REAL ID Final Rule Published

Tuesday,
January 29, 2008

Part II

Department of
Homeland Security

rwilkins on PROD1PC63 with RULES_2

6 CFR Part 37
Minimum Standards for Driver’s Licenses
and Identification Cards Acceptable by
Federal Agencies for Official Purposes;
Final Rule

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

PO 00000

Frm 00001

Fmt 4717

Sfmt 4717

E:\FR\FM\29JAR2.SGM

29JAR2

5272

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

DEPARTMENT OF HOMELAND
SECURITY
Office of the Secretary
6 CFR Part 37
[Docket No. DHS–2006–0030]
RIN 1601–AA37

Minimum Standards for Driver’s
Licenses and Identification Cards
Acceptable by Federal Agencies for
Official Purposes
Office of the Secretary, DHS.
Final rule.

AGENCY:

rwilkins on PROD1PC63 with RULES_2

ACTION:

SUMMARY: The Department of Homeland
Security is establishing minimum
standards for State-issued driver’s
licenses and identification cards that
Federal agencies would accept for
official purposes on or after May 11,
2008, in accordance with the REAL ID
Act of 2005. This rule establishes
standards to meet the minimum
requirements of the REAL ID Act of
2005. These standards involve a number
of aspects of the process used to issue
identification documents, including:
Information and security features that
must be incorporated into each card;
application information to establish the
identity and immigration status of an
applicant before a card can be issued;
and physical security standards for
facilities where driver’s licenses and
applicable identification cards are
produced. This final rule also provides
a process for States to seek an additional
extension of the compliance deadline to
May 11, 2011, by demonstrating
material compliance with the core
requirements of the Act and this rule.
Finally, taking into consideration the
operational burdens on State
Departments of Motor Vehicles, this rule
extends the enrollment time period to
allow States determined by DHS to be
in compliance with the Act to replace
all licenses intended for official purpose
with REAL ID-compliant cards by
December 1, 2014 for people born after
December 1, 1964, and by December 1,
2017 for those born on or before
December 1, 1964.
DATES: Effective Date: This rule is
effective March 31, 2008. The
incorporation by reference of certain
publications listed in the rule is
approved by the Director of the Federal
Register as of March 31, 2008.
Compliance Dates: Extensions: As of
May 11, 2008, Federal agencies cannot
accept driver’s licenses or identification
cards for official purposes, as defined
herein, from States that have not been
determined by DHS to be in compliance

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

with the REAL ID Act unless a State has
requested and obtained an extension of
the compliance date from DHS. States
seeking extensions must submit a
request for an extension to DHS no later
than March 31, 2008. As of December
31, 2009, any initial extension will
terminate unless a State, no later than
October 11, 2009, submits to DHS a
request for an additional extension and
certification that the State has achieved
the benchmarks set forth in the Material
Compliance Checklist. As of May 11,
2011, driver’s licenses and
identification cards will not be accepted
from States that are not in full
compliance with the provisions of REAL
ID.
Enrollment: As of December 1, 2014,
Federal agencies cannot accept driver’s
licenses or identification cards for
official purposes, as defined herein,
from any individual born after
December 1, 1964, unless DHS has
determined that the issuing State is in
compliance with Subparts A through D
of this rule and the card presented by
the individuals meet the standards of
this rule. As of December 1, 2017,
Federal agencies will not accept any
State-issued driver’s licenses and
identification cards for official purposes
unless such cards have been issued by
States that have certified to DHS their
compliance with Subparts A through D
of this rule.
FOR FURTHER INFORMATION CONTACT:
Darrell Williams, REAL ID Program
Office, Department of Homeland
Security, Washington, DC 20528 (202)
282–9829.
SUPPLEMENTARY INFORMATION:
Abbreviations and Terms Used in This
Document
AAMVA—American Association of Motor
Vehicle Administrators
ACLU—American Civil Liberties Union
CAC—U.S. Department of Defense Common
Access Card
CDLIS—Commercial Drivers License
Information System
CHRC—Criminal History Records Check
CRBA—Consular Report of Birth Abroad
DHS—U.S. Department of Homeland
Security
DMV—Department of Motor Vehicles
DOS—U.S. Department of State
DOT—U.S. Department of Transportation
EAD—Employment Authorization Document
EDL—Enhanced driver’s license and
identification card
EVVE—Electronic Verification of Vital
Events
FOIA—Freedom of Information Act
IAFIS—Integrated Automated Fingerprint
Identification
ICAO—International Civil Aviation
Organization
ID—Identification Card
JPEG—Joint Photographic Experts Group

PO 00000

Frm 00002

Fmt 4701

Sfmt 4700

LPR—Lawful Permanent Resident
MRZ—Machine Readable Zone
NAPHSIS—National Association of Public
Health Statistics and Information
Systems
NASCIO—National Association of State Chief
Information Officers
NCSL—National Conference of State
Legislatures
NCIC—National Crime Information Center
NGA—National Governors Association
NPRM—Notice of Proposed Rulemaking
PII—Personally Identifiable Information
RFID—Radio Frequency Identification
SAVE—Systematic Alien Verification for
Entitlements
SEVIS—Student and Exchange Visitor
Information System
SSA—Social Security Administration
SSI—Sensitive Security Information
SSN—Social Security Number
SSOLV—Social Security On-Line
Verification
TIF—Tagged Image Format
TSA—Transportation Security
Administration
TWIC—Transportation Worker Identification
Credential
USCIS—U.S. Citizenship and Immigration
Services
WHTI—Western Hemisphere Travel
Initiative
Table of Contents
I. Background
II. Discussion of the Final Rule
A. Extension of Deadlines
B. Implementation Dates
C. Verification and Data Exchange Systems
Architecture
D. Marking of Compliant REAL ID
Documents
E. Prohibition on States Issuing Real ID
Cards to Persons Who Hold a Driver’s
License in Another State
F. Western Hemisphere Travel Initiative
III. Section-by-Section Analysis of the Final
Rule
IV. Discussion of Comments
A. General Comments on the Proposed
Regulation
B. Scope, Applicability, and Definitions
C. Compliance Period
D. Privacy Considerations
E. State to State Database Queries
F. Document Standards for Issuing REAL
ID Driver’s Licenses and Identification
Cards
G. Exceptions Processing for Extraordinary
Circumstances
H. Temporary or Limited-Term Driver’s
Licenses and Identification Cards
I. Minimum Driver’s License or
Identification Card Data Element
Requirements
J. Validity Period and Renewals of REAL ID
Driver’s Licenses and Identification
Cards
K. Source Document Retention
L. Database Connectivity
M. Security of DMV Facilities Where
Driver’s Licenses and Identification
Cards are Manufactured and Produced
N. State Certification Process; Compliance
Determinations

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
O. Driver’s Licenses and Identification
Cards that Do Not Meet the Standards of
the REAL ID Act.
P. Section 7209 of the Intelligence Reform
and Terrorism Prevention Act of 2004
Q. Responses to Specific Solicitation of
Comments
V. Regulatory Analyses
A. Paperwork Reduction Act
B. Economic Impact Analyses
C. Executive Order 13132, Federalism
D. Environmental Impact Analysis
E. Energy Impact Analysis
F. Executive Order 13175, Tribal
Consultation

I. Background
A. Statutory Authority and Regulatory
History
This final rule establishes minimum
standards for State-issued driver’s
licenses and identification cards that
Federal agencies can accept for official
purposes on or after May 11, 2008, as
required under the REAL ID Act of
2005. See, Public Law 109–13, 119 Stat.
231, 302 (May 11, 2005) (codified at 49
U.S.C. 30301 note) (the Act).
During the terrorist attacks on the
United States on September 11, 2001, all
but one of the terrorist hijackers
acquired some form of identification
document, some by fraud, and used
these forms of identification to assist
them in boarding commercial flights,
renting cars, and other necessary
activities leading up to the attacks. See,
The 9/11 Commission Report, Final
Report of the National Commission on
Terrorist Attacks upon the United States
(July 2004) (9/11 Commission Report),
p. 390. The 9/11 Commission
recommended implementing more
secure sources of identification for use
in, among other activities, boarding
aircraft and accessing vulnerable
facilities. In its report, the Commission
stated:

rwilkins on PROD1PC63 with RULES_2

Secure identification should begin in the
United States. The federal government
should set standards for the issuance of birth
certificates and sources of identification,
such as driver’s licenses. Fraud in
identification documents is no longer just a
problem of theft. At many entry points to
vulnerable facilities, including gates for
boarding aircraft, sources of identification are
the last opportunity to ensure that people are
who they say they are and to check whether
they are terrorists.

Id. at 390.
Congress enacted the Act in May
2005, in response to the 9/11
Commission’s recommendations.
Under the Act, Federal agencies are
prohibited, effective May 11, 2008, from
accepting a driver’s license or a Stateissued personal identification card for
an official purpose unless the issuing
State is meeting the requirements of the

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

Act. ‘‘Official purpose’’ is defined under
§ 201 of the Act to include access to
Federal facilities, boarding Federallyregulated commercial aircraft, entry into
nuclear power plants, and such other
purposes as established by the Secretary
of Homeland Security. Undoubtedly, the
most significant impact on the public of
this statutory mandate is that, effective
May 11, 2008, citizens of States that
have not been determined by DHS to be
in compliance with the mandatory
minimum requirements set forth in the
REAL ID Act may not use their Stateissued driver’s licenses or identification
cards to pass through security at
airports. Citizens in this category will
likely encounter significant travel
delays.
The Act authorizes the Secretary of
Homeland Security, in consultation
with the States and the Secretary of
Transportation, to promulgate
regulations to implement the
requirements under this Act. Section
205(b) of the Act further authorizes the
Secretary of Homeland Security to grant
extensions of time to meet the minimum
standards of the Act when States
provide adequate justification for
noncompliance. The Act does not,
however, give DHS the authority to
waive any of the mandatory minimum
standards set forth in the Act. Those
mandatory provisions are set forth
below.
Section 202(b) of the Act directs that
REAL ID-compliant licenses and
identification cards must include the
following information:
(1) The person’s full legal name, date
of birth, and gender;
(2) The person’s driver’s license or
identification card number;
(3) A digital photograph of the person;
(4) The person’s address of principal
residence;
(5) The person’s signature;
(6) Physical security features designed
to prevent tampering, counterfeiting, or
duplication of the driver’s licenses and
identification cards for fraudulent
purposes; and
(7) A common machine-readable
technology, with defined minimum
elements.
Section 202(c) of the Act also
mandates certain minimum standards
that States must adopt when issuing
driver’s licenses and identification cards
intended for use for official purposes
(referred to as REAL ID-compliant
cards). Those standards include, but are
not limited to, the following:
• The State shall require, at a
minimum, presentation and verification
of (1) A photo identity document
(except that a non-photo identity
document is acceptable if it includes

PO 00000

Frm 00003

Fmt 4701

Sfmt 4700

5273

both the applicant’s full legal name and
date of birth); (2) documentation
showing the applicant’s date of birth; (3)
proof of the person’s Social Security
Number (SSN) or verification that the
applicant is not eligible for a SSN; and
(4) documentation showing the
applicant’s name and address of
principal residence. § 202(c).
• The State shall require valid
documentary evidence that the
applicant is lawfully present in the
United States. Such evidence shall
include documentary evidence that the
applicant: (1) Is a citizen or national of
the United States; (2) is an alien
lawfully admitted for permanent
residence or temporary residence in the
United States or pending application for
same; (3) has conditional permanent
resident status in the United States or
pending application for such status; (4)
has an approved application for asylum
in the United States, a pending
application for asylum, or has been
admitted to the United States in refugee
status; (5) was lawfully admitted to the
United States using a valid, unexpired
nonimmigrant visa; (6) has a pending or
approved application for temporary
protected status in the United States; or
(7) has approved deferred action status.
§ 202(c)(2)(B).
• States must establish procedures to
verify each document required to be
presented by the applicant. The State
also shall have entered into a
memorandum of understanding (MOU)
with DHS to use the Systematic Alien
Verification for Entitlements (SAVE
system) to verify the lawful status of an
applicant, other than a U.S. citizen.
§ 202(c)(3)(C).
• States also must confirm with the
Social Security Administration (SSA)
that the SSN presented by an applicant
(as required under § 202(c)(1)(C)) is
registered to that person. § 202(d)(5).
• States must ensure the physical
security of facilities where driver’s
licenses and identification cards are
produced; and the security of document
materials and papers from which
driver’s licenses and identification cards
are produced. § 202(d)(7).
• All persons authorized to
manufacture or produce cards to
appropriate security clearance
requirements. § 202(d)(8).
• Physical security features on the
driver’s licenses and identification cards
designed to prevent tampering,
counterfeiting, and duplication of the
documents for a fraudulent purpose.
§ 202(b)(8).
The Act also permits a State otherwise
in compliance with the Act to issue
driver’s licenses and identification cards
that do not conform to the Act’s

