This hearing examined how the federal government is preparing to implement REAL ID and the Western Hemisphere Travel Initiative (WHTI) and hear from various stakeholders.

Witnesses:

Panel I

• The Honorable Stewart Baker, Assistant Secretary for Policy, Department of Homeland Security
• Mr. Derwood Staeben, Senior Advisor on the Western Hemisphere Travel Initiative for the Office of Passport Services and for the Border Crossing Card Renewal Program for the Bureau's Executive Office, Bureau of Consular Affairs, Department of State

Panel II A

• The Honorable Donna Stone, Delaware State Representative and President, National Conference of State Legislatures
• Mr. David Quam, Director of Federal Relations, National Governors Association
• Ms. Caroline Fredrickson, Director, Washington Legislative Office, American Civil Liberties Union

Panel II B

• Mr. Roger J. Dow, President and CEO, Travel Industry Association
• Mr. Angelo I. Amador, Director of Immigration Policy, U.S. Chamber of Commerce
• Ms. Sophia Cope, Staff Attorney/Ron Plesser Fellow, Center for Democracy and Technology

I want to first thank our witnesses for being here today to testify as we review how the Department of Homeland Security (DHS) and the Department of State are implementing the Real ID Act and the Western Hemisphere Travel Initiative (WHTI). I also want to thank Senator Voinovich, my partner on so many issues on this Committee. Last year, following our hearing on Real ID, he expressed his interest in holding another hearing to examine whether federal agencies are prepared to implement both Real ID and WHTI. I share this concern, and I am happy that we can work on this issue together.

Both Real ID and WHTI stem from the 9-11 Commission's recommendations on how to improve efforts to prevent and deter another terrorist attack in the U.S. Real ID was designed to enhance the security of driver's licenses as most of the 9-11 hijackers acquired some form of U.S. identification document, some by fraud, which assisted them in boarding commercial flights and renting cars. WHTI is based on the Commission's recommendation that Americans have their identities securely verified when entering the U.S.

I support the 9-11 Commission's recommendations concerning identification security. However, as the saying goes, the devil is in the details. Unfortunately, both Real ID and WHTI are controversial because of those very details.

Both Real ID and WHTI pose significant threats to Americans' privacy and civil liberties.

Real ID calls for all states to capture digital images of an individual's documents proving identity, such as a birth certificate or passport, and provide electronic access to their databases to all other states.The massive amounts of personal information that would be stored in state databases that are to be shared electronically with all other states, as well as the unencrypted data on the Real ID card itself, could provide one-stop shopping for identity thieves.

We have been told repeatedly that the model for this network of networks is the Commercial Drivers License Information System (CDLIS), which allows states to exchange information about commercial drivers. CDLIS currently stores the name, date of birth, social security number, and driver's license state and number of 13.5 million commercial drivers. Although proponents of Real ID are quick to point out that CDLIS has never been breached, the attractiveness of such a network for computer hacking by identity thieves would increase exponentially as the number of individuals in a system increases to 245 million.

In addition, it is unclear what privacy and data security laws would apply to this network of networks and what redress mechanisms are in place for individuals whose data is lost or stolen in another state. Because of the lack of privacy details in Real ID, this expansive effort may create false sense of security while actually making Americans more vulnerable to identity theft.

Adding to my concern is the fact that some states are implementing enhanced driver's licenses (EDLs) to comply with WHTI. EDLs are basically Real IDs with a vicinity-read radio frequency identification (RFID) chip. I'm afraid this poses serious privacy and security risks as anyone with a RFID reader will be able to monitor the activities of EDL holders.

Both Real ID and WHTI also pose significant challenges to the economy and the travel industry. For example, last year the State Department was not prepared for the overwhelming demand for passports caused by the implementation of WHTI for individuals traveling to Canada and Mexico. Due to the lack of staff and planning, the passport processing time went from several weeks to several months, causing many Americans to cancel their travel plans. I fear that DHS will be in the same boat in 2009 when the current extensions for Real ID compliance expire. Several states have passed laws rejecting Real ID, and the list is growing. DHS must be prepared for how it will deal with partial compliance if the problems with Real ID are not resolved.

The American public will need to know what to expect in secondary screening. The Transportation Security Administration will need enough staff on hand to quickly screen passengers and avoid travel disruptions if states continue to reject Real ID. Federal agencies will need guidance on how they can serve the public and provide benefits to those who visit them and do not have Real ID compliant cards.Today I hope to hear from both DHS and State as to how they are preparing for these implementation deadlines and what has been the impact of the current WHTI rules on the traveling public so far.

Moreover, states are struggling to figure out how they are to pay for what is essentially an unfunded mandate. The matter is even more important given the current economic climate. States are trying to figure out how to pay for schools, roads, health care, and other central services in a tight budget. Now they have to figure out how to pay for secure ID cards.Initially, DHS estimated the cost of implementing REAL ID to be $23 billion, of which $14 billion would be born by the states. In the final regulations, the overall cost decreased to $10 billion, leaving the estimated cost to the states at $4 billion. The federal government should pay for this unfunded mandate, but it is critical that we fix the problems with Real ID first. We cannot spend billions of taxpayer dollars to erode Americans' privacy protections.That is why I introduced the Identity Security Enhancement Act - S. 717 - with Senators Sununu, Leahy, Tester, Baucus, and Alexander to repeal Real ID and replace it with the negotiated rulemaking process and the more reasonable guidelines established in the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA). As you know, that Act brought together representatives from the federal government, state and local governments, privacy groups, and other stakeholders to develop standards for driver's licenses while ensuring privacy protections. By bringing everyone together I believe that we can address the problems with Real ID and have secure driver's license faster than the time frame proposed in DHS's final rules.I am pleased that our bill now has the support of the National Conference of State Legislatures, the U.S. Conference of Mayors, the Association of Corporate Travel Executives, the American Civil Liberties Union, and the Center for Democracy and Technology.

We all support improvements in our driver's license and identification cards, but Congress has a responsibility to ensure that the changes being implemented by the Administration really are improvements and are affordable, practical, and increase security against would-be terrorists and identity thieves.

-- 30--