How to Not Fix the ID Problem

Several of the 9/11 terrorists had Virginia driver’s licenses in fake names. These were not forgeries; these were valid Virginia IDs that were illegally sold by Department of Motor Vehicle workers.

So what did Virginia do to correct the problem? They required more paperwork in order to get an ID.

But the problem wasn’t that it was too easy to get an ID. The problem was that insiders were selling them illegally. Which is why the Virginia “solution” didn’t help, and the problem remains:

The manager of the Virginia Department of Motor Vehicles office at Springfield Mall was charged yesterday with selling driver’s licenses to illegal immigrants and others for up to $3,500 apiece.

The arrest of Francisco J. Martinez marked the second time in two years that a Northern Virginia DMV employee was accused of fraudulently selling licenses for cash. A similar scheme two years ago at the DMV office in Tysons Corner led to the guilty pleas of two employees.

And after we spend billions on the REAL ID act, and require even more paperwork to get a state ID, the problem will still remain.

Tags: 9/11, crime, economics of security, fraud, ID cards, identification, insiders, security theater, threat models, trust

Posted on July 19, 2005 at 1:15 PM • 48 Comments

Comments

Eric K. • July 19, 2005 1:32 PM

Please, Bruce… just once, have an article on HOW TO fix something security related.

It seems like all you do anymore is critique others on HOW NOT TO handle security.

We’re not going to get there any faster if security consultants just watch what we do and say nothing but “Nope, that’s not it, try again.”

jayh • July 19, 2005 1:42 PM

Non-thinking is the standard procedure.

A friend of mine who doesn’t drive has a state issued age ID for puchase of tobacco and alcohol.

Her local stored stopped selling her cigarettes when her ID expired, I can think of no reason why a person who was old enough yesterday is suddenly not old enough today.

But the drones just mechanically move ahead… so much easier than thinking.

blankmeyer • July 19, 2005 1:47 PM

@ Erik

I think inherrent in his criticism of the Real ID program is his suggested solution – don’t spend money changing the system completely, find a way to keep employees honest. Granted that’s not a specific solution, in that he does not tell us how to keep the employees honest, but it does identify the problem correctly.

xr • July 19, 2005 1:51 PM

@ Erik

The last time I checked, you’re supposed to hire a consultant first, and then they provide you with their services.

N Ki • July 19, 2005 2:06 PM

Officials in the business of using their judgment to control access to something valuable will take bribes. You can watch them closely and punish them severely, but that quickly reaches the zone of diminishing returns.

Nobody wants to sell a driver’s license to a terrorist, but they’re perfectly willing to sell to illegal immigrants. That’s because terrorists are bad and scary people, but illegal immigrants are just people the system screws over as a matter of policy. Getting rid of illegal immigration by making immigration legal and letting anyone get a driver’s license who wants to (so long as they identify themselves accurately) will drastically change the balance of incentives.

Of course, having a driver’s license in your own name doesn’t mean you’re not a terrorist. But if you want to raise that particular bar, the very real needs of huge numbers of illegal immigrants are going to make it unreasonably hard until you solve that problem.

Tanuki • July 19, 2005 2:27 PM

Perhaps if we adopted a Chinese approach to dealing with corrupt public officials who sell bogus IDs then the problem would be lessened? Unfortunately I fear that in the Developed World™ the offender’s estate might complain about being billed for the bullet.

jp • July 19, 2005 2:31 PM

Eric K:

It seems part of the issue is the bizarre belief in government (and in the general population) that doing something new is always preferable, from a security standpoint, to keeping things the same. Bruce routinely points out the fallacies of this logic, and that is a Very Good Thing.

JD • July 19, 2005 2:35 PM

“Getting rid of illegal immigration by making immigration legal….”

The only way I can make sense of that is that you would simply open the border to anyone who wants to walk in. Or??

JD • July 19, 2005 2:38 PM

@Erik

Sometimes the first step in getting security done right is to free up the resources being wasted on stupid “security.” Keep putting the spotlight on them, Bruce.