E:\FR\FM\29JAR2.SGM

29JAR2

5274

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

requirements. See § 202(d)(11). Federal
agencies, however, cannot accept such
driver’s licenses and identification cards
for an official purpose and States must
ensure that such cards or licenses must
state on their faces that a Federal agency
may not accept it for an official purpose.
See § 202(d)(11)(A). States also must use
a unique design or color indicator so
that it is readily apparent to Federal
agency personnel that the card is not to
be accepted for an official purpose. See
§ 202(d)(11)(B).
The Act requires DHS to determine
whether a State is meeting the Act’s
requirements based upon certifications
submitted by each State in a manner
prescribed by DHS.
II. Discussion of Final Rule
DHS published an NPRM on March 3,
2007, proposing requirements to meet
the minimum standards required under
the Act. The proposed requirements
included information and security
features that must be incorporated into
each card; application information to
establish the identity and immigration
status of an applicant before a card can
be issued; and physical security
standards for facilities where driver’s
licenses and identification cards are
produced. For additional information,
please see the NPRM at 72 FR 10820.
DHS received over 21,000 comments
on the NPRM and supporting regulatory
evaluation during the sixty-day public
comment period for this rulemaking
action. Responses to those comments
are set forth in Section IV of this final
rule. This final rule implements the
requirements of the Act, but with
significant changes from the NPRM as a
result of public comment, as discussed
below.
As discussed above, effective May 11,
2008, Federal agencies are prohibited
from accepting for official purposes
state-issued driver’s licenses or
identification cards unless an issuing
State certifies, and DHS determines, that
it has met the mandatory minimum
requirements of § 202 of the REAL ID
Act. Several States have implemented—
or are working to implement—
legislation prohibiting their
Departments of Motor Vehicles (DMVs)
from complying with the requirements
of the Act or any related implementing
regulations issued by DHS. DHS wants
to make clear that effective May 11,
2008, individuals from States who have
not obtained an extension of the
compliance date from DHS, or who have
not submitted a Compliance Package to
DHS under the deadlines provided in
this final rule, will not be able to use
their State-issued license for federal
official purposes, including for

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

identification to board a commercial
airplane. Residents of States that do
choose to comply, however, through
submission of their Compliance Plan or
a timely-filed request for an extension,
will be able to continue to use their
current license to board commercial
aircraft (and for other official purposes)
through December 1, 2014. Effective
December 1, 2014, Federal agencies will
refuse to accept non-REAL ID-compliant
driver’s licenses from all persons born
before December 1, 1964 (i.e. under the
age of fifty). Effective December 1, 2017,
anyone seeking to use a State-issued
driver’s license or identification card for
official purpose, including boarding of
commercial aircraft, must have a REAL
ID-compliant card.
A. Extension of Deadlines
Under section 205(b) of the Act, the
Secretary of Homeland Security is
authorized to grant extensions of the
May 11, 2008 compliance date to those
States who provide adequate
justification for their inability to comply
by the statutory deadline. On March 1,
2007, the Secretary of Homeland
Security announced, in conjunction
with the release of the NPRM, that the
Department would grant extensions to
all States requesting extensions, not to
exceed December 31, 2009. In the
NPRM, DHS proposed that States that
would not be able to comply by May 11,
2008, should request an extension of the
compliance date no later than February
10, 2008, and the proposal encouraged
States to submit requests for extension
as early as October 1, 2007. Under this
final rule, States must file requests for
an initial extension no later than March
31, 2008. That initial extension would
expire on December 31, 2009. Pursuant
to § 37.55 of this rule, States must
submit requests for extensions to the
REAL ID Program Office. Contact
information is provided in the ‘‘For
Further Information’’ section of this
rule. Requests for extension must be
submitted from the highest level
executive official in the State overseeing
the DMV to the REAL ID Program
Office.
DHS received numerous comments
from States arguing that the lack of a
centralized verification system would
make it impossible for most, if not all,
States to comply with the minimum
statutory requirements by December 31,
2009. DHS recognizes the difficulty that
many States may have in meeting the
statutory requirements under the Act,
but emphasizes that the Department has
a critical responsibility to ensure that
identification documents used to board
commercial air carriers or access
Federal buildings are secure documents

PO 00000

Frm 00004

Fmt 4701

Sfmt 4700

and adequately prevent persons from
circumventing Federal security and
screening requirements by use of false
or fraudulent identification.
In balancing the operational needs of
the States against the security
responsibilities of DHS and the Federal
Government, DHS has decided to allow
States to obtain an extension beyond
December 31, 2009. DHS, however, will
only grant a second extension to States
that demonstrate that they have
achieved certain milestones towards
compliance with the Act and the final
rule. States unable to demonstrate this
progress will not be able to receive an
additional extension. DHS has
identified eighteen milestones, captured
in the ‘‘Material Compliance Checklist,’’
that States must certify they have met in
order to obtain an extension of the
compliance deadline beyond December
31, 2009. The Material Compliance
Checklist is available at DHS’ Web site
at www.dhs.gov. The eighteen
milestones are all mandatory
requirements under the Act; one of the
most important ones, however, is the
State’s ability to verify that the
applicant is lawfully present in the
United States. Any second extension
will terminate effective May 11, 2011, at
which time, as discussed above, the
State must begin issuing fully compliant
REAL ID cards.
B. Phased Enrollment Periods
DHS initially proposed that States
determined by DHS to be in compliance
with the Act and the final rule would
have until May 11, 2013 to replace all
driver’s licenses and identification cards
with REAL ID-compliant cards. Under
the NPRM, licenses intended for Federal
official purposes issued by States on or
after May 11, 2008 and determined by
DHS to be in compliance with the Act
and this final rule would be REAL IDcompliant, and the State would have
worked to replace existing licenses,
through standard renewal or
replacement processes no later than
May 11, 2013. Until that phased-in
enrollment period concluded on May
11, 2013, Federal agencies would accept
from residents of compliant States both
REAL ID-compliant licenses dated on or
after May 11, 2008 or standard licenses
issued before May 11, 2013. The NPRM
also proposed the same phase-in period
for States requesting initial extensions
of the compliance date until December
31, 2009, i.e., States receiving an
extension would still have until May 11,
2013 to enroll their current drivers.
During the public comment period, a
number of States and State associations
noted that States obtaining an initial
extension of the compliance date until

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
December 31, 2009, would still be
required to enroll their existing driver
population (estimated to be
approximately 240 million) by May 11,
2013. This would essentially halve the
phase-in period and create an untenable
burden and increased costs on States
who were committed to complying with
the REAL ID requirements. Several
commenters suggested that DHS
consider a risk-based approach that
would permit States and DMVs to defer
enrollment of a proportion of the
population that statistically may present
a lower risk of obtaining false or
fraudulent identification to, among
other potential purposes, circumvent
Transportation Security Administration
(TSA) passenger screening procedures
and requirements or to access Federal
buildings with a false identification.
DHS recognizes the significant
operational impact on State DMVs if all
licenses issued by a State were required
to be REAL ID-compliant by May 11,
2008, or May 11, 2013; and believes that
an age-based approach is the best way
to balance operational concerns against
security concerns. DHS has considered
the best methodology to target
preventive efforts against an individual
attempting to fraudulently obtain an
identification document to gain access
to a Federal facility, nuclear facility, or
commercial aircraft. In the absence of
threat reporting about particular
individuals, to which the DMVs will not
have access, DHS has determined that
the most appropriate substitute criteria
to apply is age.
DHS has determined that the most
logical option to reduce the significant
operational burden on States is to allow
States to divide their license-bearing
population and re-issue REAL IDcompliant licenses through a twophased enrollment. This approach
would reduce the operational burdens
on States, which otherwise would have
to reissue licenses to the majority of
their license-bearing populations within
two years for States requiring and
obtaining extensions until May 11,
2011. DHS also has determined that a
phased enrollment based on age is
consistent with the intent of the REAL
ID Act by focusing the first phase of
enrollment on the population of persons
that may have a higher propensity to
obtain and use fraudulent identification.
To determine a logical age to use as
a cut-off point for a two-phased
enrollment, DHS determined, based on
comments received and statistical
analysis of incident reports obtained
from the TSA, that solely for purposes
of establishing an age-based enrollment
for compliance with the REAL ID Act,
the logical point of division would be to

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

allow States to defer enrollment for
persons over the age of fifty. The
statistical analysis supporting this
determination was conducted by DHS
utilizing TSA incident reports
identifying persons arrested or detained
for use of fraudulent identification at
TSA screening areas during the period
from October 1, 2004 through July 25,
2007. This analysis roughly indicates
that persons over the age of fifty were
less likely to be involved in TSA-related
law enforcement incidents involving
false or fraudulent identification. More
specific information on the
methodology underlying this
assessment is provided in Section IV.C.
below.
Accordingly, DHS, under this final
rule, has developed a phased enrollment
approach for States who have certified
compliance with the requirements of the
Act and this final rule, and have been
determined by DHS to be in compliance
with the Act and this rule. Under this
final rule, once a State certifies
compliance with the REAL ID Act and
this final rule, the State may focus
enrollment first on issuing REAL IDcompliant cards to individuals born
after December 1, 1964 (those who will
be less than fifty years of age as of
December 1, 2014, the date of full
compliance). States may delay the full
enrollment of persons born on or before
December 1, 1964, for three additional
years, until December 1, 2017.
DHS believes that this approach
balances the security objective of
improving the reliability of
identification documents presented for
official purposes, including the
boarding of commercial aircraft, with
the needs of the States to spread out
their compliance costs over a greater
period of time and to obtain the
necessary legal and budgetary approval
from within their States to comply with
the regulations. DHS also notes that
States will be able to reduce their
overall compliance costs based on
phased enrollment approach. The
economic analysis is presented in
section V. of this rule.
C. Verification and Data Exchange
Systems Architecture
The REAL ID Act requires States to
verify supporting documents with the
issuing agency. Because our population
moves freely among the States, each
State will need the capability to verify
documents from issuing agencies in all
other States. Although the Act places
this burden on the States, DHS has
worked to consider several technical
solutions that would provide States
with this capability. DHS has initiated
a verification systems design project to

PO 00000

Frm 00005

Fmt 4701

Sfmt 4700

5275

define the requirements for the optimal
system for REAL ID. DHS is working
with the American Association of Motor
Vehicle Administrators (AAMVA), the
Department of Transportation (DOT),
the Social Security Administration, the
Department of State (DOS), the National
Association of Public Health Statistics
and Information Systems (NAPHSIS),
and State representatives to define
requirements for a ‘‘hub’’ based network
and messaging systems to support the
requirements of REAL ID. DHS is
assessing the extent to which the
current AAMVA network,
communications, and systems
architecture can serve as a platform for
deployment of REAL ID data
verification and State-to-State data
exchanges.
The backbone of this hub would be
AAMVAnet, the network system that
AAMVA operates to facilitate data
verification for State DMVs. DOT is
currently funding an ongoing project to
upgrade the capability of AAMVAnet by
building in such security features as
end-to-end data encryption and Federal
Information Security Management Actbased security standards. The DOTfunded project will potentially expand
AAMVAnet’s capability to provide the
capacity to handle the increased
transaction volume for the required
State-to-State transactions. Finally, the
AAMVAnet backbone resides on a
private network with no connectivity to
the Internet. It has been, and will
continue to be, a highly secure
transportation layer for all
communications between States and
agency databases.
With respect to data verification,
AAMVAnet already supports
verification of both social security
numbers (SSNs) and birth certificates.
These application systems enable States
to query the Social Security On-Line
Verification (SSOLV) database managed
by the Social Security Administration
(SSA) and the Electronic Verification of
Vital Events (EVVE) system owned and
operated by NAPHSIS. While 47 States
currently verify SSNs through
AAMVAnet, verification of birth
certificates is limited to those States
whose vital events records are available
online. In both cases only State DMVs
can initiate queries; personal data are
verified and not exchanged; and no
personal information is created,
modified, or stored as a result of the
transaction. Working with both SSA and
NAPHSIS, DHS is identifying
requirements for enhancements to both
application systems.
U.S. Citizenship and Immigration
Services (USCIS) is working to modify
the SAVE system to allow States to

