited-term REAL ID driver's
license or identification card to an individual who has temporary
lawful status in the United States.
(a) States must require, before issuing a temporary or limited-term
driver's license or identification card to a person, valid documentary
evidence, verifiable through SAVE or other DHS-approved means, that the
person has lawful status in the United States.
(b) States shall not issue a temporary or limited-term driver's
license or identification card pursuant to this section:
(1) For a time period longer than the expiration of the applicant's
authorized stay in the United States, or, if there is no expiration
date, for a period longer than one year; and
(2) For longer than the State's maximum driver's license or
identification card term.
(c) States shall renew a temporary or limited-term driver's license
or identification card pursuant to this section and Sec. 37.25(b)(2),
only if:
(1) the individual presents valid documentary evidence that the
status by which the applicant qualified for the temporary or limited-
term driver's license or identification card is still in effect, or
(2) the individual presents valid documentary evidence that he or
she continues to qualify for lawful status under paragraph (a) of this
section.
(d) States must verify the information presented to establish
lawful status through SAVE, or another method approved by DHS.
(e) Temporary or limited-term driver's licenses and identification
cards must clearly indicate on the face of the license and in the
machine readable zone that the license or card is a temporary or
limited-term driver's license or identification card.
Sec. 37.23 Reissued REAL ID driver's licenses and identification
cards.
(a) State procedure. States must establish an effective procedure
to confirm or verify an applicant's identity each time a REAL ID
driver's license or identification card is reissued, to ensure that the
individual receiving the reissued REAL ID driver's license or
identification card is the same individual to whom the driver's license
or identification card was originally issued.
(b) Remote/Non-in-person reissuance. Except as provided in
paragraph (c) of this section a State may conduct a non-in-person
(remote) reissuance if State procedures permit the reissuance to be
conducted remotely. Except for the reissuance of duplicate driver's
licenses and identification cards as defined in this rule, the State
must reverify pursuant to Sec. 37.13, the applicant's SSN and lawful
status prior to reissuing the driver's license or identification card.
(c) In-person reissuance. The State may not remotely reissue a
driver's license or identification card where there has been a material
change in any personally identifiable information since prior issuance.
All material changes must be established through an applicant's
presentation of an original source document as provided in this
subpart, and must be verified as specified in Sec. 37.13.
Sec. 37.25 Renewal of REAL ID driver's licenses and identification
cards.
(a) In-person renewals. States must require holders of REAL ID
driver's licenses and identification cards to renew their driver's
licenses and identification cards with the State DMV in person, no less
frequently than every sixteen years.
(1) The State DMV shall take an updated photograph of the
applicant, no less frequently than every sixteen years.
(2) The State must reverify the renewal applicant's SSN and lawful
status through SSOLV and SAVE, respectively (or other DHS-approved
means) as applicable prior to renewing the driver's license or
identification card. The State must also verify electronically
information that it was not able to verify at a previous issuance or
renewal if the systems or processes exist to do so.
(3) Holders of temporary or limited-term REAL ID driver's licenses
and identification cards must present evidence of continued lawful
status via SAVE or other method approved by DHS when renewing their
driver's license or identification card.
(b) Remote/Non-in-person renewal. Except as provided in (b)(2) a
State may conduct a non-in-person (remote) renewal if State procedures
permit the renewal to be conducted remotely.
(1) The State must reverify the applicant's SSN and lawful status
pursuant to Sec. 37.13 prior to renewing the driver's license or
identification card.
(2) The State may not remotely renew a REAL ID driver's license or
identification card where there has been a material change in any
personally identifiable information since prior issuance. All material
changes must be established through the applicant's presentation of an
original source document as provided in Subpart B, and must be verified
as specified in Sec. 37.13.
Sec. 37.27 Driver's licenses and identification cards issued during
the age-based enrollment period.
Driver's licenses and identification cards issued to individuals
prior to a DHS determination that the State is materially compliant may
be renewed or reissued pursuant to current State practices, and will be
accepted for
[[Page 5337]]
official purposes until the validity dates described in Sec. 37.5.
Effective December 1, 2014, Federal agencies will only accept REAL ID
cards for official purpose from individuals under 50 as of December 1,
2014. Individuals age 50 or older on December 1, 2014, must obtain and
present REAL ID cards for official purposes by December 1, 2017.
Sec. 37.29 Prohibition against holding more than one REAL ID card or
more than one driver's license.
