Best Practices for the Implementation of the REAL ID Act

The  REAL  ID  Act  was  signed  into  law  in  2005. It  specifies  the  minimum  standards  that are necessary to produce and issue REAL ID compliant driver’s licenses and identification cards. The REAL  ID  Act prevents some  federal  agencies  from  accepting  state-issued  driver’s  licenses  and identification  cards  if they  do  not  meet  the  standards  required  by  the  Department  of  Homeland Security  (DHS).  Beginning  in  2020,  if  a  person  does  not  possess  a  form  of  identification  that meets  REAL  ID  standards  they  will  not  be  able  to  board  an  aircraft  that  is  regulated  by  the Federal  Aviation  Administration.  Currently,  of  the  56  states  and  jurisdictions  required  to implement  the  REAL  ID  Act,  only  23  are  in  compliance.  Although  the  Commonwealth  of Kentucky has not yet implemented the REAL ID Act, an extension allowing Federal agencies to accept   state   driver’s   licenses   is   currently   in   effect.   This   report   summarizes   REAL   ID requirements,   discusses   the   results   of   a   survey   that   asked compliant   states   about   their implementation  experiences,  identifies  different  strategies  for  implementation,  and  proposes recommendations.To receive a compliance certification from the federal government, states must submit a security plan  to  DHS  that  meets  the  requirements  of  REAL  ID.  The  eight  requirements each state  must comply with are:

(1)Confirm   physical   security   for   the   facilities that produce   the   driver’s   license   and identification cards,and provide storage areas for card stock and other materials used in card production.

(2)Maintain security of personally identifiable information (PII) at DMV locations.

(3)Document the physical security features for the card, including a description of the state’s use of biometrics.

(4)Put access controls in place for facilities and systems, including employee identification, credentialing, and background checks.

(5)Require periodic training in fraudulent documentation recognition(FDR) and in security awareness.

(6)Create an emergency and incident response plan.

(7)Set up internal audit controls.

(8)Affirm that  the state  has  the  authority  to  produce,  revise,  expunge,  and  protect  the confidentiality of REAL ID driver’s licenses or ID cards for programs that require special licensing or identification.

Each  requirement  has  implications  for  how  Kentucky  can  proceed  with  implementation.  If  the security plan does not satisfy all of these requirements the state will not be certified as REAL ID compliant. A  survey was distributed  to  officials  in  compliant  states,  and  the  responses provided insight  to security  precautions  as  well  as to the  dynamics  of  issuing  and  renewing  driver’s  licenses  and identification cards. A total of ten survey responses were received. All states now issue driver’s licenses  and  identification  cards  from  a  centralized  location. The  only  exception  is  South Dakota,  which  also gives the  option  of  acquiring  driver’s  licenses  and  identification  cards  over the  counter  in  some  portions  of  the  state.  Aside  from  Connecticut  and  Maryland,  all  of  the surveyed  states  provide  temporary  identification  cards during  the printing of  the final  version. Renewal  cycles  vary  from  four  to  eight  years,  while  photo  cycles  (the  amount  of  time  that elapses  between  ID  photo  retakes)  are  between  eight  and  16  years.  Many  of  the  states  have introduced  public  outreach  campaigns  so  that  people  understand the  purpose  of REAL  ID  and what  to  expect  when obtaining  a  REAL  ID.  Unfortunately,  most  states  were  unable  to  provide detailed  cost   breakdowns   for   implementation   costs,   although   many   received significant assistance from the federal government to establish a REAL ID program.  Based on a reading of the REAL ID legislation and interpretation of the survey results, there are several  options   Kentucky   could   use   to   implement   REAL   ID.   The   report   estimates implementation  costs  under  four  scenarios —1)  a  centralized  print  farm  run  by  the  Kentucky Transportation Cabinet  (KYTC)  without  an  option  for  online  license  renewal,  2)  a  centralized print farm located in the state but run by a third-party vendor without an option for online license renewal, 3) a centralized print farm run by KYTC with online renewal, and 4) a centralized print farm  that  is  operated  out  of  state  by  a  third-party  vendor.  Under  each  scenario, PII  would  be collected  by  the  Kentucky  Division  of  Driver  Licensing  (DDL)  at  one  of  their  12  field  offices. None of the scenarios leverage a de-centralized model of ID distribution. This is consistent with practices in other states, where distribution of driver’s licenses and identification cards is entirely centralized. This  report  also provide revenue  estimates  if  the  state  were  to  move  from  a  four-year to eight-year renewal cycle for licenses and estimates the cost of shifting to online driver’s license renewal.

Click Here to download the full report