E:\FR\FM\29JAR2.SGM

29JAR2

5276

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

facilitate their ability to meet the
verification requirements under the
§ 202(c)(3) of REAL ID Act, a
requirement that States routinely utilize
the SAVE system to verify the lawful
status of REAL ID card applicants.
Currently, a majority of States have
already entered into Memoranda of
Understanding with USCIS to access
and use SAVE, as required under
section 202(c)(3) of the Act. USCIS is
developing a standard user interface to
meet all State DMV business process
needs for immigration-related
transactions and to draft requirements
for a common messaging system that
takes advantage of the same AAMVAnet
standards and infrastructure that
support State DMV queries against
SSOLV, EVVE, and other Federal and
State databases.
DHS also is exploring the alternative
of using the Commercial Drivers
Licensing Information System (CDLIS)
as the baseline platform for supporting
the State-to-State data exchange
requirements of the REAL ID Act and
regulation. CDLIS currently supports
queries to every State DMV every time
an individual applies for a driver’s
license in any State or the District of
Columbia. CDLIS already meets the data
exchange requirements of REAL ID for
those drivers holding commercial
driver’s licenses. Moreover, CDLIS is a
secure, State-governed system that
stores the minimum amount of personal
information possible to facilitate the
routing of queries and responses
between States. DHS is considering an
effort to define system requirements for
REAL ID State-to-State data exchanges
based upon the CDLIS model or
platform. This project would define a
systems architecture for REAL ID Stateto-State data exchanges that would
leverage the ongoing CDLIS
modernization project led by the DOT.
DHS will work closely with DOT to
build upon current and planned systems
designs to meet the requirements of
REAL ID.
D. Marking of Compliant REAL ID
Documents
Section 202(d)(11) of the Act allows
States to issue, in addition to REAL IDcompliant licenses, identification cards
not intended to be accepted by Federal
agencies for official purposes. Under the
Act, however, any such card must
clearly state on its face that it may not
be accepted by any Federal agency for
federal identification or any other
official purpose; and States must use a
unique design or color indicator to alert
Federal agencies and other law
enforcement that it may not be accepted
for any such purpose. DHS will leave

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

the types of marking and unique
coloring to the discretion of the
individual States, subject to DHS
approval as part of the Compliance
Package to ensure that DHS officials,
such as TSA screeners, can adequately
distinguish between REAL ID-compliant
cards and those not intended for official
purposes.
Based on an analysis of feedback from
several commenters, DHS, however, has
determined it would be in the best
interest of the nation’s security for
States to place a security marking on
licenses and identification cards to
allow Federal agencies to more readily
determine which States are issuing
licenses or identification cards that are
REAL ID-compliant or have been
determined to be ‘‘materially
compliant’’ (including verifying that
REAL ID applicants are lawfully present
in the United States). DHS will work
with States concerning marking
compliant licenses and identification
cards that indicate whether the
document was issued in material
compliance of the Act’s requirements, or
in full compliance of the Act’s
requirements as set forth in Subpart E of
this rule.
E. Prohibition on States Issuing REAL ID
Cards to Persons Who Hold a Driver’s
License in Another State
Section 202(d)(6) of the Act requires
that States ‘‘refuse to issue a driver’s
license or identification card to a person
holding a driver’s license issued by
another State without confirmation that
the person is terminating or has
terminated the driver’s license.’’ In the
NPRM, DHS maintained that we are not
regulating the issuance of driver’s
licenses beyond that required under the
REAL ID Act, but encourage the policy
of ‘‘one driver, one license.’’ Following
comments on the rule, however, DHS
believes it is necessary to clarify that the
REAL ID Act mandates that a State
cannot issue a REAL ID license to a
person who is holding a license issued
by another State or to an individual who
already holds a REAL ID card. (A person
can, however, hold a REAL ID card and
another non-REAL ID, non-driver’s
license identification card). DHS,
therefore, revised § 37.33, moving that
provision to a separate section (§ 37.29),
to clarify and emphasize that a State
cannot issue a REAL ID card without
verifying that an applicant does not
hold another REAL ID card or a driver’s
license from another State, or if the
applicant holds another driver’s license,
that he or she is taking steps to
terminate that license. See § 202(d)(6) of
the Act.

PO 00000

Frm 00006

Fmt 4701

Sfmt 4700

F. Western Hemisphere Travel Initiative
Section 7209 of the Intelligence
Reform and Terrorism Prevention Act of
2004, as amended,1 requires the
Secretary of Homeland Security, in
consultation with the Secretary of State,
to develop and implement a plan to
require travelers entering the United
States to present a passport, other
document, or combination of
documents, that are ‘‘deemed by the
Secretary of Homeland Security to be
sufficient to denote identity and
citizenship.’’ This DHS and Department
of State (DOS) initiative is referred to as
the Western Hemisphere Travel
Initiative (WHTI). DHS and DOS have
issued several regulations implementing
WHTI travel document requirements at
air ports of entry, and proposing
documents acceptable for cross border
travel at land and sea ports-of-entry. For
additional information on the WHTI
rulemaking actions, please see 71 FR
68411 (Nov. 24, 2006) (final air rule)
and 72 FR 35087 (proposed land and sea
rule).
As part of WHTI, the Secretary of
Homeland Security has the authority to
designate alternative documents that
denote identity and citizenship that can
be used for cross border purposes at
land and sea ports-of-entry. In
determining which documents should
provide a convenient, low-cost
alternative for U.S. citizens, particularly
those residing in border states, DHS
notes that State DMVs are well
positioned to provide an enhanced
driver’s license (EDL) to meet this need.
DHS is coordinating efforts to ensure
that an EDL, developed to meet the
requirements of WHTI, will adopt
standards that REAL ID requires, as they
are defined through the REAL ID
rulemaking process. For an EDL to be an
acceptable WHTI document for land and
sea cross-border travel, it can only be
issued to U.S. citizens, denote such
citizenship on the face of the card, and
must include technologies that facilitate
electronic verification and travel at
ports-of-entry. DHS will continue to
work closely with interested states to
develop driver’s licenses that can meet
both REAL ID and WHTI requirements.
The requirements outlined above
constitute substantive changes between
the March 2007 proposed rule and this
final rule. A more robust discussion of
this final rule and DHS’s responses to
comments are set forth below.
1 Pub. L. 108–458, as amended, 118 Stat. 3638
(Dec. 17, 2004).

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
III. Section-By-Section Analysis of the
Final Rule
Section 37.1

Applicability

DHS added a reference to § 202(d)(11)
of the REAL ID Act to make it clear that
the provisions of this rule apply to
States who intend to issue driver’s
licenses or identification cards that can
be accepted by Federal agencies for
official purposes and that intend to be
determined by DHS to be in compliance
with section 202 of the REAL ID Act.

rwilkins on PROD1PC63 with RULES_2

Section 37.3

Definitions

DHS added a definition of ‘‘full
compliance’’ to clarify the relationships
between full compliance with the
requirements of Subparts A through D,
and ‘‘material compliance’’ with the
procedures in Subpart E that allow a
State to file for and receive an
extension.
DHS refined the definition of
‘‘covered employees’’ in this final rule
to clarify that employees refers to DMV
employees.
DHS added a definition of
‘‘duplicate’’ for driver’s licenses and
identification cards issued subsequent
to the original license or card bearing
the same information and expiration
date as the original.
DHS has modified the definition of
‘‘full legal name’’ to bring it closer to
existing name conventions used by the
Social Security Administration, the
Department of State, and other issuers of
source documents.
DHS has added the definition of
‘‘material change’’ to provide clarity for
States as to when an individual may be
required to make an in-person visit to a
DMV office to obtain an updated REAL
ID driver’s license or identification card
when certain information changes from
the time they obtained their previous
REAL ID document. For the purpose of
this final rule, a change of address of
principal residence does not constitute
a material change.
DHS has added a definition of
‘‘material compliance’’ as a basis for
establishing the benchmarks that DHS
will use to evaluate State progress
toward meeting the requirements of this
rule. States in material compliance with
Subparts A through D of this rule will
be granted a second extension until no
later than May 10, 2011 to meet all the
requirements of this rule.
DHS maintained the same definition
of ‘‘official purpose’’ as that proposed in
the NPRM and set forth in the REAL ID
Act; to mean ‘‘accessing Federal
facilities, boarding Federally-regulated
commercial aircraft, and entering
nuclear power plants.’’

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

DHS also added a definition for
‘‘personally identifiable information’’ as
it pertains to these rules and the REAL
ID Act.
DHS changed the definition of
‘‘principal residence’’ from the location
where a person has his or her true,
fixed, and permanent home and intends
to return, to the location where a person
currently resides even if this location is
temporary, in conformance with the
residency requirements of the State
issuing the driver’s license or
identification card, if such requirements
exist. DHS made this change in response
to comments that the prior definition
would unfairly prevent persons such as
military personnel or students residing
temporarily in a State from obtaining a
driver’s license or identification card
from that State.
DHS revised the definition of ‘‘sexual
assault and stalking’’ to incorporate the
meaning of these terms given by State
laws.
DHS broadened the scope of the term
‘‘State address confidentiality’’ to allow
States to cover not only victims of
violence or assault, but also ‘‘other
categories of persons’’ that may need to
have their addresses kept confidential.
DHS added a comprehensive
definition of the term ‘‘verify’’ to clarify
the scope of application in the rule. The
definition makes it clear that
verification includes two interrelated
procedures: (1) inspection to see if the
document is genuine and has not been
altered, and (2) checking to see that the
identity data on the document is valid.
Section 37.5 Validity Periods and
Deadlines for REAL ID Driver’s Licenses
and Identification Cards
The proposed language in § 37.5
required that all cards issued, reissued,
or renewed after May 11, 2008 had to be
REAL ID-compliant by May 11, 2013 in
order to be acceptable by Federal
agencies for official purposes. As
discussed in Section II above and the
responses to comments in Section IV
below, DHS has determined that the
following enrollment schedule will
apply under this final rule: (1) Effective
December 1, 2014, Federal agencies will
be prohibited from accepting Stateissued driver’s licenses or identification
cards for official purpose from
individuals born after December 1,
1964, unless the individual presents a
REAL ID-compliant card from a State
that has certified and that DHS has
determined compliance with the REAL
ID Act and this final rule; and (2)
effective December 1, 2017, Federal
agencies will be prohibited from
accepting for official purposes from any
individual (regardless of age) State-

PO 00000

Frm 00007

Fmt 4701

Sfmt 4700

5277

issued driver’s licenses or identification
cards that are not REAL ID-compliant.
Section 37.11 Application and
Documents the Applicant Must Provide
DHS proposed, in the March NPRM,
that States must maintain photographs
of individuals who applied for, but
ultimately were denied a REAL ID card
by the State, for up to one year.
However, DHS also proposed that States
must maintain photographs of persons
denied REAL ID cards based on
suspected fraud for ten years and reflect
in the State’s records that a driver’s
license or identification card was not
issued by the State because of
suspicions of fraud. In response to
comments, this final rule was amended
to provide a uniform photograph
retention provision of five years for
persons who are denied a REAL ID card,
regardless of the reason that the State
denies issuance of a REAL ID card. DHS
has also added a provision requiring
States to retain the photo for two years
after expiration of the card to allow
individuals to renew licenses after they
have expired.
The NPRM also proposed to require,
under § 37.11(b), that States retain with
applicant source documents the
required signed declaration that the
information presented by the applicant
is true and accurate. This final rule no
longer requires States to retain the
required declaration with the
applicant’s source documents, the
retention of which is mandated under
§ 202(d)(2) of the Act. Instead,
recognizing the operational burdens on
the States, DHS is exercising its
discretion on this matter to require only
that the declaration must be retained by
States consistent with applicable State
document retention requirements or
policies.
Under § 37.11(c), DHS has added a
provision that would allow DHS to
change the list of documents acceptable
to establish identity following
publication of a notice in the Federal
Register.
DHS also has provided States a
broader latitude to accept documents
other than documents issued by a
Federal or State-level Court or
government agency to establish a name
change. Moreover, where State law or
regulation permits, the State may record
a name other than that contained in the
identity document on the face of the
license or card as long as the State
maintains copies of the documentation
presented pursuant to § 37.31, and
maintains a record of both the recorded
name and the name on the source
documents in a manner to be
determined by the State.

