Otherwise Occupied - Politics

Maybe even California is warming to nuclear power

gregh — Tue, 12 Jun 2007 12:06:22 -0500

A decent article in the Mercury News about the benefits of going nuclear. One quote made me chuckle.

San Jose Mercury News - Nuclear-power dilemma: It's carbon-free, but comes with big questions:

"We think global warming is such a tremendous planetary problem that we're not going to refuse to look at it," said Karen Douglas, director of the California climate initiative of Environmental Defense. However, the group does not support an expansion of nuclear-power capacity until issues such as safety, security, waste and nuclear-weapons proliferation are resolved, she said.

So it's all but a done deal, then? Heh.

Schneier on Real-ID: Costs and Benefits

gregh — Tue, 30 Jan 2007 12:28:49 -0600

Real-ID: Costs and Benefits:

All of these problems demonstrate that identification checks based on Real ID won’t be nearly as secure as we might hope. But the main problem with any strong identification system is that it requires the existence of a database. In this case, it would have to be 50 linked databases of private and sensitive information on every American -- one widely and instantaneously accessible from airline check-in stations, police cars, schools, and so on.

The security risks of this database are enormous. It would be a kludge of existing databases that are incompatible, full of erroneous data, and unreliable. Computer scientists don’t know how to keep a database of this magnitude secure, whether from outside hackers or the thousands of insiders authorized to access it.

And yet, there's a group that will carry on insisting that this is something we must have. We open ourselves up to theft of identity information on a grand scale, and for what? As Schneier continues:

Even worse, as soon as you divide people into two categories -- more trusted and less trusted people -- you create a third, and very dangerous, category: untrustworthy people whom we have no reason to mistrust. Oklahoma City bomber Timothy McVeigh; the Washington, DC, snipers; the London subway bombers; and many of the 9/11 terrorists had no previous links to terrorism. Evildoers can also steal the identity -- and profile -- of an honest person. Profiling can result in less security by giving certain people an easy way to skirt security.

So, we do all of this Real ID nonsense, and what do we get? Oh, right. Less security. Along with the false sense of security, we also receive diminished privacy, heightened risks to privacy, greater government aggregation of data that is is unlikely to be able to manage, and just generally a worse situation than we had before.

Do DHS Real ID regulations recommend private aggregators?

gregh — Thu, 11 Jan 2007 15:48:12 -0600

Update: See my follow-up, covering the actual text leading to these suggestions. It's not quite as bad as suggested. It still ain't great.

If the following is actually correct, the Department of Homeland Security is even more worthless than I could have imagined.

UnRealID.com:

The Department of Homeland Security has finished their proposed regulations for implementing the Real ID Act and has sent them to the Office of Management and Budget for approval. The publication of DHS's REAL ID regulations will follow shortly. The compliance guidelines are almost one year overdue.

According to a still-secret several hundred-page dossier sent last week by DHS to the Office of Management and Budget, DHS considered three ways to implement the REAL ID Act:

Plan A: Order the individual states to find a way of communicating data to one another. This idea was given short shrift by DHS, who dismissed it out of hand.
Plan B: Have DHS build a centralized database for the states to query before issuing REAL ID-compliant drivers licenses. This idea was also rejected.
Plan C: Have a private data aggregator act as the central database. This is the plan advocated by DHS. The plan calls for the outsourcing of all drivers license and ID card checks to a private corporation, who would then charge the states for each check performed. DHS head Michael Chertoff personally ordered this option to be chosen, according to a senior administration source.

One would hope that this would be the final nail in the Real ID coffin, and this would surely bring about swift introduction of the Akaka-Sununu Identification Security Enhancement Act of 2006.

Given the poor data protection histories of the commercial data aggregators, not to mention their incredibly poor histories of data matching, the very idea of them being called upon to manage aggregation of all of the drivers databases sounds more like a cruel joke. There may be more interesting issues.