Davi Ottenheimer • July 19, 2005 2:45 PM

Ouch. The Virgina state system was so egregiously abused for illegal gain, over the protests of their own auditors, this does not surprise me.

Take a look at the news in 2002 when “Federal agents swarmed into Arlington yesterday and shut down a massive immigration fraud scheme that allowed thousands of illegal immigrants to obtain permission to work in the United States — and made millions of dollars for an Arlington lawyer and his colleague — prosecutors said.”

http://www.washingtonpost.com/ac2/wp-dyn?pagename=article&contentId=A59891-2002Jul24&notFound=true

The fault, it seems, was an absolute lack of ANY detective controls in the system for even the most obvious abuse(s):

“Investigators in Kooritzky’s case said they were amazed that neither the Virginia Employment Commission nor the U.S. Labor Department noticed the volume of applications coming in from individual restaurants. […] In each instance, the application said the potential cook would be paid $12.05 an hour, according to the affidavit written by Andrew H. Shea, a Labor Department special agent. When Shea visited the restaurants, managers at each said they had not filed for labor certifications and that they don’t pay starting cooks that much.”

And to top it all off, how bad was the abuse and who found it?

“Of the nearly 2,700 applications filed by Kooritzky since January 2001, Shea wrote, he had investigated 1,436 and ‘did not find a single legitimate application.’ The inquiry was launched last spring after the Labor Department accidentally sent a certification to a Chili’s restaurant, rather than Kooritzky, and the store manager notified authorities.”

I like that. The Labor Department “accidentally” verified a certification. Talk about a lack of integrity…

Alas, that was in early 2002, five months after the Sept 11 hijackers had paid a stranger only $100 to hand them “proof” for IDs in Virgina.

I hate to use the word “trade-offs”, but the most disturbing aspect of all this is the apparent lack of a wholistic view that will allow the US to process immigration efficiently enough to support economic needs (as well as the immigrants themselves, of course) while still providing security that is meant to catch and completely deter illegal acts (not just raise the cost of illegally-obtained IDs from $100 to $3500).

Daedala • July 19, 2005 2:46 PM

When I first read this, I wondered what was wrong with requiring “more paperwork” and making IDs harder to process. Then I realized you meant more documents on the part of the person being issued the ID. If the DMV had instead focused on greater accountability and auditing of the person issuing the ID, that might actually have helped.

I have no idea what VA is using now to track and monitor who issues what IDs. It could be that it’s not necessary to improve this — maybe they’re catching all the frauds in a reasonably timely fashion — but I’ll bet that it could stand a review.

JD • July 19, 2005 2:47 PM

My Comparative Resource Allocation Program (CRAP) reveals that if just 21% of the resources wasted on security idiocy were used intelligently instead, we would all be 76% safer.

Bruce Schneier • July 19, 2005 3:12 PM

“Please, Bruce… just once, have an article on HOW TO fix something security related.

“It seems like all you do anymore is critique others on HOW NOT TO handle security.

“We’re not going to get there any faster if security consultants just watch what we do and say nothing but ‘Nope, that’s not it, try again.'”

A couple of points. One, I do write about how to fix security I think it is broken. It’s often the same things over and over again, and I don’t like to repeat myself more than I have to. The new stuff is more often stupid than smart, so that’s what the blog ends up being about.

Fixing this problem is kind of obvious, and doesn’t make for good reading. Make it harder for a rogue employee to issue a fake ID. There are lots of strategies to do this, and I talked about them in my latest book Beyond Fear. But I’ll bet most readers of this blog can come up with them themselves.

And lastly, I’m not sure where the “there” is that you think we’re going. If we’re talking about terrorism, I think we should spend money on investigation and intelligence, and on emergency response. I think we should spend money on the things that work regardless of what the terrorists are planning, rather than things that work only if we correctly guess what the terrorists are planning — and the terrorists are unable to revise their plans in the face of reality. But I’ve said that again and again, too.

