Best Practices for the Implementation of the REAL ID Act
The REAL ID Act was signed into law in 2005. It specifies the minimum standards that are necessary to produce and issue REAL ID compliant driver’s licenses and identification cards. The REAL ID Act prevents some federal agencies from accepting state-issued driver’s licenses and identification cards if they do not meet the standards required by the Department of Homeland Security (DHS). Beginning in 2020, if a person does not possess a form of identification that meets REAL ID standards they will not be able to board an aircraft that is regulated by the Federal Aviation Administration. Currently, of the 56 states and jurisdictions required to implement the REAL ID Act, only 23 are in compliance. Although the Commonwealth of Kentucky has not yet implemented the REAL ID Act, an extension allowing Federal agencies to accept state driver’s licenses is currently in effect. This report summarizes REAL ID requirements, discusses the results of a survey that asked compliant states about their implementation experiences, identifies different strategies for implementation, and proposes recommendations.To receive a compliance certification from the federal government, states must submit a security plan to DHS that meets the requirements of REAL ID. The eight requirements each state must comply with are:
(1)Confirm physical security for the facilities that produce the driver’s license and identification cards,and provide storage areas for card stock and other materials used in card production.
(2)Maintain security of personally identifiable information (PII) at DMV locations.
(3)Document the physical security features for the card, including a description of the state’s use of biometrics.
(4)Put access controls in place for facilities and systems, including employee identification, credentialing, and background checks.
(5)Require periodic training in fraudulent documentation recognition(FDR) and in security awareness.
(6)Create an emergency and incident response plan.
(7)Set up internal audit controls.
(8)Affirm that the state has the authority to produce, revise, expunge, and protect the confidentiality of REAL ID driver’s licenses or ID cards for programs that require special licensing or identification.
Each requirement has implications for how Kentucky can proceed with implementation. If the security plan does not satisfy all of these requirements the state will not be certified as REAL ID compliant. A survey was distributed to officials in compliant states, and the responses provided insight to security precautions as well as to the dynamics of issuing and renewing driver’s licenses and identification cards. A total of ten survey responses were received. All states now issue driver’s licenses and identification cards from a centralized location. The only exception is South Dakota, which also gives the option of acquiring driver’s licenses and identification cards over the counter in some portions of the state. Aside from Connecticut and Maryland, all of the surveyed states provide temporary identification cards during the printing of the final version. Renewal cycles vary from four to eight years, while photo cycles (the amount of time that elapses between ID photo retakes) are between eight and 16 years. Many of the states have introduced public outreach campaigns so that people understand the purpose of REAL ID and what to expect when obtaining a REAL ID. Unfortunately, most states were unable to provide detailed cost breakdowns for implementation costs, although many received significant assistance from the federal government to establish a REAL ID program. Based on a reading of the REAL ID legislation and interpretation of the survey results, there are several options Kentucky could use to implement REAL ID. The report estimates implementation costs under four scenarios —1) a centralized print farm run by the Kentucky Transportation Cabinet (KYTC) without an option for online license renewal, 2) a centralized print farm located in the state but run by a third-party vendor without an option for online license renewal, 3) a centralized print farm run by KYTC with online renewal, and 4) a centralized print farm that is operated out of state by a third-party vendor. Under each scenario, PII would be collected by the Kentucky Division of Driver Licensing (DDL) at one of their 12 field offices. None of the scenarios leverage a de-centralized model of ID distribution. This is consistent with practices in other states, where distribution of driver’s licenses and identification cards is entirely centralized. This report also provide revenue estimates if the state were to move from a four-year to eight-year renewal cycle for licenses and estimates the cost of shifting to online driver’s license renewal.