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5278

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

The NPRM proposed, under
§ 37.11(e), that an applicant for a REAL
ID card must provide documentation
establishing a Social Security Number
(SSN) or the applicant’s ineligibility for
an SSN. This final rule amends that
proposed requirement to allow an
applicant, if a Social Security
Administration account card is not
available, to present any of the
following documents bearing the
applicant’s SSN: (i) A W–2 form, (ii) a
SSA–1099 form, (iii) a non-SSA–1099
form, or (iv) a pay stub bearing the
applicant’s name and SSN. A State,
however, must verify the SSN pursuant
to § 37.13(b)(2) of this final rule.
DHS has amended proposed § 37.11(f)
to give States more discretion in the
acceptance of documents required to
demonstrate the applicant’s principal
address by removing specific
requirements that documents used to
demonstrate address of principal
residence be issued ‘‘monthly’’ and
‘‘annually.’’
In response to comments regarding
demonstrating the applicant’s lawful
status in the United States, DHS has
amended § 37.11(g) with regard to
which identity documents may serve as
satisfactory evidence of the applicant’s
lawful status. While all identity
documents listed in § 37.11(c) must be
verified by the State in the manner
prescribed in § 37.13, State verification
of some of the identity documents also
provides satisfactory evidence of lawful
status. Therefore, if the applicant
presents one of the documents listed
under § 37.11 (c)(1)(i)-(viii)(except for
(v)), the issuing State’s verification of
the applicant’s identity in the manner
prescribed in § 37.13 will also provide
satisfactory evidence of lawful status.
State verification of the remaining
identity documents listed in § 37.11(c),
however, does not provide satisfactory
evidence of lawful status and the
applicant must provide additional
documentation of lawful status as
determined by USCIS.
In response to comments on the
exceptions process proposed in
§ 37.11(h), DHS has amended this final
rule to allow U.S. citizens to utilize the
process to prove lawful status. In
response to comments that it was
unrealistic and too costly to require
States to provide quarterly reports
analyzing the use of their exceptions
process, this proposed requirement has
been replaced with a requirement that
States must conduct a review of the
DMV’s use of the exceptions process
and submit the report to DHS as part of
their certification package per § 37.55.
Section 37.11(h) has also reduced the
information required to be maintained

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

by the State when the exceptions
process is used.
Section 37.13 Document Verification
Requirements
Based on numerous comments and
ongoing State DMV programs, the rule
now includes the provision that the
State must make reasonable efforts to
ensure that the person has not been
issued identification documents in
multiple or different names. Identified
by several responders as the top priority
for reducing the number of fraudulent
licenses issued, this requirement has
been reformulated and moved from
§ 37.11 to 37.13.
In response to concerns that a number
of the verification systems contained in
the proposal would not be operational
by the verification deadlines, the final
rule gives States more flexibility in
verifying documents and identity data.
DHS added language that provides
that nothing in this section precludes a
DMV from issuing an interim license or
a license under § 202(d)(11) of the Act
to permit an individual to resolve any
non-match issue, but clarifies that such
cards cannot be accepted for official
purposes.
Section 37.15 Physical Security
Features for the Driver’s License or
Identification Card
DHS has deleted the proposed card
design standards in response to
comments which stated that the
standards were an undue burden on the
States. DHS has added language that
States must conduct a review of their
card design and submit a report to DHS
as part of its certification package that
indicates the ability of the designs to
resist compromise and document fraud
attempts.
Section 37.17 Requirements for the
Surface of the Driver’s License or
Identification Card
In response to comments that some
States allow a name other than the full
legal name on the identity document to
be on the surface of the license, this
section has been amended to require full
legal name as demonstrated on the
applicant’s identity document, but an
individual may establish his or her
name with other documentation where
State law or regulation permits, as long
as the State maintains copies of the
documentation presented pursuant to
§ 37.31 and maintains a record of both
the recorded name and the full legal
name on the identity document in a
manner to be determined by the State.
Under § 37.17(d), the unique license
or card identification number must only
be unique to each license or card holder

PO 00000

Frm 00008

Fmt 4701

Sfmt 4700

within the State and not unique across
all the States and other covered
jurisdictions.
With regard to full facial digital
photographs pursuant to § 37.17(e), DHS
has clarified the discussion to bring it
into closer compliance with DHS,
Federal and national standards.
Language was added that allows
photographs to be in black and white or
color.
To provide States with greater
flexibility in protecting confidential
addresses, § 37.17(f) contains new
language that allows the display of an
alternative address on the license or
card, if a State permits this, and
acceptance of an administrative order
issued by a State or Federal court to
show that an individual’s address is
entitled to be suppressed. States may
also use an address convention used by
the U.S. Postal Service where a street
number and street name have not been
assigned.
Further, § 37.17(g) now requires that
States establish an alternative procedure
for individuals unable to sign their
names. The requirement to use the
Roman alphabet has been replaced with
use of the Latin alphabet which is more
common.
In response to several comments from
States and AAMVA that REAL IDcompliant documents should be marked
or ‘‘branded’’ as REAL ID-compliant,
DHS has added 37.17(n) which requires
that REAL ID-compliant licenses and
identification cards bear a DHSapproved security marking in
accordance with the level of compliance
with the Act.
Section 37.19 Machine Readable
Technology on the Driver’s License or
Identification Card
This section contains technical
conforming changes to reflect the
changes made in § 37.11(c)(2) allowing
a name other than the full legal name to
appear on the license or card if a State
law permits. State or territory of
issuance has been added to the MRZ
data fields to accommodate instances
where a State may not have a residency
requirement or may allow use of an outof-State address to receive a license.
Section 37.21 Temporary or LimitedTerm Driver’s Licenses and
Identification Cards
In response to comments that the term
‘‘temporary’’ may cause confusion
under current terminology practices
with some DMVs, this section adds new
terminology and now refers to such
licenses/cards as ‘‘limited-term or
temporary.’’ DHS also added language
that provides that the verification of

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
lawful status for such licenses/cards
may be through SAVE, or ‘‘another
method approved by DHS.’’

Section 37.29 Prohibition Against
Holding More Than One REAL ID Card
or More Than One Driver’s License

Section 37.23 Reissued REAL ID
Driver’s Licenses and Identification
Cards

In response to numerous comments to
clarify the ‘‘one driver one license’’
concept in the REAL ID rules, DHS has
created a stand-alone section, § 37.29,
that specifically states that an
individual may hold only one REAL ID
card, whether it is a REAL ID
identification card or a REAL ID driver’s
license. In addition, prior to issuing a
REAL ID driver’s license, a State that is
complying with REAL ID must check
with all other States to determine if the
applicant currently holds a driver’s
license or REAL ID identification card
in another State, and if so, the receiving
State must take measures to confirm that
the person has terminated or is
terminating the driver’s license or REAL
ID identification card issued by the
prior State pursuant to State law,
regulation or procedure.

In response to comments, § 37.23 now
provides that States may conduct a nonin-person (i.e., remote) reissuance of a
driver’s license or card if State
procedures permit the reissuance to be
conducted remotely, except that a State
may not remotely reissue a license or
card where there has been any material
change in information since prior
issuance.
Section 37.25 Renewal of REAL ID
Driver’s Licenses and Identification
Cards
Section 37.25(a)(2) adds language that
requires the States to reverify SSN
information to ensure that the
applicant’s information is still valid.
DHS has also added explicit language
requiring that the State must verify
electronically information that it was
not able to verify at a previous issuance
or renewal, if the systems or processes
exist to do so.

rwilkins on PROD1PC63 with RULES_2

Section 37.27 Driver’s Licenses and
Identification Cards Issued During the
Age-Based Enrollment Period
This section has been added to affirm
the acceptability of driver’s licenses and
identification cards issued, reissued, or
renewed prior to the end of the agebased enrollment period. For example,
if an individual is 60 years of age and
their license naturally expires in 2009,
the State may issue that individual a
license under that State’s current
practices, and that license will be
accepted for official purposes until
2017, after which time that individual
must present a license that complies
with this rule for that card to be
accepted for official purposes. As of
December 1, 2014, individuals born
after December 1, 1964 (that is, under
fifty years old on that date) must present
a REAL ID card when they present a
State-issued driver’s license or
identification for official purposes. As of
December 1, 2017, all individuals
presenting a State-issued driver’s
license or identification card for official
purposes must present a REAL ID card.
The new section reemphasizes that an
individual’s driver’s license will
continue to be accepted for official
purposes until the expiration of the
individual’s applicable enrollment
period.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

Section 37.31
Retention

Source Document

DHS has added language to § 37.31 to
reiterate the requirement that States
must protect any personally identifiable
information collected pursuant to the
REAL ID Act as described in the
Security Plan (§ 37.41).
In response to comments, DHS
deleted the following requirements from
this section:
• That States must replace black and
white imagers with color imagers by
December 31, 2011;
• That States using digital imaging to
retain source documents must use the
AAMVA Digital Exchange Program or a
standard that has interoperability with
the AAMVA standard;
• That all images must be linked to
the applicant through the applicant’s
unique identifier assigned by the DMV;
the amended requirement now states
that all images must be retrievable by
the DMV if properly requested by law
enforcement.
DHS has also added a provision that
allows States to record information from
birth certificates in lieu of retaining an
image or copy if State law permits and
if requested by the applicant. This will
protect medical and other personal
information not relevant to REAL ID.
Section 37.33

DMV Databases

DHS changed the title of this section
from ‘‘Database connectivity with other
States’’ to ‘‘DMV Databases.’’ This
section has also been amended to
require that the DMV database allow
capture of the full legal name and any
other name recorded under § 37.11(c)(2)
without truncation.

PO 00000

Frm 00009

Fmt 4701

Sfmt 4700

5279

Section 37.41 Security Plan
DHS amended this section to clarify
that each State submit a single security
plan to address DMV facilities involved
in the enrollment, issuance,
manufacturing and production of
driver’s licenses and identification
cards, rather than all State DMV driver’s
license/identification facilities as stated
in the NPRM. This change is in response
to comments that it does not enhance
overall security to require every DMV
office (which could be interpreted to
include administrative offices) to submit
a security plan and individual risk
assessments.
Furthermore, in response to
comments asking for clarification,
§ 37.41(b)(iii) now provides that the
release and use of personal information
must, at a minimum, be consistent with
the Driver’s Privacy Protection Act, 18
U.S.C. 2721 et seq.
This section of the final rule now
indicates that the fraudulent document
training requirement would be satisfied
by a fraudulent document training
program approved by AAMVA. DHS has
also deleted the requirements that the
security plan contain procedures to
revoke and confiscate driver’s licenses
or identification cards fraudulently
issued in another State, in response to
comments that States have no authority
to carry out such a requirement.
A new section has been added to
§ 37.41 to state that the Security Plans
contain Sensitive Security Information
and must be handled and protected in
accordance with 49 CFR Part 1520.
Section 37.43 Physical Security of
DMV Production Facilities
This section is unchanged.
Section 37.45 Background Checks for
Covered Employees
Section 37.45(d) has been amended to
recognize background checks that are
similar to those required under § 37.45
and that were conducted on or after May
11, 2006, and that the DMV does not
have to check references from prior
employers for individuals that have
been working with the DMV for at least
two consecutive years prior to the Act
taking effect. (The Act becomes effective
on May 11, 2008). Therefore DMVs
would not have to seek references from
prior employers of employees who have
been with the DMV consecutively from
May 11, 2006 to May 11, 2008. The final
rule clarifies that the waiver provision
in § 37.45(b)(1)(v) allows a waiver of
requirements for the determination of
arrest status and includes circumstances
where the individual has been arrested,
but no final disposition on the matter
has been reached.