Bruce Schneier • July 19, 2005 3:15 PM

“‘Getting rid of illegal immigration by making immigration legal….’ The only way I can make sense of that is that you would simply open the border to anyone who wants to walk in. Or??”

“Legal” doesn’t necessarily mean “easy.” Driving a car is legal, but require a license. Many drugs are legal, but require perscriptions. I think our society, and our security, is better served by very open borders. That does not necessarily mean unguarded boarders.

Don • July 19, 2005 3:27 PM

I think providing “solutions” in this case would be hard given that the -problem- is not correctly identified. Examining the question of identifying people accurately should make one question why we need to identify someone accurately. Most of the 9/11 hijackers had no history of ‘evil’ behavior. What would identifying them correctly have bought us? Every one of those people could have been on those planes unarmed and we wouldn’t have had a problem either.

Given the relative difficult of disarming someone before they get on a plane compared to identifying them the smart move is to stop examining identity and expend that effort towards disarming them. But given that we’re haggling over the position of this particular set of deck chairs I think it’s reasonable for Bruce to go after the flaw in the solution rather than provide an alternate approach.

dbr • July 19, 2005 3:43 PM

Well, this all goes back to the question of whether knowing who someone is makes you safer. What definitely makes us less safe is believeing we know who someone is because of a piece of plastic or even a fingerprint. In the case of air travel, for example, why does anyone even care who gets on a domestic flight? So long as the cockpit is secured and no one has been allowed to put anything dangerous on the plane, why does it matter who is who? (The airlines care because they’ve convinced us that transferring tickets should cost us more money.)

And even on international flights, it shouldn’t be the airlines’ business who gets on– and the job of verifying identification should be left to the customs and immigration officials at the gates. The nonsense of planes being re-routed because a name is on a list is a complete waste of money, time and effort. If the “name” hasn’t been allowed to bring anything dangerous on board, then what’s the harm?

If our security rests on 100% trustworthy IDs, then it rests on sand. Even “biometric” ID won’t help if the database is corrupted through bribery or hacking or error or whatever else; or made to crash for a short time while a bad guy gets through. And as I read here, fingerprints can be faked with materials available at a hobby shop.

With REAL ID, the public’s trust in the IDs will only go up. I see this as a bad thing, but maybe that’s just me…

Don • July 19, 2005 3:51 PM

DBR – well, the ‘harm’ is that the No-fly list is a currently unchallenged way for the government to punish and control people it can’t pin an actual crime on so not constantly challenging people for their papers would dimish this avenue of control.

Davi Ottenheimer • July 19, 2005 4:27 PM

“I think our society, and our security, is better served by very open borders. That does not necessarily mean unguarded boarders.”

Bruce, you are right on target here. Although I think you meant borders. 🙂

The Virginia system of issuing identity papers and autorization repeatedly failed to catch violations because it was never setup properly to catch them in the first place (absent and/or deficient detective controls).

And now the wrong controls (preventative externally facing instead of internal) are being enhanced…it’s easy to see but hard to watch.

Nick • July 19, 2005 5:13 PM

REAL ID presumes the following:

Terrorists who are in the country illegally will be caught when they seek to obtain REAL ID’s.
Terrorists who are in the country illegally, but use forged ID’s will be caught the moment they show their ID, because REAL ID’s are so much more recognizable.
It is impossible to be a terrorist without using ID (legal or illegal).

Why does a terrorist have to be an illegal immigrant? Why do we continue to assume they are going to be Middle Eastern in appearance or name?

Think of it in terms of underage drinking -even strict enforcement of IDs has not eliminated the problem, because there are numerous ways around the ID requirement. Even a REAL ID wouldn’t change this.