To begin with, the Real ID Act doesn't call for a large database of driver's license data. In order to issue Real ID-compliant driver's licenses, states must:

(12) Provide electronic access to all other States to
information contained in the motor vehicle database of the
State.
(13) Maintain a State motor vehicle database that contains,
at a minimum--
(A) all data fields printed on drivers' licenses and
identification cards issued by the State; and
(B) motor vehicle drivers' histories, including
motor vehicle violations, suspensions, and points on
licenses.

Driver's license database information is commercial information owned by the states. This is clear from Reno v. Condon:

The motor vehicle information which the States have historically sold is used by insurers, manufacturers, direct marketers, and others engaged in interstate commerce to contact drivers with customized solicitations. The information is also used in the stream of interstate commerce by various public and private entities for matters related to interstate motoring. Because drivers’ information is, in this context, an article of commerce, its sale or release into the interstate stream of business is sufficient to support congressional regulation.

There were already some questions hanging around (most dismissed by commentators) about the Constitutionality of allowing the federal government to require states to grant other states access to their own commercial items without compensation in order to comply with the Real ID Act. Permitting commercial data aggregators to take possession or ownership of that state property without compensation is somewhat more egregious. As things now, those aggregators would be forced to purchase that information from the states; at least in that instance, the coffers of the states are gaining something to help cover the maintenance of that data. Under this plan, it would seem plausible (especially if the aggregators "accidentally" released the information into the public domain) that the states would simply be forced to give it away. This may raise greater Constitutional questions about those portions of the Real ID Act.

It makes the security aspect even worse.

It likely removes the (feckless) Privacy Act and the Computer Matching and Privacy Protection Act from the mix.

In short, I'm currently even a bit skeptical that even the inept Department of Homeland Security could proffer a suggestion as ludicrous as this one; I can't wait to see the actual proposed regulations to find out if it's true.

Homeland Stupidity: The nice guys behind REAL ID

gregh — Tue, 14 Nov 2006 12:22:48 -0600

The nice guys behind REAL ID - Homeland Stupidity:

For a very few well-connected people, the REAL ID Act is a way to make lots of money.

The organization set to profit from the REAL ID Act is the American Association of Motor Vehicle Administrators. According to its web site, AAMVA ‘is a tax-exempt, nonprofit organization striving to develop model programs in motor vehicle administration, police traffic services and highway safety. The association also serves as an information clearinghouse in these areas, and acts as the international spokesman for these interests.’

Info/Law: Election's Impact on Info/Law

gregh — Wed, 08 Nov 2006 19:11:34 -0600

It will prove interesting to see the results of the election as they bubble up.

Election’s Impact on Info/Law:

In the House, it appears most likely that Rep. Howard Berman will take over the chairmanship of the subcommittee that handles intellectual property law. As National Journal’s Congress Daily noted, we can expect him to ‘protect his nearby Hollywood interests by cracking down on piracy and protecting against copyright infringement of TV, music and movie productions.’ In general terms, that means restrictive IP law that favors content producers and rightsholders and hostility toward flexibility or expansion of fair use. That’s the bad news for Info/Law. The good news is that Congressman Ed Markey, a champion of consumer-oriented telecom and internet policy (and sponsor of the network neutrality amendment in the House earlier this year) will take over the subcommittee with the most power over these issues; the full Committee on Energy & Commerce will be helmed by John Dingell, who is pretty good on telecom as well. In addition, Rick Boucher, another consistent advocate for balanced information policy, particularly fair use and library concerns, will be a very senior Democrat on the Judiciary Committee (and possibly on Berman’s subcommittee). Finally, there is reason to hope education-oriented Democrats like Dale Kildee may pay attention to the serious and growing problems relating to educational uses of digital content.