(a) An individual may hold only one REAL ID card. An individual
cannot hold a REAL ID driver's license and a REAL ID identification
card simultaneously. Nothing shall preclude an individual from holding
a REAL ID card and a non-REAL ID card unless prohibited by his or her
State.
(b) Prior to issuing a REAL ID driver's license,
(1) A State must check with all other States to determine if the
applicant currently holds a driver's license or REAL ID identification
card in another State.
(2) If the State receives confirmation that the individual holds a
driver's license in another State, or possesses a REAL ID
identification card in another State, the receiving State must take
measures to confirm that the person has terminated or is terminating
the driver's license or REAL ID identification card issued by the prior
State pursuant to State law, regulation or procedure.
(c) Prior to issuing a REAL ID identification card,
(1) A State must check with all other States to determine if the
applicant currently holds a REAL ID driver's license or identification
card in another State.
(2) If the State receives confirmation that the individual holds a
REAL ID card in another State the receiving State must take measures to
confirm that the person has terminated or is terminating the REAL ID
driver's license or identification card issued by the prior State
pursuant to State law, regulation or procedure.
Subpart C--Other Requirements
Sec. 37.31 Source document retention.
(a) States must retain copies of the application, declaration and
source documents presented under Sec. 37.11 of this Part, including
documents used to establish all names recorded by the DMV under Sec.
37.11(c)(2). States shall take measures to protect any personally
identifiable information collected pursuant to the REAL ID Act as
described in their security plan under Sec. 37.41(b)(2).
(1) States that choose to keep paper copies of source documents
must retain the copies for a minimum of seven years.
(2) States that choose to transfer information from paper copies to
microfiche must retain the microfiche for a minimum of ten years.
(3) States that choose to keep digital images of source documents
must retain the images for a minimum of ten years.
(4) States are not required to retain the declaration with
application and source documents, but must retain the declaration
consistent with applicable State document retention requirements and
retention periods.
(b) States using digital imaging to retain source documents must
store the images as follows:
(1) Photo images must be stored in the Joint Photographic Experts
Group (JPEG) 2000 standard for image compression, or a standard that is
interoperable with the JPEG standard. Images must be stored in an open
(consensus) format, without proprietary wrappers, to ensure States can
effectively use the image captures of other States as needed.
(2) Document and signature images must be stored in a compressed
Tagged Image Format (TIF), or a standard that is interoperable with the
TIF standard.
(3) All images must be retrievable by the DMV if properly requested
by law enforcement.
(c) Upon request by an applicant, a State shall record and retain
the applicant's name, date of birth, certificate numbers, date filed,
and issuing agency in lieu of an image or copy of the applicant's birth
certificate, where such procedures are required by State law.
Sec. 37.33 DMV databases.
(a) States must maintain a State motor vehicle database that
contains, at a minimum--
(1) All data fields printed on driver's licenses and identification
cards issued by the State, individual serial numbers of the card, and
SSN;
(2) A record of the full legal name and recorded name established
under Sec. 37.11(c)(2) as applicable, without truncation;
(3) All additional data fields included in the MRZ but not printed
on the driver's license or identification card; and
(4) Motor vehicle driver's histories, including motor vehicle
violations, suspensions, and points on driver's licenses.
(b) States must protect the security of personally identifiable
information, collected pursuant to the REAL ID Act, in accordance with
Sec. 37.41(b)(2) of this part.
Subpart D--Security at DMVs and Driver's License and Identification
Card Production Facilities
Sec. 37.41 Security plan.
(a) In General. States must have a security plan that addresses the
provisions in paragraph (b) of this section and must submit the
security plan as part of its REAL ID certification under Sec. 37.55.
(b) Security plan contents. At a minimum, the security plan must
address--
(1) Physical security for the following:
(i) Facilities used to produce driver's licenses and identification
cards.
(ii) Storage areas for card stock and other materials used in card
production.
(2) Security of personally identifiable information maintained at
DMV locations involved in the enrollment, issuance, manufacture and/or
production of cards issued under the REAL ID Act, including, but not
limited to, providing the following protections:
(i) Reasonable administrative, technical, and physical safeguards
to protect the security, confidentiality, and integrity of the
personally identifiable information collected, stored, and maintained
in DMV records and information systems for purposes of complying with
the REAL ID Act. These safeguards must include procedures to prevent
unauthorized access, use, or dissemination of applicant information and
images of source documents retained pursuant to the Act and standards
and procedures for document retention and destruction.