E:\FR\FM\29JAR2.SGM

29JAR2

5280

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

In response to comments, DHS
deleted the requirement that States must
conduct a financial history check as part
of the background check of covered
employees.
Section 37.45 now requires that the
State confirm the employment eligibility
of the covered employee, rather than
lawful status through SAVE, and
recommends that the State participate in
the USCIS E-Verify program (or any
successor program) for employment
eligibility verification.
Section 37.51 Compliance—General
Requirements
DHS has modified this section in
response to many comments. DHS
recognizes that States will be unable to
meet all the requirements of this rule
beginning on January 1, 2010, the day
after the termination of the extension
period proposed by DHS in the NPRM.
For example, requirements for State
verification of source documents
depend upon the deployment of
electronic systems that have not yet
been developed. Therefore, DHS
proposes that States meeting key
benchmarks for progress toward
compliance with the REAL ID Act be
granted an additional extension until no
later than May 10, 2011 to meet all the
requirements of Subparts A through D.
States seeking a second extension would
submit a Material Compliance Checklist
to DHS no later than October 11, 2009,
documenting their progress in meeting
the benchmark requirements. States
meeting these benchmarks would also
be able to issue driver’s licenses and
identification cards bearing security
markings indicating that the license was
issued in conformity with REAL ID
standards.

rwilkins on PROD1PC63 with RULES_2

Section 37.55 State Certification
Documentation
The title of the section was amended
to reflect the changes to the certification
process discussed above. The required
contents of the State certification have
been amended in the final rule to delete
the requirement for a copy of all
statutes, regulations, and administrative
procedures and practices related to the
State’s implementation program. DHS
has amended the requirement that a
State’s governor certify compliance to
read that a State’s highest level official
with oversight responsibility over the
DMVs certify compliance. In addition,
the frequency of certification reporting
has been modified to be similar to the
three-year intervals required by several
Department of Transportation programs.
Thus, in accordance, § 37.57 ‘‘Annual
State Certifications’’ has been removed.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

Section 37.59 DHS Reviews of State
Compliance
DHS has rephrased the information
requirement in the section to require
any reasonable information pertinent to
determining compliance with this part
as requested by DHS. Also, DHS must
now provide written notice to the State
in advance of an inspection visit. The
final rule provides that, in the event of
a DHS preliminary determination that
the State has not submitted a complete
certification or that the State does not
meet one or more of the minimum
standards for compliance under this
part, DHS will inform the State of the
preliminary determination within fortyfive days. Finally, this section now
includes DHS procedures for reviewing
a Material Compliance Checklist as part
of the procedure for granting States an
additional extension until no later than
May 10, 2011.
Section 37.61 Results of Compliance
Determination
The final rule now states that DHS
will determine that a State is not in
compliance when it fails to submit the
certification as prescribed or to request
an extension as prescribed in the
subpart.
Section 37.63 Extension of Deadline
The NPRM was not clear on the
timing of submissions for requests for
extension. Although proposed
regulatory text stated that requests for
extension must be submitted no later
than October 1, 2007; the preamble
requested submission of compliance
plans and strongly encouraged ‘‘States
to communicate their intent to certify
compliance or request an extension by
October 1, 2007.’’ We clarify the
deadline for submission of requests for
extension in the final rule, providing
that requests for extension must be
submitted to DHS ‘‘no later than March
31, 2008.’’ DHS will notify a State of its
acceptance of the extension within
forty-five days of receipt.
This section now includes the
procedure for requesting an additional
extension until no later than May 10,
2011. States seeking an additional
extension shall submit a Material
Compliance Checklist to DHS no later
than October 11, 2009, documenting the
State’s progress in meeting certain
benchmarks. States meeting the
benchmarks included in this checklist
will be granted a second extension until
no later than May 10, 2011.
Section 37.65 Effect of Failure To
Comply With This Part
DHS amended this section to provide
that REAL ID driver’s licenses and

PO 00000

Frm 00010

Fmt 4701

Sfmt 4700

identification cards issued by the State
during the term of any extension will
continue to be acceptable for official
purposes until the card expires.
Section 37.67 Non-REAL ID Driver’s
Licenses and Identification Cards
This section was renumbered to
§ 37.71, consistent with the structure of
the Part. The section was also renamed
to ‘‘Driver’s licenses and identification
cards issued under § 202(d)(11) of the
REAL ID Act’’ to further clarify that
DHS interprets this section of the Act to
apply only to States that certify and
DHS determines are compliant with the
REAL ID Act, as defined by these
regulations, and that choose to also
issue driver’s licenses and identification
cards under the Act that are otherwise
not acceptable by Federal agencies for
official purposes.
IV. Discussion of Comments
During the sixty-day comment period,
DHS received over 21,000 comments on
the NPRM. DHS received numerous
requests to extend the comment period
past the sixty days provided in the
NPRM. DHS has carefully considered
the comments and determined not to
extend the comment period for the
NPRM. As discussed above, under the
REAL ID Act, Federal agencies will be
prohibited from accepting driver’s
licenses or other State-issued
identification cards from States that are
not in compliance with the
requirements of the Act by May 11,
2008, less than one year away. Given the
complexity of the Act’s requirements
and these implementing regulations,
extending the comment period beyond
sixty days would serve only to delay
issuance of this final rule and deprive
States of the information necessary for
their DMVs to begin preparations and
adjust their operations consistent with
the requirements of this final rule and
the Act. Further, in addition to the 60day comment period, DHS provided
several opportunities for additional
public participation through such
events as the May 1, 2007, public
meeting in Davis, California (with
participation also available via webcast);
and meetings with stakeholders. We
determined that the 60-day comment
period and additional DHS outreach
during the comment period provided
adequate time for the public to consider
and provide meaningful comment on
the NPRM.
We also received several comments
that were filed well past May 8, 2007,
the close of the comment period. As
discussed above, given the upcoming
May 11, 2008, compliance deadline and
the adequacy of the sixty-day comment

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
period and public outreach, DHS has
not accepted or considered comments
that were filed after the May 8, 2007
close of the comment period. Because
DHS did not extend the comment
period, allowing some commenters to
file late—or to provide late filed
supplements to their comments—would
disadvantage those commenters who
did not file late and would also have
preferred additional time to file
comments or amend the comments that
were filed within the deadline.
Comments that were timely filed, but
not processed immediately by DHS due
to technical errors by the submitter or
DHS, are not considered to have been
filed late and were considered in the
development of this final rule.
A. General Comments on the Proposed
Regulation

rwilkins on PROD1PC63 with RULES_2

1. General Comments in Support of the
Proposed Regulation
Comments: Several commenters
expressed general support for the
proposed rule. Commenters wrote that
the REAL ID program will provide a
measurable and positive impact on a
wide range of security matters, and that
the cost estimates, methods of
implementation, and the projected time
frames were reasonable. One commenter
wrote that REAL ID correctly specified
a set of performance standards rather
than listing static prescriptive
standards, and that enhanced document
security is essential to combat terrorists,
can help improve transportation safety,
and can combat identity theft or other
criminal acts.
Response: DHS agrees with these
commenters, and believes that States
that fully implement these rules will
improve national security by improving
the security and reliability of a key
document carried by many Americans.
Both the REAL ID Act and the REAL ID
regulations focus on improving the
reliability of State-issued driver’s
licenses and identification cards and
decreasing the likelihood that an
individual can fraudulently obtain an
identity document or alter a legitimate
identity document to create a false
identity. The availability of better and
more reliable security documents means
that government and law enforcement
officials have a greater opportunity to
prevent terrorists and other
unauthorized persons from gaining
access to commercial airplanes and
Federal facilities.
2. General Comments in Opposition to
the Proposed Regulation
Comment: Many commenters
expressed general opposition to the

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

REAL ID program. General comments
included the following: DHS
misinterpreted the REAL ID Act, the
proposed rule is incomplete and
problematic, adequate studies have not
been conducted to determine that the
program will work, the rule’s
requirements will lead to degradation in
the level of State DMV customer service,
the rule would harm citizens’ privacy,
and the rule requires additional Federal
funding. Many commenters wrote that
the rule fails to provide appropriate
security, utility, or privacy and one
commenter said the rule ‘‘is inadequate
to meet the intent of the REAL ID Act
and the needs of the states and citizens
of the U.S.’’ Another commenter wrote
that DHS ‘‘could have done a better job
of creating a regulatory framework that
does not increase the risk of identity
theft nor enable widespread
governmental and commercial tracking
of U.S. residents.’’ Several commenters
requested that DHS provide a revised
NPRM reflecting comments and that
DHS accept at least a second round of
comments before issuing a final rule.
Other commenters asked that public
advocacy groups and other stakeholders
be consulted to ensure the final rule
properly considers citizen rights and
interests. Several commenters,
including States, wrote that a secure
identity credential could increase fraud,
identity theft, and other forms of
misuse, including the ability to access
confidential information, and that many
security leaks would occur. Two
commenters said the Federal
government has an existing program, the
passport program, that does everything
the REAL ID is supposed to accomplish,
and that it makes sense to expand the
passport program rather than revamping
State driver’s license requirements.
Other commenters wrote that an
improved system of Social Security
number verification is a more efficient,
less intrusive system for work status
verification and driver’s license
eligibility.
Response: DHS appreciates the many
comments received; however, DHS
respectfully disagrees with the
comments generally opposing the REAL
ID program. DHS believes that both
DMVs and the American public will
welcome having a more secure and
reliable form of identification, and that
DMVs will take the necessary steps to
ensure that their customer service
efforts are not degraded as a result of the
regulations. DHS strongly disagrees with
the proposition that the rules will lead
to an increase in identity theft, harm
privacy, or enable the government to
track individuals in their daily lives. To

PO 00000

Frm 00011

Fmt 4701

Sfmt 4700

5281

the contrary, the rules create an
environment where it is far less likely
that an individual can fraudulently
obtain a State-issued identity document
using another person’s identity and
identity documents and minimizes the
possibility that one individual can
obtain identification documents in
multiple names and identities. The
privacy interests of driver’s license and
identification card applicants are
strengthened, rather than weakened,
since this rule requires all States to
protect the personally identifiable
information that DMVs collect from
applicants. Establishing minimum
standards for States to issue more secure
licenses does not confer any ability on
the government to monitor or track
anyone, although it does improve the
ability of the government and private
sector parties to rely on the identity
document an individual presents.
DHS does not believe that additional
rounds of comments on the
requirements proposed in the NPRM are
necessary before issuing this rule. Some
21,000 comments were filed in the
docket covering the full range of issues.
In addition, DHS hosted a town hall
meeting in California to hear directly
from the public and reconstituted the
groups that participated in the 2005
Department of Transportation-led
negotiated rulemaking committee in
order to gather input and comments
directly from those groups.
DHS does not agree that a passport
issued by the Department of State
fulfills the same function as a Stateissued driver’s license. Individuals who
have no intention of leaving the United
States do not need to obtain a passport
in order to enter another country or
reenter the United States. Any of these
same individuals who desire to drive
would need to obtain a driver’s license.
DHS also disagrees with the comment
that a Social Security number (SSN) is
an adequate substitute for the statutory
requirement that an individual have
lawful status in the United States. Mere
possession of a SSN cannot replace the
statutory requirement that States verify
an individual’s lawful status in the
United States. There are individuals
who are no longer lawfully present in
the United States who have SSNs.
3. Cost Considerations
Comment: Numerous commenters
questioned the anticipated costs of the
REAL ID requirements. Specifically,
commenters wrote that the costs of the
REAL ID program would be ‘‘huge,’’
‘‘exorbitant,’’ ‘‘significant,’’ or
‘‘excessive.’’ Some States wrote that
estimated costs for implementing REAL
ID were equal to or substantially