Sensenbrenner is the Devil

gregh — Fri, 20 Oct 2006 10:08:59 -0500

Where rubber meets the road in privacy debate - Special Projects - MSNBC.com:

“The Real ID Act is a direct implementation of one of the 9/11 Commission recommendations,” said Jeff Lungren, spokesman for House Judiciary Chairman Rep. James Sensenbrenner, R-Wisc., the legislation’s key sponsor. “There’s a ton of misconceptions that have been promulgated by the opponents from the get-go. It’s unfortunate that they’re continuing to do so.”

Okay. He's not really the Devil. At least, I don't think he is. I'm not really an authority on such matters.

As far as I can tell, this is the 9/11 Commission recommendation that the Real ID Act implements:

Recommendation: Secure identification should begin in the United States. The federal government should set standards for the issuance of birth certificates and sources of identification, such as drivers licenses. Fraud in identification documents is no longer just a problem of theft. At many entry points to vulnerable facilities, including gates for boarding aircraft, sources of identification are the last opportunity to ensure that people are who they say they are and to check whether they are terrorists.

See Chapter 12, Immigration Law and Enforcement.

Now, Jeff Lundgren, what about this recommendation:

First, as we will discuss in chapter 13, to open up the sharing of information across so many agencies and with the private sector, the President should take responsibility for determining what information can be shared by which agencies and under what conditions. Protection of privacy rights should be one key element of this determination.

Recommendation: As the President determines the guidelines for information sharing among government agencies and by those agencies with the private sector, he should safeguard the privacy of individuals about whom information is shared.

Perhaps they simply for got about that? No. It's worse than that. Section 7212 of the Intelligence Reform and Terrorism Prevention Act of 2004 implemented the same top-level recommendation of the 9/11 Commission Report to bring more control to the issuance of driver's licenses. In fact, the Department of Transportation, in conjunction with the states and the Department of Homeland Security were already working on the new standards. Among the differences? Section 7212 had a requirement that privacy concerns be considered in the development of regulations; that nagging little piece was omitted from the Real ID Act Sensenbrenner is so proud of ramming through. Second, § 7212 required negotiated rulemaking, so that affected and interested parties could take part in the process of formulating the regulations. Oops. That got dropped from Real ID, too.

Here's a snippet from a work in progress of mine that goes into more detail on the important pieces of § 7212 that were tossed aside for the Real ID Act:

Section 206 of Real ID[1] repeals § 7212 of the Intelligence Reform and Terrorism Prevention Act of 2004.[2] Section 7212 imposed many similar data and identity verification constraints on the states as does Real ID.[3]   Beyond intentionally trying to increase information collection, enhance capabilities for information processing, and increase information dissemination, it’s unclear why § 7212 should have been repealed.

Generally, § 7212 is very similar to Real ID, so much so that the casual observer might not notice the differences.[4] Both impose their restrictions only if the state-issued identification will be used by federal agencies as authentic identification for official purposes.[5] Both require similar types of information to be collected applicants for driver’s licenses or identification cards.[6] Both suggest at offers of grants to help the states get themselves into compliance.[7] Both provide timelines for implementation and mechanisms to extend those timelines.[8] That’s roughly where the similarities end.

Section 7212 calls for negotiated rulemaking, while Real ID doesn’t address the rulemaking process at all.[9]

1.     The Privacy Requirements of § 7212

For information privacy, the most important piece of § 7212 that was not carried forward to Real ID is the requirement for regulations to protect the privacy of individuals.[10] Section 7212 required that the regulations “shall include procedures and requirements to protect the privacy rights of individuals who apply for and hold driver’s licenses and personal identification cards.”[11] There is no such provision in Real ID.

