Beyond Real ID deadline panic, national identity document plan raises new privacy questions

CNBC

02-05-2025

After years of delay, the deadline for Real ID is fast approaching.
Starting May 7, upgraded driver's licenses or ID cards — created post-9/11 to boost security standards — or another acceptable form of identification will be required to board domestic flights and enter certain federal facilities.
All states, the District of Columbia, and the five U.S. territories are Real ID compliant and issuing Real ID-compliant driver's licenses and IDs, according to DHS. But not all states are happy about it. Representative Laurel Libby, R-Maine, has sponsored a bill to repeal the law in Maine that allows the secretary of state to issue state IDs in compliance with federal Real ID legislation.
Transportation Security Administration officers are able to use biometric cameras, where available, to assist with identity verification, according to the TSA's website. However, a traveler's photo and personal data are deleted after the person's identity is verified. Images are not used for law enforcement, surveillance or shared with other entities, the TSA says.
Nevertheless, Real ID has stirred concern among cybersecurity and privacy professionals about consumer data protection.
Here's what is important to know about the significant shift in identification:
Real ID does not create a federal database of driver's license information. Each state continues to issue unique licenses and maintains responsibility for recordkeeping. States also control who gets access to their records and under what circumstances, according to the Department of Homeland Security.
Even so, concerns persist among privacy professionals that the next step will be a federal database of driver's license information, which is bad from a privacy and cybersecurity standpoint, said Jay Stanley, a senior policy analyst with the American Civil Liberties Union.
"The more information the government has, the more the government might use that information," said Jodi Daniels, founder and chief executive of Red Clover Advisors, a privacy consulting company. "But that's not what's happening now," she added.
States have been issuing driver's licenses for many years, and personal information is already being stored. The expectation is that the same controls apply to Real ID, said Bala Kumar, chief product and technology officer at Jumio, an online mobile payment and identity verification company. "States have already been managing this for many years," Kumar said.
Different states have different technologies they use to protect personal data, said Ian Grossman, president and chief executive of the American Association of Motor Vehicle Administrators, and while this information is not published, that's a good thing — it is to prevent nefarious actors from having a leg up, he said. AAMVA, however, offers state motor vehicle departments best practices for data security, which includes encrypting personal information at rest and in transit.
Despite existing cybersecurity protocols, privacy experts are concerned about the ability of bad actors and others to potentially access personal information. In some cases, states sell personal information to outside companies such as insurance providers and private investigators. Concerned individuals should ask their state motor vehicle department about how their data is stored and shared, said Daniels, and they can contact their state representatives if they aren't satisfied with the answers, she added.
Even though many security professionals feel confident in the data security around Real ID, they still say consumers can't be too careful, given the tenacity of criminals to steal personal information. If anything, this is a good time to bake some basic security protocols that have been recommended for years into your personal life.
Consumers should strongly consider freezing their credit with each of the major credit bureaus, Experian, Equifax and TransUnion. Identity monitoring tools could also be used to help protect your identity, said Zulfikar Ramzan, chief technology officer at Point Wild, a cybersecurity company. You only have so much control over how the various organizations that have your data store it and protect it, but you can mitigate what thieves can do with the data, he said.
Consumers should also use two-factor authentication and implement practices to avoid allowing scammers to dupe unsuspecting family members — a growing problem, according to Tom Moore, senior managing director at Protiviti and one of the leaders of the firm's data privacy practice. Facial recognition can be used to create faceprints or images that can be used to fool people, such as a scammer pretending to be a loved one in distress. Moore recommends that families create code words only known to them. A bad actor won't know the code word, stopping him in his tracks, he said.
For the past decade, states have been using the State-to-State (S2S) Verification Service administered by the American Association of Motor Vehicle Administrators, a nonprofit that develops model programs in motor vehicle administration, law enforcement and highway safety. The system allows states to electronically check with other participating states to determine if an applicant currently holds a driver's license or identification card in another state. Previously, a similar system was used for commercial driver's license holders.
States also share certain information from their driver's license databases with local and federal law enforcement agencies, and they may even sell personal data, in some cases. Security protocols exist to mitigate the potential misuse of this data, and several laws regulate how DMV information is protected or disclosed. What's more, many states have upgraded and monitored their infrastructure in the process of getting ready for Real ID, which further decreases the risk of cyber-attacks, said Andrew Bud, chief executive of iProov, a global technology company focused on biometric verification and authentication.
Many states are starting to roll out mobile driver's licenses, a digital version of state-issued driver's licenses stored on a smartphone or other smart device, which the AAMVA says "is the future of licensing and proof of identity."
These licenses are embedded with cryptographic digital signatures, so anyone verifying your ID, whether in person or online, can trust that the information hasn't been altered, providing higher security and trust than a static image.
About a quarter of states today, including Utah, Maryland, Virginia and New York, issue mobile driver's licenses, according to mDLConnection, an online resource from the Secure Technology Alliance. Other states have pilot programs in effect, have enacted legislation or are studying the issue. This undertaking is quite ambitious and has been underway for several years.