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5282

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

exceeded their current operating
budgets for motor vehicle licensing. One
State estimated its costs for verification
and re-verification will be over $100
million in the first year; another State
estimated its costs would be $19.5
million for initial expenses and $9
million a year for ongoing expenses.
Another commenter suggested that the
burden would be particularly heavy on
small States, which would be
overwhelmed by the volume of queries
they would receive each day from States
with large populations and which
would not have funds to improve their
systems to handle the query volume.
Commenters identified several features
of REAL ID implementation that they
believed would be the most costly,
including verification requirements; the
requirements for issuing driver’s license
and identification card renewals;
background checks for State personnel
issuing cards; the need to upgrade
computer systems; hiring additional
staff; and renegotiation of existing
contracts.
Response: DHS has examined both the
budgetary impacts and economic
impacts of the proposed rule and
understands the significance of these
costs for States. DHS has also reviewed
various options that would reduce the
disproportionate burden upon small
states but have not found a feasible
alternative that would provide the same
benefits but at a lower cost.
DHS has also reviewed many of the
high-cost options of the proposed rule
and has significantly reduced both the
infrastructure costs and the costs of
reenrollment for States. As stated in
other parts of this document, DHS
agrees with an age-based approach and
concludes that there is a higher risk of
individuals under age fifty obtaining
fraudulent identification than there is
for those over this age limit.
Comment: Commenters wrote that
DHS had overestimated the benefits of
REAL ID and that the potential benefits
did not justify the high cost of
implementation. One commenter stated
that cost estimates are low given that
DHS has ‘‘no clear idea of how to
implement the REAL ID Act’s dictates
and has made some unrealistic
calculations.’’
Response: DHS understands that the
benefits of the proposed rule on REAL
ID are difficult to quantify and that there
are some imperfections in the
methodology. Commenters stated that
DHS has overestimated the benefits
when in fact it developed a ‘‘break-even
analysis.’’ DHS estimated that if the
requirements of the proposed rule
lowered by 0.061% per year the annual
probability of a terrorist attack that

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

caused both immediate and longer run
impacts then the quantified benefits of
the REAL ID regulation would be
positive.
This ‘‘break-even’’ analysis was based
on the rule having an impact on the
annual probability of the U.S.
experiencing 9/11 type attacks in the ten
years following the issuance of the rule.
DHS believes that the probability and
consequences of a successful terrorist
attack cannot be determined for the
purposes of this analysis. However, it
was not necessary to assume that there
was (or is) a probability of being
attacked in any particular year. Instead,
the analysis examined the reduction in
the probability of an attack so that the
expected cost of REAL ID equaled the
expected value of the benefits. Since it
is extremely difficult to predict the
probability and consequences of a
hypothetical terrorist attack, DHS asked
what impact would the proposed and
final rule have to have on the annual
probability of experiencing a 9/11 type
of attack in order for the final rule to
have positive quantified net benefits.
The analysis does not assume that the
United States will necessarily
experience this type of attack, but rather
is attempting to provide the best
available information to the public on
the impacts of this rule.
Comment: Many commenters wrote
that the cost of REAL ID would be borne
initially by the States, and then passed
on to those States’ citizens in the form
of higher fees for driver’s licenses,
higher taxes, or reduced services.
Commenters wrote that higher fees
would be paid by persons who need
driver’s licenses but who do not fly,
enter Federal buildings, or go into
nuclear facilities. Another commenter
wrote that citizens would incur large
costs to acquire the source documents
needed to obtain REAL ID cards. One
commenter wrote that the costs of REAL
ID would drain resources from other
vital public services. One commenter
wrote lost income would be borne by
commercial drivers and motor carriers
domiciled in non-compliant States, and
that the costs to commercial drivers to
obtain new REAL ID commercial drivers
licenses may result in reduced trucking
services to Federal facilities. One
commenter wrote that the DHS cost
estimate of $7.88 billion over ten years
would amount to a cost of $96.25 per
REAL ID holder.
Response: DHS acknowledges the
concerns of the individuals who
commented that this rule will impose
significant costs and believes that a
large portion of the costs will be passed
on from the States to the States’ REAL
ID applicants in the form of higher fees

PO 00000

Frm 00012

Fmt 4701

Sfmt 4700

for driver’s licenses. But each citizen in
the United States, whether he or she has
a driver’s license or not will be
receiving security benefits as a result of
this rulemaking. For example, the 9/11
Commission believes that acceptable
forms of identification will help ensure
that people are properly identified. The
Commission’s report, which informed
the basis for the REAL ID Act of 2005
said that: ‘‘At many entry points to
vulnerable facilities, including gates for
boarding aircraft, sources of
identification are the last opportunity to
ensure that people are who they say
they are and to check whether they are
terrorists.’’
DHS agrees that some applicants
might incur added costs to acquire the
source documents needed to obtain
REAL ID cards but, overall, DHS has
attempted to minimize the potential
added costs while remaining true to the
intent of the Act. People are being
provided ample time to acquire any
source documents that they might not
have so the potential added costs will be
lessened should they take advantage of
this flexibility. Consequently, the added
costs are expected to be small.
With regards to commercial drivers
and motor carriers domiciled in noncompliant States, the commenter did
not provide any useful cost data that
could be included in the regulatory
analysis. This was probably due to the
fact that it is impossible to estimate at
this time how many states would choose
to not participate.
Comment: Several States wrote that
the costs of REAL ID would divert
money from other homeland security
projects whether or not the States
diverted a portion of the Homeland
Security Grant Program funding, as DHS
would allow them to do. States that
raised the possibility of diverting twenty
percent of their Homeland Security
Grant funds wrote that a diversion
would be impossible immediately as
funds were already committed to other
uses. One commenter called the use of
DHS grants for REAL ID ‘‘at best,
window dressing,’’ and another
commenter called it ‘‘an empty hole.’’
An additional commenter identified
training and equipment for rescue and
first responder personnel as areas likely
to suffer reduced funding. One
commenter wrote that if REAL ID
security measures ultimately have no
effect, those spent dollars would have
been spent more effectively in
maintaining and strengthening proven
security measures.
Response: DHS believes that some
commenters may have misunderstood
DHS’s announcement about the use of
State Homeland Security Grant Program

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
(SHSGP) funds for REAL ID purposes.
DHS did not suggest that SHSGP funds
would replace appropriated monies
from Congress to help the States
implement the rules and comply with
the REAL ID Act. DHS and the
Administration are continuing to work
with Congress on the availability of
additional funding to the States for
these purposes.
All homeland security funding
decisions require trade-offs among
various competing priorities given the
available funding. The 9/11 Commission
Report noted that fraudulently-obtained
identification is equivalent to a weapon
in the hands of a terrorist.

rwilkins on PROD1PC63 with RULES_2

4. Unfunded Mandate Reform Act
Comment: Numerous commenters
wrote that REAL ID is an unfunded
mandate. The American Association of
Motor Vehicle Administrators
(AAMVA) wrote that past and proposed
Federal budget submissions had fallen
far short of securing necessary funding
for both the Federal government and the
States to implement REAL ID. More
than twenty-seven States called for
Federal funding of the REAL ID
program. Two States suggested that
Federal funding for REAL ID not be in
the form of grants for which a State
would have to submit applications, but
rather be either a block grant or set-aside
match for State funds. AAMVA wrote
that because eighty percent of a SHSGP
funding must be passed along to local
governments, in fact a much smaller
percentage of available DHS funding
will be available to each State for REAL
ID implementation.
Response: As discussed elsewhere in
this preamble, DHS is adopting a more
flexible approach for States to
implement the requirements of REAL
ID, including a second extension period
and age-based enrollment. This
approach will permit States to spread
out implementation costs over a greater
period of time. Congress has
appropriated $40,000,000 in grant
funding to the States. These grants will
be made available to the States through
both categorical and competitive grants.
In addition, States may utilize up to
20% of their SHSGP funding. This
combination of funding, flexibility and
phasing provides the relief that States
and other commenters are seeking.
5. Privacy Concerns
Comments: Several States and many
other commenters expressed concerns
about threats to the privacy of State
residents who apply for REAL ID cards
once the requirements are implemented.
Commenters also expressed concern for
the privacy of DMV employees who

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

would be subject to background
screening. Some commenters wrote that
any privacy requirements must adhere
to those of the Driver Privacy Protection
Act and applicable State laws. Other
commenters urged DHS to encourage
States to meet agreed-upon privacy and
security requirements. Another
commenter asked that privacy and
acceptable use policies address State
DMV information systems, equipment,
employees, and contractors. One
commenter wrote that the regulations
omit crucial privacy and security
protections to the point that the
proposed rule conflicts with Federal
privacy and security principles. Several
commenters were concerned about
privacy protection for immigrants,
ethnic minorities, and others who might
be discriminated against based on use of
the REAL ID.
Response: DHS understands that
commenters have many concerns that
implementation of the REAL ID Act may
impact the privacy of driver’s license
and identification card holders and their
personally identifiable information.
DHS recognizes, however, the
importance of privacy protection and
has sought to address privacy in a
comprehensive manner. First, the final
rule requires a minimum of information
to be collected by the States to verify
identity for issuance of a license or
identification card and a minimum of
information to be printed on the card
and in the machine readable zone.
Second, the final rule requires the
States to file, as part of the certification
process, a security plan that explains
how the State will protect the
personally identifiable information
collected, stored, and maintained in
DMV records or information systems
including a privacy policy.
In addition to this rulemaking, DHS
intends to issue a set of Privacy and
Security Best Practices that are built on
the Fair Information Principles and
Federal Information Security
Management Act (FISMA) standards to
help guide the States in protecting the
information collected, stored, and
maintained pursuant to the REAL ID
Act.
DHS plans to include the following
elements in its Privacy and Security
Best Practices: Issuing a clear and
understandable privacy policy to each
card holder; providing individual access
and correction rights for card holders;
specifying the purpose for collecting
personally identifiable information in
the privacy policy and limitation of the
use to those purposes; limiting the
information collected for those
purposes; limiting disclosure of the
information except to a governmental

PO 00000

Frm 00013

Fmt 4701

Sfmt 4700

5283

agency engaged in the performance of
official responsibilities pertaining to law
enforcement, the verification of personal
identity, or highway and motor vehicle
safety, or a third party as authorized
under the Driver’s Privacy Protection
Act; requiring data quality standards
and security safeguards to protect
against loss or unauthorized access,
destruction, misuse, modification, or
disclosure; performing a Privacy Impact
Assessment (PIA) to identify and
analyze how personally identifiable
information related to implementation
of the REAL ID Act is collected, used,
maintained, and protected; and
establishing accountability for
compliance with the State’s privacy and
security policies to ensure that these
best practices are fully implemented.
Finally, DHS recognizes that States
will also be guided by their own privacy
laws, which may provide greater
protections and are not preempted by
the REAL ID Act.
6. Concerns With the REAL ID Act Itself
Comments: Many commenters wrote
that the REAL ID Act has deficiencies
that the regulatory process cannot cure.
One State asked DHS to work with
States to identify problematic statutory
components and to seek Congressional
amendments to facilitate a ‘‘rational and
funded approach for implementation.’’
Some commenters wrote that the rule
sets no clear minimum standards for
States to follow. A commenter wrote
that there were no hearings or Senate
floor debate on the REAL ID Act;
another commenter wrote that DHS held
only one town hall meeting before the
comment period ended. One commenter
asserted that the development process
did not recognize its tribal entitlement
to meaningful consultation regarding
the REAL ID regulations.
Response: DHS was charged to issue
regulations to implement the law that
Congress enacted. DHS held extensive
consultations with the States during the
development of the NPRM and during
the public comment period, and the
Town Hall meeting held in California
during the comment period was
published in the Federal Register and
available via the Web to a national
audience. Over 21,000 comments were
filed in the docket. While additional
individuals may have preferred to
express their comments orally at town
hall meetings, DHS believes that the
scope and breadth of the comments filed
adequately informed DHS on the issues
of concern to the commenters. DHS does
not believe that the tribal consultation
obligations required by Executive Order
13175 were triggered in this rulemaking,
as this final rule will not have a

