As the Department of Homeland Security (DHS) pursues driver's license security law compliance under the REAL ID Act of 2005 in the coming months it will be imperative that the underlying material requirements are available for all 56 jurisdictions (the 50 states plus D.C. and the five island territories) to incorporate into their driver's license issuance processes. With DHS granting a six-month grace period (until July 2013) to comply with the driver's license security law, according to a December 2012 press release, stakeholders are still rumbling that two key elements of the 36 compliance requirements do not exist. They are both right and wrong.
EVVE: Accessing Digitized Vital Records
States are wrong when they claim that they cannot provide a method for verifying information that appears on birth certificates. Birth certificates are a key identity document required to be presented with a first driver's license application, or in some cases, renewals of driver's licenses, in compliance with the REAL ID Act. With 47 of 56 jurisdictions now completely digitized and networked to support interagency vital record checks — should departments of motor vehicles choose to use the network — this compliance requirement does exist. Specifically, the REAL ID Act of 2005 requires that:
The Secretary of Health and Human Services, in coordination with the Commissioner of Social Security and other appropriate Federal agencies, shall award grants to States, under criteria established by the Secretary, to assist States in —
(i) computerizing their birth and death records;
(ii) developing the capability to match birth and death records within each State and among the States; and
(iii) noting the fact of death on the birth certificates of deceased persons.
In reality, this two-part vital records program (1) supports states by digitizing their vital records in conjunction with state offices; and (2) provides connectivity so that states and federal agencies that need to verify identities can interface with state vital records offices both intrastate and interstate, via a "yes/no" query system.
Verification of vital record information is crucial to protect against the fraud and identity theft to which both birth and death records are subjected. The fact is, with only paper birth certificates, it is nearly impossible for any government employee at a motor vehicle department, Social Security office, or passport office, for example, to determine a counterfeit versus a legitimate birth certificate. There are thousands of varieties of the paper document and still no standards by which to issue them. However, when checked against clean, digitized vital records data, the counterfeits no longer pass muster and issuance of identity documents becomes significantly more reliable.
The goal of the Electronic Verification of Vital Events (EVVE) system, an initiative of the National Association for Public Health Statistics and Information Systems Association, which took the digitization program requirements off the states' hands and is providing the "match" capability among states, is to support each of the nation's vital records jurisdictions. (As seen in the map below, NAPHSIS counts 57 such jurisdictions, separating out New York City, which the DMVs don't do.) The initial lofty goal of NAPHSIS was to start at zero digitized jurisdictions in 2005 and have all of them on board by the May 2011 secure driver's license compliance deadline set out in REAL ID. However, with 10 jurisdictions either opting out or slow to initiate digitization, NAPHSIS has at least temporarily maxed out its potential.
Nonetheless, NAPHSIS has done remarkably well in reaching its 2005 goal. Even with the REAL ID deadline rolled back to January 2013 (and postponed again to July 2013), NAPHSIS pushed to complete digitization in the jurisdictions where it could. Plenty of work remains, however, including data cleanup and the matching of birth and death records, which is a specific requirement of REAL ID. However, the birth record element is what motor vehicle departments need, and that project is done. At least for now.
As I explained in a February 2011 CIS Memorandum, EVVE remains available today — as it was in 2011— for motor vehicle departments to incorporate into their processing. The relevancy of the issues and recommendations pertaining to cost and data cleanup outlined in that Memorandum continue and need not be repeated here. The differences between 2011 and today are in four main areas:
- In 2011, there were 27 jurisdictions available for query by motor vehicle departments. In 2013, just two years later, 48 of 56 now have digitized vital records (highlighted in green in the map below). New in the past year are Alaska, American Samoa, Florida, Massachusetts, Nevada, New Mexico, North Carolina, South Carolina, Tennessee, Virginia, Wisconsin, and Wyoming.
- Jurisdictions not participating in the digitization effort so far are Guam, Idaho, Illinois, Maine, New Hampshire, New York, Puerto Rico, Texas, and Washington. All other jurisdictions are online and available.
- An increased focus on "comprehensive immigration reform" (CIR) brings the opportunity to insist that preventing identity theft is critical to any legalization initiative. Two important ways to do so are to (1) publish the birth certificate minimum standard regulations drafted eight years ago under the Intelligence Reform and Terrorism Prevention Act of 2004, as described here; and (2) initialize EVVE as the primary means to verify identity for the job authorization program known as E-Verify. Under a CIR provision, the outstanding issues of matching birth with death records alongside "data cleanup" could be addressed directly with modest, but incredibly helpful, startup appropriations of $10 million.
- Unlike DIVS (described below), states have been left to individually approach NAPHSIS for linkage to their departments of motor vehicles, making national deployment more complicated than it needs to be. Despite this, some states have directly approached NAPHSIS for connectivity, whether or not those states are seeking REAL ID compliance.
DIVS: One Driver, One License Rule
The "one driver, one license" compliance requirement, which still does not exist, pertains to interstate checks to ensure residents are only issued one license and do not hold multiple licenses in one state, or multiple licenses in multiple states, as all four 9/11 pilots did. Much of the "one driver, one license" rule on the intrastate level is taken care by the facial recognition technology that most states have. And while this technology is not a REAL ID requirement, it does help sort through photos to ensure that individuals do not have multiple IDs and licenses issued in one state under a variety of names. In fact, every state that has run a facial recognition-matching pilot has caught many identity thieves, who steal others' identifying information and use their own photo to get IDs -- sometimes dozens of them.
However, the yet-to-be-implemented DIVS (Driver License and Identification Card Verification System) could yield an incredible array of multiple driver's licenses issued to the same person across state lines. To be fair, the program got bungled in its initial stages and the initial contractor on the project, which was funded through the REAL ID Act, is now working with AAMVA toward implementation.
Nonetheless, rollout is set to begin in 2014 for participating states, and DHS can certainly incorporate the DIVS timeline into their compliance requirements and enforcement checklist as the implementation goals reach fruition. According to a presentation by the DIVS contractor, these states are: Connecticut, Delaware, Georgia, Iowa, Louisiana, Massachusetts, Tennessee, Texas, Nebraska, North Carolina, North Dakota, Ohio, Oregon, South Dakota, South Carolina, Vermont, Virginia, and Wisconsin.
Ironically, while most of these states are either already REAL ID-compliant or seeking compliance actively, Louisiana refuses REAL ID compliance and Texas is REAL ID compliant, but has not initiated vital records digitization. Clearly, the hodgepodge of REAL ID full compliance continues, although significantly less so than in past years. Completion of the DIVS rollout is estimated to occur in 2023, 22 years after 9/11.
One caveat: How, exactly, the program will secure against multiple driver's licenses in states has yet to be made clear. Initial explanations suggest the program will enable states to verify that identity documents provided in one state for a license or ID card were previously provided upon application for a new license in a different state, an incredible jumpstart to streamlining procedures for customer service and customers. How such verification will prevent multiple licenses is unclear. I look forward to more clarity.