Randall Munroe • July 19, 2005 5:16 PM

I can confirm that you need a silly set of paperwork to obtain a license; we’d misplaced my birth certificate and for some reason didn’t have the other item, and despite my expired license, social security card, draft card, and a lonnng list of other documents, I had to spend weeks waiting for Pennsylvania to dig a copy certificate out of their records and send it down — weeks in which I couldn’t drive. The whole thing was stamped with notices of “since [post 9-11], the following things are required.” Things that aren’t too hard to forge. Just a pain to get honestly.

Dustin J. Mitchell • July 19, 2005 5:29 PM

Regarding jayh’s “A friend of mine who doesn’t drive has a state issued age ID for puchase of tobacco and alcohol. Her local stored stopped selling her cigarettes when her ID expired, I can think of no reason why a person who was old enough yesterday is suddenly not old enough today.”

Actually, this is exactly what we want to happen. Just as with CRLs and certificate expirations, independent credentials (those which are trusted prima facie, without communication with any other authoirty) are built to expire so that if they are lost or stolen, the damage is of a limited duration.

The process can also be used to require updates to the format — for example, the inclusion of additional anti-forgery devices.

Davi Ottenheimer • July 19, 2005 6:31 PM

@Nick

“Why does a terrorist have to be an illegal immigrant?”

They don’t, of course. The 19 hijackers on 9-11 had 63 valid driver’s licenses from various states including California, Florida, Virginia and New Jersey. They were all legally in the US and all had valid SSNs. That was supposedly the reason a federal standard was mandated by the 9-11 commission.

But REALID is generally expected to be a disaster precisely because it could be even more convincing as proof of somone’s “legal” status. I think the Register put it best here:

http://www.theregister.co.uk/2005/05/11/real_id_makes_terrorists_happy/

“They will become the most valuable fraudulent ID documents available, and the black market supplying them will flourish in unprecedented splendor. Criminals will get them. Terrorists will get them. Illegal aliens will get them. They’ll pay a lot more than they do today for identity documents, but these will be worth the expense. They’ll be really convincing.”

Alas, it all just supports Bruce’s sage point that security can not rely on identification.

Davi Ottenheimer • July 19, 2005 6:52 PM

Sorry, I accidentally left out the punch-line from the Register article (ominously titled “Congress passes Gestapo ID legislation”)…

“The dwindling privacy of US citizens will be eroded dramatically for no real gain in security. Much money will be spent, much privacy will be lost, and states will lose a significant measure of sovereignty, for no purpose but making a collection of middle-class control freaks in Congress feel important. The whole project would be a sad waste of money and effort, if it wasn’t actually harmful.

But, hey, terrorism…”

Rob Mayfield • July 19, 2005 7:18 PM

@Davi

The problem is we dont have privacy any more, or so we are told. One politician here in Australia who is pushing for a new version of the once defeated ‘Australia Card’ recently said on a radio interview “…people dont have privacy now anyway, I mean I know some would like to hang onto this mystical concept of privacy…”. The same politician seems keen to push for a national ID card that is everything – ID, drivers license, credit card, atm card, etc etc – one card fits all. (you can listen to the interview at http://www.abc.net.au/rn/talks/austback/ — “National Identification Card” 18 July 2005.). The comments are early in the segment, and are made by Queensland Premier Beattie. It’s worth a listen and a laugh – or a cry …

Some peoples understanding of the current situation and the issues is truly breathtaking. It seems the “Australia Card” is now firmly back on the agenda here and while there is healthy opposition to it, our federal government has absolute majority in both houses of parliament so process, logic and common sense will not necessarily prevail.

Davi Ottenheimer • July 19, 2005 8:21 PM

@Rob

The recently released “Review of the private sector provisions of the Privacy Act” does seems to suggest that Australian privacy is inconsistently enforced and sometimes lacking:

http://www.privacy.gov.au/act/review/index.html

But it is especially sad to hear that a government official would be so ignorant of his own country’s Privacy Charter, let alone the importance of a fundamental human right that is recognized in the UN Declaration of Human Rights, and the International Convenant on Civil and Political Rights, not to mention many other international and regional treaties.