E:\FR\FM\29JAR2.SGM

29JAR2

5284

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

substantial direct effect on one or more
Indian tribes and will not impose
substantial direct compliance costs on
Indian tribal governments. Further,
tribal governments will not be
substantially affected as tribal members
are licensed through State agencies.

rwilkins on PROD1PC63 with RULES_2

7. DHS Acting Outside the Scope of Its
Authority
Comment: Several commenters wrote
that DHS is acting outside the scope of
its authority, and cited several
examples, including requiring States to
conduct various document verifications,
requiring States to implement motor
vehicle facility security plans, and
requiring States to revoke licenses
collected by other States. Two States
commented that requiring background
checks for employees other than those
engaged in manufacturing REAL ID
cards was outside the scope of authority
and interferes with employee
collectively bargained rights. Several
commenters wrote that the REAL ID Act
constitutes a delegation of licensing
authority to DHS. Another commenter
wrote that Congress only intended to
exclude illegal aliens from eligibility to
obtain a REAL ID.
Response: The REAL ID Act provides
the Secretary of Homeland Security
with authority to issue regulations
necessary to implement the
requirements of the Act. DHS
understands that there is a balance
between Executive discretion in
interpreting the REAL ID Act through
regulation, while also respecting the
State’s autonomy to govern an
inherently State function—the driver’s
license issuance process. DHS has
attempted to preserve State autonomy
wherever possible, while remaining
consistent with the Act, and believes
these regulations represent a logical
interpretation of the Act and
Congressional intent.
8. Constitutional Concerns
Comment: Several commenters wrote
that requiring a REAL ID for access to
Federal courts may raise Constitutional
issues for litigants, jurors, attorneys,
witnesses, media, and the public.
Another commenter wrote that requiring
REAL ID for accessing Federal ports will
have consequences for intrastate
licensees attempting to conduct
business.
Response: DHS does not believe that
the REAL ID Act or the implementing
regulations will impede the public’s
Constitutional rights. Once REAL ID is
in effect, an individual presenting a
driver’s license to access a Federal
courthouse must use a REAL ID driver’s
license to do so. However, that

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

individual may present other
documents, or may not be required to
present identification at all, depending
on the courthouse’s pre-existing
identification policies.
Comment: Several commenters wrote
that the REAL ID rules would
impermissibly commandeer and coerce
State governments in service of a
Federal objective and would prohibit
Congress from exercising its Commerce
Clause powers. One commenter wrote
that courts have long recognized that
licensing of drivers is a traditional State
police, health, and safety function, and
under the Tenth Amendment, such
State authority generally is not subject
to encroachment by the Federal
government.
Response: DHS recognizes both the
important national interest in secure
identity documents and the Federalism
implications of the policies which
underpin this rule. Accordingly, DHS
has welcomed and encouraged State
participation in this process and, where
possible, drafted these rules in such a
way as to maximize State discretion.
Where the exigencies of national
security and the need to prevent
identity fraud have militated in favor of
a uniform national standard (e.g.,
baseline security features on identity
cards and background check
requirements), DHS has, as reflected
above, consulted with States in order to
ensure that the uniform standards
prescribed could be attained by the
States and would reflect the
accumulated security experience of
State motor vehicles administrations.
Comment: Some commenters wrote
that the REAL ID Act and regulations
violate the Constitutional right to travel
freely from one State to another by
denying citizens in non-compliant
States the right to board any plane,
interstate bus, or Amtrak train. Other
commenters wrote that government
initiatives conditioning the ability to
travel upon the ‘‘surrender of privacy
rights’’ require particular scrutiny. One
commenter wrote that the situation is
acute for residents of Hawaii or Alaska
who often have no choice but to travel
via Federally-regulated modes of travel.
Response: DHS does not agree that the
REAL ID Act will hinder individuals’
rights to interstate travel. The REAL ID
Act states that a Federal agency may not
accept State driver’s licenses or
identification cards for official purposes
unless a State is meeting the
requirements of the Act. At this time,
the definition of ‘‘official purposes’’
includes boarding Federally-regulated
commercial aircraft; no other form of
transportation is included. Moreover,
travelers will be able to use

PO 00000

Frm 00014

Fmt 4701

Sfmt 4700

identification other than a REAL ID
driver’s license to board an aircraft.
While Federally-regulated commercial
aircraft are a mode of transportation, the
Act only prohibit Federal agencies from
accepting a non-REAL ID license or card
where a State-issued driver’s license is
presented by the individual. Where
individuals are allowed to board aircraft
or enter Federal facilities with
documents other than a State-issued
driver’s license or identification (such
as a passport or military identification
card), neither the Act nor these rules
change those processes and procedures.
Further, an individual with a Stateissued non-compliant driver’s license or
identification card may travel interstate
or intrastate in a commercial motor
carrier, Amtrak train, ship, individual
automobile, or any other mode of
transport aside from Federally-regulated
commercial aircraft. These
transportation options illustrate that
individuals’ rights to travel are not
substantially impeded.
Comment: Several commenters and
States expressed concern with a State’s
lack of authority to request or demand
that other jurisdictions correct
erroneous records about individuals and
that there is no easily available process
for resolving errors. A number of
commenters wrote that the lack of a
process for correcting errors in the
REAL ID Act violates both procedural
and substantive due process under the
Fifth and Fourteenth Amendments. One
commenter expressed concern with the
requirements that licensing authorities
maintain for ten years the name and
photograph of individuals denied
licenses because of suspicion of
attempting to obtain a fraudulent
license.
Response: DHS recognizes that the
provision of redress is an important
element of any credentialing program.
Applicants need a process by which
they can access their records, correct
errors, and obtain due process if denied
a card. States already provide such a
redress process for driver’s license
applicants. Generally, State DMVs direct
applicants to the appropriate Federal
agency, SSA, to resolve SSN verification
issues or to USCIS to resolve
immigration status verification issues.
SSA and USCIS have redress programs
in place to assist individuals whose
records are incomplete or inaccurate.
State-to-State record checks are also
done routinely, and when an applicant
needs to access his or her out-of-State
DMV record, the applicant must make
the request directly to the State DMV.
DHS will work with the States to inform
the public of their ability to access and
correct DMV records as well as records

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
held in the various Federal data
verification systems used to implement
this rule.
The ten-year retention period
proposed in the NPRM for the
photograph and identity of individuals
denied a license has been reduced in the
final rule to five years. This limited
retention is necessary to enable State
DMVs to reduce the incidence of
individuals who shop among DMVs
until one issues a license.
Comment: Three commenters wrote
that there is no due process in
instructing DMVs to refer an applicant
to the local USCIS office when there is
a non-match through SAVE. There may
be no local USCIS office, and a noncitizen has no straightforward route to
review and correct their records and
USCIS lacks jurisdiction to correct
errors made by different immigration
agencies. One commenter wrote that
only through the FOIA process can an
immigrant gain access to his or her
immigration records, and that tens of
thousands of FOIA requests are
currently pending.
Response: DHS disagrees that there is
a lack of effective due process or redress
when there is a non-match through
SAVE. An individual who believes that
information about him or her in SAVE
is inaccurate, can schedule an
appointment online with USCIS at
www.uscis.gov and be assigned an
appointment at the appropriate USCIS
office based on the individual’s
residential zip code. These
appointments afford an opportunity to
meet with an Immigration Officer faceto-face to resolve any non-asylum
related issues relating to a current or
pending immigration case. Minimal
information, including an Alien
Registration Number or Receipt Number
is required to schedule an appointment.
Comment: Several commenters wrote
that REAL ID has the potential for
fostering discrimination, particularly
against non-citizens. One commenter
urged DHS to ensure REAL IDcompliant cards are all accepted
equally, without ‘‘geographic
discrimination.’’ One commenter wrote
that REAL ID will cause discrimination
against U.S. citizens who ‘‘look’’ or
‘‘sound’’ foreign. This commenter wrote
that DMV employees must make subtle
judgments about who is a citizen.
Another commenter wrote that noncitizens and foreign nationals who are
in the United States for work or study
will be singled out and that renewing a
document will be difficult because DMV
employees will not understand the
complexities of immigration law. One
commenter urged DHS to promulgate
rules prohibiting discriminatory

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

behavior and creating penalties for DMV
staff who discriminate against
individuals.
Response: DHS believes that the
States will take adequate measures to
prevent discrimination and is unable to
create private rights of action for the
behavior of DMV employees. DHS
disagrees that citizens will be treated
differently based on their ‘‘looks’’ or
‘‘sounds’’ since all persons seeking to
obtain a REAL ID-compliant driver’s
license or identification card have to
establish their identity, date of birth,
and lawful status in the United States.
Furthermore, State DMVs already work
with immigration documents and
questions of citizenship and
immigration status under their
applicable State laws and have
developed increasing familiarity with
this subject already, without evidence of
discriminatory practices in so doing.
9. REAL ID Will Not Make the Nation
Safer
Comment: Commenters wrote that
terrorist intentions cannot be predicted
based on identification and that REAL
ID will not prevent determined bad
actors from using a compliant REAL ID
to gain access to Federal buildings,
nuclear facilities, and aircraft. A number
of commenters wrote that it is not clear
whether REAL ID will enhance the
nation’s security or create new
opportunities for those seeking to
exploit the nation’s security.
Commenters also wrote that
centralization of personal data would
create a greater security risk and may
raise demand and value of a counterfeit
document. Some commenters wrote that
the proposed regulations would not
have prevented the 9/11 terror attacks
since all but one of the hijackers could
still have obtained a State driver’s
license. One commenter said that REAL
ID is predicated on a flawed belief that
only ‘‘outsiders’’ intend to harm the
United States, yet U.S. citizen
‘‘insiders’’ have committed terrorist
acts.
Response: The commenters are correct
that the REAL ID rules cannot
completely eliminate the possibility that
an individual will commit an act of
terrorism inside the United States.
However, by improving the security and
reliability of State-issued identification
documents, the rules substantially
increase the ability of the government
and law enforcement to identify with
greater accuracy an individual at a
check point or screening opportunity.
Furthermore, the rules minimize the
possibility of an individual possessing
multiple documents, as some of the 9/
11 terrorists did. The 9/11 Commission

PO 00000

Frm 00015

Fmt 4701

Sfmt 4700

5285

and Congress have concluded that this
ability may prevent or deter future acts
of terrorism.
It is incorrect to assume that the REAL
ID rules could have had no impact on
the 9/11 terror attack. As described in
great detail in the 9/11 Commission
Report, the ability of the terrorists to
easily obtain multiple, legitimate
identity documents facilitated their
ability to move about the country and to
board the ill-fated aircraft with minimal
scrutiny. Under this final rule, it will be
significantly more difficult for an
individual to use a false name or
provide fraudulent documents to obtain
an identification that can be used for
purposes of boarding a commercial
airplane. Therefore, the final rule makes
it less likely that a terrorist could
circumvent watch-list screening
processes and security procedures (as
upgraded or developed post-9/11) and
board a commercial airplane.
Further, several of the terrorists no
longer had lawful status in the United
States. Under the REAL ID Act and this
final rule, those individuals would now
be unable to obtain REAL ID driver’s
licenses or would only obtain a
temporary driver’s license that clearly
indicates on its face an expiration date
tied to the expiration of the holder’s
status.
10. REAL ID Will Result in Persons
Driving Without Licenses and Auto
Insurance
Comment: Several commenters wrote
that REAL ID, and the weeks it can take
to collect documents needed to replace
lost or stolen licenses, would result in
illegal immigrants driving without a
license and auto insurance, and this
would present health and safety risks on
the roadways.
Response: DHS does not believe that
the implementation of the REAL ID
requirements will result in persons,
particularly illegal aliens, driving
without a license and auto insurance
any more than may already be
occurring. Most States already require
the collection and submission of
particular documents in order to replace
lost and stolen licenses.
11. REAL ID Will Place a Heavy Burden
on State DMVs
Comment: Many States and AAMVA
wrote that if States are to maintain their
present levels of service while
incorporating REAL ID, they will need
to hire additional employees, increase
service hours, expand or increase
facilities to accommodate customer
volume, purchase additional equipment
to support personnel, create and
implement public education campaigns