This may not merely be trimming some fat from a process that might have been a government smokescreen in forming such regulations. Development of the regulations for driver’s licenses under § 7212 was required to be done by a committee using federal negotiated rulemaking guidelines.[12] The statute laid out the minimum categories of individuals that would have representatives on the committee drafting the regulations: 1) officials from state agencies that issue driver’s licenses or identification cards;[13] 3) elected officials from the states; 4) representatives of the Department of Homeland Security; and 5) other interested parties.[14]

State officials would have vested interests, both political and legal, in ensuring that the regulations protected the privacy of their constituents.[15] Other interested parties would no doubt consist of civil liberties groups interested in protecting privacy rights.[16] Even companies that sell privacy protection software or advanced identification technologies would probably get involved.[17] Regardless of the motives of the various parties included in the negotiated rulemaking, there would surely by more public input and oversight to protect the privacy rights of individuals than there will be in an otherwise undefined privacy regulation context, as that which exists in Real ID.

2.     Specific § 7212 Steps to Avoid the National ID Card Issue

The repeal of § 7212 also removed some measures that appeared to avoid the institution of a national identity card.[18] Americans have long been opposed to the concept of a national identity card, feeling that such a card is too great an intrusion into their personal privacy.[19] Some commentators have even suggested that such a system, giving someone a single national identity, robs that person of individual political identity that many Americans cherish.[20]

Richard Sobel has put forth some suggestions about what a national identity system might look like. He proffers that such a system would require all citizens and documented immigrants to: 1) be issued an identifying number; 2) at a certain age, every individual would be issued a card that identified the person and was tied to the identification number; and 3) those numbers would be entered into a nationwide databank collecting disparate personal information.[21] As Prof. Sobel points out, with the issuance of a Social Security Number at birth, the first step of that process is already complete.[22]

Section 7212 prevented the execution of the other two components of Prof. Sobel’s national identity system prerequisites. First, it allowed states to forego certain requirements, including the requirement that an individual have a social security number, or even that a person be a citizen or documented immigrant to drive.[23] Second, it allowed no requirement that states force their cards to conform to a national appearance standard.[24] Third, it did not impose the open database access requirement of Real ID.[25]

Real ID, on the other hand, virtually meets all of these prerequisites. It relies upon Social Security Numbers, which are now issued at birth. It will allow the issuance of a standardized card at the time when a person needs to access federal resources. Finally, Real ID mandates that all of that information be put into a databank of disparate information, that can all be tied together by the national identifier.[26]

[1] Real ID Act § 206.

[2] Intelligence Reform and Terrorism Prevention Act of 2004, Pub. L. 108-48, Title VII, § 7212 (2004).

[3] See e.g., § 7212(b)(C)(2); Real ID Act § 202(b)-(c).

[4] Section 7212 placed rulemaking and administrative authority under the Secretary of Transportation. Section 7212(b)(C)(i). Real ID Act substitutes the Secretary for Homeland Security. The Real ID Act, § 201(4). Section 7212 requires regular audits of state compliance.

Section 7212(b)(C)(iii). Real ID Act, curiously, does not, in spite of it’s supposedly great concern for ensuring states comply. Real ID Act, § 202(a)(2).

[5] Rather than risk federalism questions, both § 7212 and Real ID Act only purport to lay down standards for what is required of state-issued identification documents if they are to be used for official federal government uses. See e.g., § 7212(b)(C)(2); Real ID Act § 202(a).

[6] See, e.g. § 7212(b)(C)(2); Real ID Act § 202(c).

[7] See e.g., § 7212(c); Real ID Act § 204.

[8] See e.g., § 7212(d); Real ID Act § 205(b).

[9] See § 7212(b)(4).

Real ID Act contains no similar requirement for the involvement of affected parties in the crafting of regulations.

[10] See § 7212(b)(3)(2).

[11] Id. Real ID Act contains no similar requirement for regulations to ensure information privacy. There’s no explanation for why it has been removed in the record. There are certainly inferences that can be drawn.

[12] Section 7212(b)(4).

[13] In other words, those who would be charged with implementing the standards would be involved in developing the regulations. In contrast, the current approach under the Real ID Act doesn’t prohibit the Department of Homeland Security from involving those charged with implementation, but neither does it require such involvement. In fact, it would appear that the Department of Homeland Security is well underway in drafting regulations in a vacuum. See U.S. Driver’s License Standard Still Undefined, Card Technology, http://www.cardtechnology.com/article.html?id=20060613J3I4TARG (last visited Jun. 30, 2006).