You do still have a right to privacy. Specifically, the Australian Privacy Charter states that “A free and democratic society requires respect for the autonomy of individuals, and limits on the power of both state and private organizations to intrude on that autonomy. Privacy is a value which underpins human dignity and other key values such as freedom of association and freedom of speech. […] Privacy is a basic human right and the reasonable expectation of every person.”

http://www.privacy.org.au/About/PrivacyCharter.html

Dennis Bailey • July 19, 2005 8:21 PM

When it comes to finding flaws with security systems, one must mention the aforementioned Bruce Schneier who is first-rate. If I wanted someone to analyze security at my company, Bruce would be at the top of the list. And as original analysis and insight goes, Bruce is an outside-of-the-box thinker. I’m not sure if that was damning him with faint praise, but as one of his commenters mention tonight on his site, he is much more adept at poking holes than finding solutions, something I’ve said before. Even his response to the critic on his site is to “read my book.”

Anyone can find weaknesses in systems; the real challenge is coming up with solutions that are affordable, practical and effective. Schneier’s readers should demand that each time he critiques secure identification or other proposals he offer his own solution – something other than going to Amazon for a contribution to his retirement fund.

Now if you want a blog with solutions, even some you may disagree with, you can find it at http://www.opensocietyparadox.com. See my next post for answers to the insider driver’s license issue raised above.

Davi Ottenheimer • July 19, 2005 8:45 PM

@Dennis Bailey

“Anyone can find weaknesses in systems; the real challenge is coming up with solutions that are affordable, practical and effective.”

True it is a challenge, and thus solutions should not be required for each question or criticism that is raised. Otherwise, we discourage dialogue about systems that are flawed and do not yet have clear solutions.

“Schneier’s readers should demand that each time he critiques secure identification or other proposals he offer his own solution”

I completely disagree. Why should everyone be required to have a solution? What purpose does that serve other than censor people with legitimate criticisms?

The NASA investigations into Shuttle disasters have demonstrated that a culture that requires a solution to be proposed with every problem often does not find out about problems until it is too late. Thus it is better to encourage open dialogue about the uncertainties of a system and at least consider them, rather than to charge ahead with a false sense of certainty.

For more information, visit your favorite library (who says you have to buy books) and read “Waltzing with Bears” by DeMarco and Lister.

8====D ~ • July 19, 2005 9:02 PM

RFID piggy backing on sperm = the brave new world of nanotech ID microchip technology…

Can you say… JOYGASM?

I knew you could.

But think about it, that’s what it will come down to eventually.

Roy Owens • July 19, 2005 9:21 PM

Unintentional mistakes will be bad enough, but the REAL ID system, whatever it will be, must be deliberately insecure, so that government operatives can have ‘valid’ phony identification, both to impersonate other people and to prevent discovery of their real identities.

Rob Mayfield • July 19, 2005 9:26 PM

@Dennis Bailey – “Anyone can find weaknesses in systems”

If anyone could find weaknesses in systems then discussions like this would not exist. I believe one of the major problems we face is that the vast majority of people cant find weaknesses in systems, or simply dont want to, or dont care, or dont even know they should care – indeed in many cases dont even know a system with a (maybe potential) weakness exists that they should care about. This results in ignorance, apathy, blind trust, whatever – and then the few who can find the weakness exploit it. There is a ‘management philosophy’ that promotes ‘dont give me problems, give me solutions’ – but as Davi has already pointed out, this just serves to muffle the discussion of the problem/weakness, delaying and possibly precluding finding a solution.

Bruce Schneier • July 19, 2005 9:54 PM

“Even his response to the critic on his site is to ‘read my book.'”

One of the problems I’ve had being a pundit in this area is that there are few sound-bite solutions. There are book-length solutions, but no one wants to hear about them. “Read my book” isn’t my way of dissing the critic; it’s my way of saying that any summary isn’t going to do the topic justice.