(ii) A privacy policy regarding the personally identifiable
information collected and maintained by the DMV pursuant to the REAL ID
Act.
(iii) Any release or use of personal information collected and
maintained by the DMV pursuant to the REAL ID Act must comply with the
requirements of the Driver's Privacy Protection Act, 18 U.S.C. 2721 et
seq. State plans may go beyond these minimum privacy requirements to
provide greater protection, and such protections are not subject to
review by DHS for purposes of determining compliance with this Part.
(3) Document and physical security features for the card,
consistent with the requirements of Sec. 37.15, including a
description of the State's use of biometrics, and the technical
standard utilized, if any;
(4) Access control, including the following:
(i) Employee identification and credentialing, including access
badges.
(ii) Employee background checks, in accordance with Sec. 37.45 of
this part.
[[Page 5338]]
(iii) Controlled access systems.
(5) Periodic training requirements in--
(i) Fraudulent document recognition training for all covered
employees handling source documents or engaged in the issuance of
driver's licenses and identification cards. The fraudulent document
training program approved by AAMVA or other DHS approved method
satisfies the requirement of this subsection.
(ii) Security awareness training, including threat identification
and handling of SSI as necessary.
(6) Emergency/incident response plan;
(7) Internal audit controls;
(8) An affirmation that the State possesses both the authority and
the means to produce, revise, expunge, and protect the confidentiality
of REAL ID driver's licenses or identification cards issued in support
of Federal, State, or local criminal justice agencies or similar
programs that require special licensing or identification to safeguard
persons or support their official duties. These procedures must be
designed in coordination with the key requesting authorities to ensure
that the procedures are effective and to prevent conflicting or
inconsistent requests. In order to safeguard the identities of
individuals, these procedures should not be discussed in the plan and
States should make every effort to prevent disclosure to those without
a need to know about either this confidential procedure or any
substantive information that may compromise the confidentiality of
these operations. The appropriate law enforcement official and United
States Attorney should be notified of any action seeking information
that could compromise Federal law enforcement interests.
(c) Handling of Security Plan. The Security Plan required by this
section contains Sensitive Security Information (SSI) and must be
handled and protected in accordance with 49 CFR Part 1520.
Sec. 37.43 Physical security of DMV production facilities.
(a) States must ensure the physical security of facilities where
driver's licenses and identification cards are produced, and the
security of document materials and papers from which driver's licenses
and identification cards are produced or manufactured.
(b) States must describe the security of DMV facilities as part of
their security plan, in accordance with Sec. 37.41.
Sec. 37.45 Background checks for covered employees.
(a) Scope. States are required to subject persons who are involved
in the manufacture or production of REAL ID driver's licenses and
identification cards, or who have the ability to affect the identity
information that appears on the driver's license or identification
card, or current employees who will be assigned to such positions
(``covered employees'' or ``covered positions''), to a background
check. The background check must include, at a minimum, the validation
of references from prior employment, a name-based and fingerprint-based
criminal history records check, and employment eligibility verification
otherwise required by law. States shall describe their background check
process as part of their security plan, in accordance with Sec.
37.41(b)(4)(ii). This section also applies to contractors utilized in
covered positions.
(b) Background checks. States must ensure that any covered employee
under paragraph (a) of this section is provided notice that he or she
must undergo a background check and the contents of that check.
(1) Criminal history records check. States must conduct a name-
based and fingerprint-based criminal history records check (CHRC)
using, at a minimum, the FBI's National Crime Information Center (NCIC)
and the Integrated Automated Fingerprint Identification (IAFIS)
database and State repository records on each covered employee
identified in paragraph (a) of this section, and determine if the
covered employee has been convicted of any of the following
disqualifying crimes:
(i) Permanent disqualifying criminal offenses. A covered employee
has a permanent disqualifying offense if convicted, or found not guilty
by reason of insanity, in a civilian or military jurisdiction, of any
of the felonies set forth in 49 CFR 1572.103(a).
(ii) Interim disqualifying criminal offenses. The criminal offenses
referenced in 49 CFR 1572.103(b) are disqualifying if the covered
employee was either convicted of those offenses in a civilian or
military jurisdiction, or admits having committed acts which constitute
the essential elements of any of those criminal offenses within the
seven years preceding the date of employment in the covered position;
or the covered employee was released from incarceration for the crime
within the five years preceding the date of employment in the covered
position.