[14] Section 7212(b)(4)(B). It seems reasonable to assume that “interested parties” in 5) would see the involvement of privacy advocates and other civil liberties groups.

[15] See supra Part I.E.

[16] See e.g., EPIC – National ID and Real ID Act, Electronic Information Privacy Center, http://www.epic.org/privacy/id_cards/ (last visited Jun. 30, 2006) (EPIC’s tracking of the latest news regarding Real ID Act issues as well as national identity card issues); American Civil Liberties Union, RealNightmare.org, http://www.realnightmare.org/ (last visited Jun. 30, 2006) (ACLU’s public awareness website for Real ID Act concerns); United States Public Policy Committee of the Association for Computing Machinery, USACM Urges Reconsideration of Real ID Provisions, http://www.acm.org/usacm/weblog/index.php?p=280 (last visited Jun. 30, 2006).

[17] This is not a suggestion that vendors shouldn’t be involved in this process. Indeed, software companies right now are doing significant work in identity management technologies, and the considerable research being done in that space would almost certainly benefit the development of the requirements the Real ID Act is imposing. See, e.g., Microosft Corporation, Microsoft CardSpace, http://msdn.microsoft.com/winfx/reference/infocard/default.aspx (last visited Jun. 30, 2006); Network World, Novell Funds Open Source Bandit, http://www.networkworld.com/news/2006/061306-novell-funds-open-source.html?fsrc=rss-security (last visited Jun. 30, 2006) (regarding Novell’s Bandit identity management technology); Liberty Alliance Project, http://www.projectliberty.org/ (last visited Jun. 30, 2006) (website for the Liberty Alliance Project, a federated identity management technology).

[18] There is a long history of rejection of national identity cards in the United States. See

Richard Sobel, The Demeaning of Identity and Personhood in National Identification Systems, 15 Harv. J.L. & Tech. 319, 382-386.

[19] See Id.

[20] Id at 370 (“Similarly, the presumption and presence of unimpeded individual action protected by the political buffer around personhood and undergirding individual rights clash with a national ID.”).

[21] Richard Sobel, The Degradation Of Political Identity Under A National Identification System, 8 B.U. J. Sci. & Tech. L. 37, 45-47.

[22] Id. at 46.

[23] See § 7212(b)(3), specifiying:

(B) may not infringe on a State's power to set criteria concerning what categories of individuals are eligible to obtain a driver's license or personal identification card from that State;

(C) may not require a State to comply with any such regulation that conflicts with or otherwise interferes with the full enforcement of State criteria concerning the categories of individuals that are eligible to obtain a driver's license or personal identification card from that State;

[24] Id. (“(D) may not require a single design to which driver’s licenses or personal identification cards issued by all States must confirm . . . .”).

[25] In fact, it requires no information sharing between the states at all.

[26] The national identifier here is the Social Security Number, despite the fact that the Privacy Act of 1974, in part, was aimed at limiting use of the Social Security Number as a national identification number. Sobel, Demeaning, at 350-351. The disparate information is the array of drivers records, in all of their various formats, spread throughout the states.

AAMVA : REAL ID WILL COST STATES MORE THAN $11 BILLION

gregh — Fri, 13 Oct 2006 16:50:55 -0500

On September 21, the American Association of Motor Vehicle Administrators announced their findings on the Real ID Act of 2005. Among the findings, as announced in their press release:

AAMVA : REAL ID WILL COST STATES MORE THAN $11 BILLION:

WASHINGTON: comprehensive analysis of the federal Real ID Act was released today, revealing a cost to states of more than $11 billion over five years. The report -- which reflects findings from a survey conducted by the National Governors Association (NGA), National Conference of State Legislatures (NCSL) and the American Association of Motor Vehicle Administrators (AAMVA) -- sets forth the consequences and costs of implementing the act and makes recommendations to facilitate a more realistic approach.