Don • July 19, 2005 10:39 PM

Another problem with the claim that a solution should be provided in addition to identifying a weakness: often the correct action in response to finding weaknesses in a solution: don’t do it at all. This is most true with these ID issues, and showing repeatedly the problems with these “solutions” is a good way to support the argument.

jammit • July 19, 2005 11:26 PM

Perhaps if we get our identification tatoo’ed on our hand or forehead, and if anybody without this mark tries to purchase any item or service could be punished severly… just kidding. But what exactly does a more exact and correct ID do anyway? I have my drivers license in my hand right now, and I see where my lic#, picture, organ donor, etc are correctly filled out, but I can’t seem to find where you stamp it for “terrorist”. The license is absolutely correct yet I could still be a bad guy. The ID as I can see it is only marginally effective only as a token as proof of ability to drive (or get beer).

DarkFire • July 20, 2005 4:33 AM

@Bruce:

[SNIP]
I think we should spend money on the things that work regardless of what the terrorists are planning, rather than things that work only if we correctly guess what the terrorists are planning – and the terrorists are unable to revise their plans in the face of reality.
[SNIP]

This is absolutely correct. At the end of the day intelligence is neither a fixed science nor 100% reliable. Again it comes down to the unfortunate position of not being aware of what we don’t yet know… If that makes sense! Too much of the current anti-terrorist security measures are based on assumed lack of capability on the part of terrorists. This is a very dangerous assumption to make – sometimes it’s plain impossible to obtain intelligence of a given plot or capability. If it is then assumed that as we have no intelligence on that specific capability then it doesn’t exist, this leaves us gaping wide open to that particular attack methodology.

General defensive measures are vastly superior for the very reason that they benefit us no matter what attack methodology the terrorists adopt. I believe by far the best security trade off is to harden targets say 50% against all forms of attack rather than hardening targets 100% against a single specific form of attack because we don’t believe the terrorists are capable of any other forms of attack because we don’t know anything about them!

I agree with your position that we ought to be concentrating on intelligence, investigative capability and emergency response. The attacks on London last week showed that a well developed, well planned and well executed response plan works extremely well in the actuality of a terrorist attack.

If I may briefly comment on intelligence… This is far more of an art form that an exact science. I’m sure that every experienced CIA, KGB or MI6 operative who worked the cold war would agree with this. Unfortunately SIGINT can only get us so far, and is particularly vulnerable to being used in sting operations by the terrorists to reveal intelligence service tactics. The very best form of intelligence in HUMINT, boots on the ground. This is notoriously difficult in the case of extremist Islamic terrorism, but this is what we need to be concentrating on. A KH-11 will not tell us what is happening inside a random Madrassa on the Pakistan border. A source inside, however, will tell us everything we need to know.

[SNIP]
“I think our society, and our security, is better served by very open borders. That does not necessarily mean unguarded boarders.”
[SNIP]

Interestingly, this has been a point of view that has been advocated as far back as Machiavelli who stated that well monitored but open immigration renewed the population and enhanced creativity, wealth generation etc. etc.

Chris • July 20, 2005 6:27 AM

@Blankmeyer
“don’t spend money changing the system completely, find a way to keep employees honest.”

Maybe we could start with decent wages. Though I tend to think that most people are greedy enough that that wouldn’t work–certainly those who accept bribes are. That might just increase the cost of bribes.

blankmeyer • July 20, 2005 7:54 AM

@ Chris
“Maybe we could start with decent wages. Though I tend to think that most people are greedy enough that that wouldn’t work–certainly those who accept bribes are. That might just increase the cost of bribes.”

I don’t think higher wages would solve the problem for exactly the reason you point out. A terrorist who is trying to illegally acquire an ID will be funded enough to afford a bribe even if we double or triple the bribe threshhold.

David • July 20, 2005 11:19 AM

Sometimes we don’t need something new to help. Sometimes we just have to live with the fact that some people are bad and will do bad things. That’s life.