(iii) Under want or warrant. A covered employee who is wanted or
under indictment in any civilian or military jurisdiction for a felony
referenced in this section is disqualified until the want or warrant is
released.
(iv) Determination of arrest status. When a fingerprint-based check
discloses an arrest for a disqualifying crime referenced in this
section without indicating a disposition, the State must determine the
disposition of the arrest.
(v) Waiver. The State may establish procedures to allow for a
waiver of the requirements of paragraphs (b)(1)(ii) or (b)(1)(iv) of
this section under circumstances determined by the State. These
procedures can cover circumstances where the covered employee has been
arrested, but no final disposition of the matter has been reached.
(2) Employment eligibility status verification. The State shall
ensure it is fully in compliance with the requirements of section 274A
of the Immigration and Nationality Act (8 U.S.C. 1324a) and its
implementing regulations (8 CFR part 274A) with respect to each covered
employee. The State is encouraged to participate in the USCIS E-Verify
program (or any successor program) for employment eligibility
verification.
(3) Reference check. Reference checks from prior employers are not
required if the individual has been employed by the DMV for at least
two consecutive years since May 11, 2006.
(4) Disqualification. If results of the State's CHRC reveal a
permanent disqualifying criminal offense under paragraph (b)(1)(i) or
an interim disqualifying criminal offense under paragraph (b)(1)(ii),
the covered employee may not be employed in a position described in
paragraph (a) of this section. An employee whose employment eligibility
has not been verified as required by section 274A of the Immigration
and Nationality Act (8 U.S.C. 1324a) and its implementing regulations
(8 CFR part 274A) may not be employed in any position.
(c) Appeal. If a State determines that the results from the CHRC do
not meet the standards of such check the State must so inform the
employee of the determination to allow the individual an opportunity to
appeal to the State or Federal government, as applicable.
(d) Background checks substantially similar to the requirements of
this section that were conducted on existing employees on or after May
11, 2006 need not be re-conducted.
[[Page 5339]]
Subpart E--Procedures for Determining State Compliance
Sec. 37.51 Compliance--general requirements.
(a) Full compliance. To be in full compliance with the REAL ID Act
of 2005, 49 U.S.C. 30301 note, States must meet the standards of
subparts A through D or have a REAL ID program that DHS has determined
to be comparable to the standards of subparts A through D. States
certifying compliance with the REAL ID Act must follow the
certification requirements described in Sec. 37.55. States must be
fully compliant with Subparts A through D on or before May 11, 2011.
States must file the documentation required under Sec. 37.55 at least
90 days prior to the effective date of full compliance.
(b) Material compliance. States must be in material compliance by
January 1, 2010 to receive an additional extension until no later than
May 10, 2011 as described in Sec. 37.63. Benchmarks for material
compliance are detailed in the Material Compliance Checklist found in
DHS' Web site at http://www.dhs.gov.
Sec. 37.55 State certification documentation.
(a) States seeking DHS's determination that its program for issuing
REAL ID driver's licenses and identification cards is meeting the
requirements of this part (full compliance), must provide DHS with the
following documents:
(1) A certification by the highest level Executive official in the
State overseeing the DMV reading as follows:
``I, [name and title (name of certifying official), (position
title) of the State (Commonwealth))] of --------, do hereby certify
that the State (Commonwealth) has implemented a program for issuing
driver's licenses and identification cards in compliance with the
requirements of the REAL ID Act of 2005, as further defined in 6 CFR
part 37, and intends to remain in compliance with these
regulations.''
(2) A letter from the Attorney General of the State confirming that
the State has the legal authority to impose requirements necessary to
meet the standards established by this part.
(3) A description of the State's exceptions process under Sec.
37.11(h), and the State's waiver processes under Sec. 37.45(b)(1)(v).
(4) The State's Security Plan under Sec. 37.41.
(b) After DHS's final compliance determination, States shall
recertify compliance with this Part every three years on a rolling
basis as determined by DHS.
Sec. 37.59 DHS reviews of State compliance.
State REAL ID programs will be subject to DHS review to determine
whether the State meets the requirements for compliance with this part.
(a) General inspection authority. States must cooperate with DHS's
review of the State's compliance at any time. In addition, the State
must:
(1) Provide any reasonable information pertinent to determining
compliance with this part as requested by DHS;
(2) Permit DHS to conduct inspections of any and all sites
associated with the enrollment of applicants and the production,
manufacture, personalization and issuance of driver's licenses or
identification cards; and
(3) Allow DHS to conduct interviews of the State's employees and
contractors who are involved in the application and verification
process, or the manufacture and production of driver's licenses or
identification cards. DHS shall provide written notice to the State in
advance of an inspection visit.