The federal Real ID act creates national standards for issuing state drivers licenses and identification cards. Among the costly requirements necessary for implementation of the law, states will likely be required to: re-issue drivers licenses and identification cards to all 245 million current holders within five years; establish on-site identification verification procedures at the source of issuance; and meet specific security and production requirements for the new card. Detailed data provided by the 47 jurisdictions which responded to the survey indicates that among the cost of the changes to the driver's licensing process are a one-time calculable expense of nearly $1 billion and ongoing costs of more than $10.1 billion for the first five-year enrollment period.

The report also suggests additional costs, such as the added time and effort citizens will spend to comply with the state motor vehicle department. Anticipating three to four identity documents per applicant, with more than 80 million transactions performed annually, applicant processing time will more than double for citizens in most states, with waits in some areas increasing by up to 200%. Several provisions under consideration by the Department of Homeland Security were not addressed by the survey, and could potentially further impact citizens and DMVs and add significantly to the costs described above.

At least we'll be oh-so-much-more safe and secure once we have these new super-verified licenses.

Avant News: 19 Year Old Diebold Technician Wins U.S. Presidency

gregh — Fri, 29 Sep 2006 13:04:48 -0500

Avant News: 19 Year Old Diebold Technician Wins U.S. Presidency:

In a dramatic development that has come as a surprise to pundits and the public alike, a youthful technician with Diebold, Inc. has emerged as the unlikely winner of the 2008 U.S. Presidential election. The president-elect, 19 year old Billy Pustule of Green, Ohio, reached via SMS at the garage apartment by his mother's house in which he currently resides, said he was "real psyched about being the president" and "had big plans for the inauguration party".

. . .

According to the official electronic tally, compiled and certified by Diebold voting engineers, President-elect Pustule won an impressive 59.6% of the popular vote nationwide, the strongest showing ever received by a write-in candidate. He was followed by 38% for Democratic candidate Hillary Rodham Clinton, and 28.6% for Republican candidate Bill Frist. The fact that the totals exceed 100% has been attributed by a Diebold spokesman to "a special kind of rounding".

AP: Commerce Dept. lost 1,100 laptops in five years

gregh — Thu, 21 Sep 2006 19:49:32 -0500

Commerce Dept. lost 1,100 laptops in five years:

The Commerce Department has lost more than 1,100 laptop computers since 2001, most of them assigned to the Census Bureau, officials said Thursday night.

The Census Bureau, the main collector of information about Americans, lost 672 computers. Of those, 246 contained some personal data, the department said in a statement. However, no data from any missing computer has been known to have been improperly used, the department said.

And even while it can't protect the information it's got, the government always wants to collect more.

Real ID hits the local press

gregh — Mon, 24 Jul 2006 12:20:26 -0500

Mostly, it's become news because the new budget calls for nearly $20 million in spending to start planning for Real ID implementation in California. They fail to mention some of the most ridiculous provisions in this article.

Long waits looming for license renewals / DMV officials fear new federal ID rules will lengthen lines:

Starting in 2008, all 22 million licensed California drivers will be required to go in person to a DMV office and prove their identity and address with three different documents before getting a new, federally approved state license.

...

But California does have a major disadvantage. "There are a whole lot of issues -- but for all of them, California's issues are compounded by its size," Cather said.

Indeed, aside from the issues of how to process the new licenses, how they will be verified and what they will look like, California's biggest headache is how to physically get all 22 million licensed drivers -- plus an additional 2 million identification card holders -- through the DMV's 169 field offices.

Currently, a resident can get a license renewal twice by mail, meaning a trip to the DMV only once every 15 years. But under Real ID, every single person seeking a renewal will have to show up in the flesh, eliminating the 2.5 million transactions a year that can currently be done by mail or over the Internet.

In short, California seems to be slow on the uptake that this is a major issue. It will become clear soon.