But when there is a truly good idea, then that should be implemented. But too often, we fall back on the easy “there ought to be a law” or some other action that increases complexity, but doesn’t solve the problem.

Just look at the current U.S. tax code, which is so complex that nobody, not even the IRS, has a firm grasp. How can a taxing plan be so complex that people cannot understand it? If it’s that hard, then people will not follow it. But each time we “fix” the code, it gets more complicated. Sometimes a fix requires getting rid of the current way and going simpler. It’s not always about making things harder.

This goes for security. Locking the cockpit door is probably enough to prevent another 9/11, unless the pilot is part of the plot. And it’s a good idea anyway since routine hijackings are also hard to do if you cannot reach the cockpit. This was rather simple and perhaps obvious. Yet we apparently needed a Patriot Act, new ID systems,sniffer equipment etc. to solve the terrorist problem.

Tim Vail • July 20, 2005 11:24 AM

@blankmeyer
“I don’t think higher wages would solve the problem for exactly the reason you point out. A terrorist who is trying to illegally acquire an ID will be funded enough to afford a bribe even if we double or triple the bribe threshhold.”

That does not mean that higher wages can’t be part of the solution. People who are pressed for money, have needs are much more likely to accept bribes, and get “creative” in finding money. Most people would prefer to get their money legitimate ways, so if you increase their wages, it would help prevent those people from going bad. Those who are bent on doing bad things won’t be stopped by that mechanism, but if you carefully put audit and other effective security mechanisms in place, this can be a vital part of a system to keep people honest.

Brett • July 20, 2005 4:21 PM

@Tim

Exactly, you keep the honest man honest.

DarkFire • July 21, 2005 3:37 AM

@David:

“Locking the cockpit door is probably enough to prevent another 9/11, unless the pilot is part of the plot”

Very true. The pilot has now become the least secure part of the security of a given aircraft. For instance, what if terrorists gained controll of an aircraft and demanded access to the cockpit. The flight crew says “over my dead body” so the terrorists start to execute passengers… How many flight crews would still not allow access to the cockpit in order to preserve the life of their passengers? Probably not many.

The only way to combat this would be armed air marshalls, which of course are currently deployed on some UK and probably most US domestic flights.

Let’s not discount the human vulnerability factor…

Rich • July 22, 2005 4:17 PM

@Dustin J. Mitchell

on the expiry of ID…

A local columnist wrote about his experience trying to buy wine with an expired DL. He no longer drove, so he didn’t renew it. The clerk accepted that the person in the photo was indeed the person trying to buy the wine, and that the birthdate was several decades to the good, but since the card had ‘expired’ he refused.

The question is- what are we trying to protect by expiring the item. The person’s ability to drive might change, so we want that to expire. The person’s DOB however isn’t going to change.

The card isn’t a ‘license to buy alchol’- it’s a proof of DOB.

Bruce Schneier • July 22, 2005 4:47 PM

Try to board an airplane with an expired ID, and you’ll get the same treatment.

Yes, it makes no sense. But in some weird bizarro-world way, it does make sense. If you need a valid ID to fly, and an expired ID is no longer valid, then….

My guess is that, in the case of buying wine, it’s the lawyers that decided the rules.

piglet • July 22, 2005 4:56 PM

@jammit: “The license is absolutely correct yet I could still be a bad guy.”

The problem is here not that bad guys might get a licence, but that they might get it under a wrong name, or that they might get an ID to which they are not entitled. The solution in this case must be organisational. It mustn’t be possible for a corrupt (or maybe stupid) agent to provide somebody with an ID unless that person has been thoroughly authenticated and the legal requirements verified. So there must be systematic verification procedures that can’t be subverted by just one or a hand full of unreliable employees.

This won’t verify the holder of the ID as a good guy, just as the person he or she pretends to be.

piglet • July 22, 2005 5:06 PM

“Try to board an airplane with an expired ID, and you’ll get the same treatment. Yes, it makes no sense.”