(b) Preliminary DHS determination. DHS shall review forms, conduct
audits of States as necessary, and make a preliminary determination on
whether the State has satisfied the requirements of this part within 45
days of receipt of the Material Compliance Checklist or State
certification documentation of full compliance pursuant to Sec. 37.55.
(1) If DHS determines that the State meets the benchmarks of the
Material Compliance Checklist, DHS may grant the State an additional
extension until no later than May 10, 2011.
(2) If DHS determines that the State meets the full requirements of
subparts A through E, the Secretary shall make a final determination
that the State is in compliance with the REAL ID Act.
(c) State reply. The State will have up to 30 calendar days to
respond to the preliminary determination. The State's reply must
explain what corrective action it either has implemented, or intends to
implement, to correct any deficiencies cited in the preliminary
determination or, alternatively, detail why the DHS preliminary
determination is incorrect. Upon request by the State, an informal
conference will be scheduled during this time.
(d) Final DHS determination. DHS will notify States of its final
determination of State compliance with this Part, within 45 days of
receipt of a State reply.
(e) State's right to judicial review. Any State aggrieved by an
adverse decision under this section may seek judicial review under 5
U.S.C. Chapter 7.
Sec. 37.61 Results of compliance determination.
(a) A State shall be deemed in compliance with this part when DHS
issues a determination that the State meets the requirements of this
part.
(b) The Secretary will determine that a State is not in compliance
with this part when it--
(1) Fails to submit a timely certification or request an extension
as prescribed in this subpart; or
(2) Does not meet one or more of the standards of this part, as
established in a determination by DHS under Sec. 37.59.
Sec. 37.63 Extension of deadline.
(a) A State may request an initial extension by filing a request
with the Secretary no later than March 31, 2008. In the absence of
extraordinary circumstances, such an extension request will be deemed
justified for a period lasting until, but not beyond, December 31,
2009. DHS shall notify a State of its acceptance of the State's request
for initial extension within 45 days of receipt.
(b) States granted an initial extension may file a request for an
additional extension until no later than May 10, 2011, by submitting a
Material Compliance Checklist demonstrating material compliance, per
Sec. 37.51(b) with certain elements of subparts A through E as defined
by DHS. Such additional extension request must be filed by October 11,
2009. DHS shall notify a State whether an additional extension has been
granted within 45 days of receipt of the request and documents
described above.
(c) Subsequent extensions, if any, will be at the discretion of the
Secretary.
Sec. 37.65 Effect of failure to comply with this Part.
(a) Any driver's license or identification card issued by a State
that DHS determines is not in compliance with this part is not
acceptable as identification by Federal agencies for official purposes.
(b) Driver's licenses and identification cards issued by a State
that has obtained an extension of the compliance date from DHS per
Sec. 37.51 are acceptable for official purposes until the end of the
applicable enrollment period under Sec. 37.5; or the State
subsequently is found by DHS under this Subpart to not be in
compliance.
(c) Driver's licenses and identification cards issued by a State
that has been determined by DHS to be in material compliance and that
are marked to identify that the licenses and cards are materially
compliant will continue to be accepted by Federal agencies after the
[[Page 5340]]
expiration of the enrollment period under Sec. 37.5, until the
expiration date on the face of the document.
Subpart F--Driver's Licenses and Identification Cards Issued Under
Section 202(d)(11) of the REAL ID Act
Sec. 37.71 Driver's licenses and identification cards issued under
section 202(d)(11) of the REAL ID Act.
(a) Except as authorized in Sec. 37.27, States that DHS determines
are compliant with the REAL ID Act that choose to also issue driver's
licenses and identification cards that are not acceptable by Federal
agencies for official purposes must ensure that such driver's licenses
and identification cards--
(1) Clearly state on their face and in the machine readable zone
that the card is not acceptable for official purposes; and
(2) Have a unique design or color indicator that clearly
distinguishes them from driver's licenses and identification cards that
meet the standards of this part.
(b) DHS reserves the right to approve such designations, as
necessary, during certification of compliance.
* * * * *
Issued in Washington, DC, on January 10, 2008.
Michael Chertoff,
Secretary.
[FR Doc. 08-140 Filed 1-28-08; 8:45 am]
BILLING CODE 4410-10-P