I don’t agree, Bruce. If an expired ID were treated as if it were a valid one, there would be no point in having IDs expire. Either IDs should on principal never expire, or expired IDs should be treated as invalid. Whether the ID requirement in a given situation makes sense or not, is a separate question.

Bruce Schneier • July 22, 2005 5:29 PM

It makes sense for drivers licenses to expire, since the right to drive expires unless renewed. But when a drivers license is used as an age-verification mechanism, epiry is less valuable.

I wrote about this in Beyond Fear. Like everything else in security, it’s complicated.

Peter • July 28, 2005 11:43 AM

Here in Colorado, there were a number of rings broken up where they were selling driving licenses. The investigation started with a box of commercial driving license test forms being reported missing (the school that they were supposed to be issued to didn’t get them). Then it turned out that a number of the test forms were counterfeited. So they investigated every CDL issued in CO in the past few years. As part of this investigation, they uncovered a number of passenger car driving licenses wrongly issued. Gee, this license branch employee has issued a bunch of these duds, what else has this person done?

I think the final tally was that 4 or 5 rings were broken up, with hundreds of driving licenses issued to people who shouldn’t (by law) get them. Some were as simple as “go to office X and go to the only [race y] person and tell them that [name] sent you.”

Most of the driving licenses were issued to illegal immigrants, but many were issued to people who had their driving privileges taken away (like for too many DUIs), or who were incapable of passing the tests involved.

As long as driving licenses are used as IDs and as proof that you’re allowed to stay in the US, then they will continue to be purchased. All that RealID will do is to raise the cost. If getting rid of illegal immigration is your point, then you should hit the employers of them in the wallet, so hard that they won’t do it again. But that won’t happen because many of those companies hiring illegals are large campaign contributors.

ed • August 13, 2005 10:36 PM

Sadly, I am out of the loop regarding the Real ID legislation in the US, but as a PhD student in the UK, I deal with idiotic security BS every time I enter or leave the UK. Because of some bureaucrat in the NYC British Consulate Visa office lost the 2 of the pages of my paperwork ( loans statements), I was officially denied a visa the first time. While I easily fixed this by resending the same stuff, I will always have a student visa refusal on my record somewhere, and I will be on some watch list. When asked if i have ever been denied a visa, i tell the truth- “they lost my paperwork the first time around”…even once got a laugh back from the customs official- “they stink, don’t they?”

I have given up on this whole personal privacy thing, honestly- I live in London, and am monitored all day by CCTV cameras and a Tube pass all day, every day. That crap didn’t stop the terrorists here- some of them didnt even bother wearing hoods (to hide from cameras). This security upratcheting is a pain in the ass and mostly wrongheaded, but what can we do- join the ACLU, and we’re moved further up the troublemaker list!
I give up. I can’t wait until they round up troublemakers who post on anti-Real-ID websites like this. woohoo!

Kelton • October 20, 2007 12:11 PM

The ID problem is a symptom of a much bigger security problem.

What if you hired a security firm to protect your home and business only to find out that many of the employees of the firm, at the bequest of management, engaged in roughing-up employees and clients of other security firms? What if this firm was also regularly engaged in vigilante efforts to kill and brutalize criminals, thugs, and anyone who did not follow their own protocols of “security interest”. What if you knew that this security firm, as a result of decades of this behavior, had more enemies than friends?

Would you continue to hire them to protect your family if their security services were exposing you to additional risks that exceeded all the reasons you hired them?

The United States government enforces U.S. national security interest worldwide, staging CIA-led coups, intentionally collapsing governments and economies that do not fall in line, and generally threatening and harassing even the civilian populations of other countries. Do not be surprised when this behavior tends to bring more hazards back to the homefront.

I say that the solution is to just fire the neocons, interventionists, frenzied internationalists and others seeking global empire and similar goals. This will reduce the level of hatred and thirst for revenge, reducing the need for ever more extreme measures of domestic security.

How to Not Fix the ID Problem

Comments

Leave a comment Cancel reply