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5286

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

to inform customers, and anticipate and
handle increases in customer inquiries.
The commenters recommended several
DHS actions, including coordinating
between DHS and DOT’s Federal Motor
Carrier Safety Administration (FMCSA)
to reassess their approach to funding
REAL ID requirements; prohibiting
Federal agencies from charging
transaction fees for verification;
coordinating among DMVs, the National
Association for Public Health Statistics
and Information Systems (NAPHSIS),
and State vital record agencies to
provide reliable data and acceptable
fees; requiring States to employ
electronic verification systems only as
they become available; and
consolidating and synchronizing system
development schedules. Other
commenters recommended changes to
the enrollment and renewal processes,
including allowing for waivers of
verification requirements for certain
categories of persons whose
identification had already been vetted
by the Federal government, allowing
transfers of authorization from State to
State of persons with valid REAL ID
identification cards, and exempting
certain segments of the population from
REAL ID requirements.
Response: Based on these comments,
DHS is taking several measures to
reduce the impact of the rule. First,
States meeting specific DHS
benchmarks for progress toward REAL
ID compliance will qualify for
additional extensions until no later than
May 10, 2011. Second, DHS is adopting
an age-based approach to REAL ID
implementation. The rule requires
individuals born after December 1, 1964
to enroll and receive REAL ID cards
prior to December 1, 2014, in order for
those cards to be accepted for official
purposes. Individuals aged fifty or older
on December 1, 2014 will not be
required to enroll until December 1,
2017. After December 1, 2017, all
individuals will have to possess REAL
ID cards in order for those cards to be
accepted for official purposes. This
timeline will substantially reduce the
impact of REAL ID on DMV operations
and budgets.
Comment: Many States and
commenters wrote that REAL ID will
significantly increase service times at
DMVs, resulting in a degradation of
service. AAMVA estimated that DMV
workloads will increase by 132 percent
and that transaction times for license
renewals will double. One commenter
wrote that central issuance would
impose considerable burdens on
citizens of rural, low-density states.
Several States wrote that the inability to
use the Internet would impose a

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

significant burden on DMV operations;
one State wrote that the elimination of
telephone and mail-in address changes
would force approximately 400,000
additional persons into its DMV offices.
Commenters also wrote that State DMVs
will be required to add new staffing and
infrastructure and, at the same time,
replace or reconfigure their existing
offices. States commented that hundreds
of new employees will need to be hired
and new costs incurred to obtain
fingerprinting and background and
financial checks of DMV staff. A few
States noted that they will have to
renegotiate contracts for services such as
card printing or purchase new printers.
Response: DHS understands the
commenters’ concerns and agrees that
forcing the entire driver’s license and
identification card holder population
into a compressed timeframe would
likely result in increased DMV service
times and a general degradation of
services. The final rule permits, for
example, additional time for enrollment,
remote license transaction processing,
and eliminates the necessity of inperson DMV visits for address changes.
Further, there is no requirement for
financial background checks or central
issuance of licenses, although a number
of States have adopted central issuance
as a best practice.
Comment: Several commenters wrote
that State DMV officials will require
extensive training in recognizing the
many types of immigration documents
and statuses that applicants may
present. One commenter wrote that
REAL ID would change State DMVs
‘‘into a wide-ranging enforcement agent
of the Federal government in areas from
immigration rules to Social Security
fraud.’’ Commenters also wrote that
State DMVs will be required to add new
staffing and infrastructure and, at the
same time, replace or reconfigure their
existing offices. A few States noted that
they will have to renegotiate contracts
for services such as card printing or
purchase new printers.
Response: DHS disagrees that the
REAL ID Act or its implementing rules
would result in DMV employees acting
as enforcement agents. The rules require
that the DMV issue compliant licenses
only to individuals lawfully present in
the United States and whose Social
Security Number can be verified with
the Social Security Administration. DHS
also believes that the rules simplify the
handling of immigration-related issues,
which DHS concedes is a very
complicated area. DMV officials are
required to verify a non-citizen’s lawful
status with DHS. The SAVE system
administered by USCIS permits DMVs
‘‘one stop shopping’’ to verify an

PO 00000

Frm 00016

Fmt 4701

Sfmt 4700

individual’s lawful status in the United
States. Furthermore, many States
provide extensive document training to
their personnel to assist in identification
and authentication of valid documents.
Furthermore, State DMVs already work
with immigration documents and
questions of immigration status under
their applicable State laws and have
developed increasing familiarity with
this subject.
Comment: Commenters wrote that
State DMVs will be required to
undertake other activities that they do
not currently perform. One State wrote
that by some State laws, driver’s
licenses and State ID cards are issued by
two separate government agencies.
Several States said they would need to
acquire new or enhanced records
management systems. Other States
wrote that they will have to physically
rearrange their facilities to comply with
the REAL ID requirement to maintain a
photo of everyone who applied for a
license.
Response: While there may be
activities DMVs may now need to
perform in order to issue more secure
driver’s licenses and identification cards
under REAL ID, Congress determined
that these activities are necessary in
order to ensure more secure and reliable
forms of identification. Understanding
that these new functions may cause
strain on some DMV facilities, the final
rule provides flexibility and additional
time for states to implement these
activities.
12. Those Without Access to Required
Documents
Comment: Several commenters wrote
that REAL ID would impose significant
burdens on low-income individuals in
the form of significantly higher fees for
licenses and ID cards, higher additional
costs to obtain necessary underlying
documents, and extra time from work,
potentially involving lost wages, to
apply for REAL ID cards. One
commenter wrote that a consequence of
these burdens could be a likely increase
in counterfeited ID cards and large
numbers of individuals who lack
Federally-compliant identification.
Several commenters stated that certain
groups would be unfairly affected by the
requirement to produce certain
documents, including foreign nationals,
Native Americans, domestic violence
victims, the homeless, the elderly, and
military personnel. In addition,
commenters described circumstances
that could impede individuals’ access to
required documents, such as natural
disasters.
Response: DHS believes that the
REAL ID Act does not have a

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

disproportionate impact on certain
groups. There is no evidence that many
of these groups lack the documents
required to establish an individual’s
name, date of birth, SSN, and lawful
status. Should States determine that the
economically disadvantaged individuals
are experiencing a hardship in obtaining
the necessary documents or cannot
afford the license fee established by the
State, nothing in the rule precludes a
State from offering the driver’s license
or identification card or copy of a birth
certificate at a reduced cost or waiving
the fee altogether. In addition, the final
rule enables States to establish an
exceptions process for a variety of
situations and circumstances, including
circumstances where a particular suite
of documents are unavailable following
a natural disaster.
13. REAL ID Will Be a Burden to EndUsers
Comment: Two commenters wrote
that the responsibility for validating
REAL ID cards is a government function
and should not be delegated to air
carriers. Instead, DHS should provide
‘‘readers,’’ similar to those used by
Immigration and Customs Enforcement,
for use at airports. Two commenters
requested the rule make clear that the
current option regarding individuals
submitting to a more extensive physical
search rather than showing ID before
passing through airport security will not
be affected by the REAL ID Act.
Response: Neither the NPRM nor this
final rule govern what documents
should be accepted or procedures
followed at airports and Federal
facilities when an individual is unable
to present a REAL ID-compliant
document as his or her form of
identification. DHS does not agree with
the comment that validating a REAL ID
is exclusively a government function,
and believes that a wide variety of
entities would want to validate a REAL
ID document before accepting it as a
valid form of identification.
Comment: Another commenter asked
how end-users could continue routine
functions if, after 2013, State-issued
driver’s licenses do not meet REAL ID
standards, since REAL ID would be
required for access to nuclear facilities.
If a State is not in compliance or elects
not to participate in the REAL ID
program, access by persons with
licenses from those States would be
prohibited, and the ability of the plants
to function could be seriously impaired.
A commenter mentioned that an access
authorization program supervised by the
Nuclear Regulatory Commission is
already in place. One commenter wrote
that while commercial nuclear power

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

plants are licensed by the NRC, they are
privately owned and operated and
security is the responsibility of the
owner/operator, not the Federal
government; therefore, they should be
exempted from the final rule
requirements.
Response: Since the REAL ID Act
specifically included access to a nuclear
facility as an example of an ‘‘official
purpose,’’ DHS cannot simply exempt
nuclear power plants from the scope of
the rules. DHS agrees with the
commenter that access authorization
programs supervised by the Nuclear
Regulatory Commission may provide
sufficient safeguards concerning access
to nuclear facilities. The NRCsupervised programs may set forth
alternative procedures or acceptable
forms of identification for persons
seeking access to a nuclear facility;
however, if an individual is presenting
a driver’s license or State-issued
identification card, it must be REAL IDcompliant pursuant to the REAL ID Act.
Comment: One commenter expressed
concern about the impact of REAL ID on
commercial truck drivers, and suggested
that drivers without REAL ID
identification cards would be far less
valuable to carriers. One commenter
wrote that motor carriers domiciled in
non-compliant States would be at a
severe disadvantage in finding drivers,
and commercial drivers themselves will
have to absorb the additional costs of
REAL ID, including increased fees to
obtain licenses and lost income.
Response: Any additional fees that
DMVs may charge to obtain a REAL ID
document will not fall
disproportionately on commercial
drivers. Nothing in the rules precludes
companies employing commercial
drivers from subsidizing the costs
incurred by the drivers they employ.
Furthermore, a REAL ID driver’s license
is not the sole document a commercial
driver could use to access a Federal
facility. Since a Federal facility may
accept other forms of identification or
establish alternative procedures to
admit individuals with non-compliant
licenses to Federal facilities, DHS does
not believe that commercial driver’s
license holders will be disadvantaged by
living in a State that chooses not to
comply with the REAL ID requirements.
B. Scope, Applicability, and Definitions
Comment: Two State commenters and
the AAMVA requested clarification of
the terms verification, authentication,
and validation. Two commenters asked
for a clear definition of the term
‘‘Federal facility.’’ One commenter
wrote that it is a statutory requirement
to consult with the U.S. Department of

PO 00000

Frm 00017

Fmt 4701

Sfmt 4700

5287

Transportation in developing new
definitions for driver licensing terms.
Commenters also requested clarification
regarding what age individuals will be
required to obtain a REAL ID. It was
suggested that the age requirement
should be consistent with the age
airlines require passengers to have their
own identification documents. One
commenter expressed the need to
inform the public, in detail, how
individuals will be impacted by not
obtaining a REAL ID.
Response: DHS agrees that the term
‘‘verification’’ should be clarified. The
final rule defines ‘‘verify’’ to include
two processes: Ensuring that the source
document is genuine and has not been
altered and that the identity data
contained on the document are valid.
DHS does not believe that the term
Federal facility needs further definition
and cannot predict how individuals
without a REAL ID-compliant driver’s
license or identification card (either
through their own choice or because a
State does not issue compliant
documents) will be impacted. DHS
notes that individuals without a REAL
ID-compliant document will still be able
to enter Federal facilities and board
commercial aircraft, and these rules
cannot determine what alternative
documents are acceptable for those
purposes. DHS believes that each State
can determine the appropriate
minimum age to issue a REAL IDcompliant driver’s license or
identification card to its residents and
does not believe that a single Federal
standard is necessary in this area.
1. Definition of ‘‘Official Purpose’’
Comment: Two States wrote that since
many Federal areas require
identification, all ‘‘official purposes’’
must be clearly stated in the rule so that
States can make informed decisions on
whether to be REAL ID-compliant based
upon the impact on the State budget
versus the negative convenience impact
on its citizens. Numerous commenters
wrote that the definition of ‘‘official
purpose’’ captures the requirements of
the REAL ID Act and they are opposed
to expanding the definition.
Commenters stated that, should DHS
decide on expanding the definition of
‘‘official purpose,’’ it should not be done
without an open comment period. One
commenter wrote that DHS has
arbitrarily chosen to restrict the required
presentment of REAL ID-compliant
documents to a much smaller set of
official uses than was contemplated by
Congress, and this contradicts and
undermines DHS’s statutory mandate to
enforce Federal immigration law. One
State suggested that DHS create a list of

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5288

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

applicable Federal facilities. One
commenter voiced concern over
possible expansion of the definition to
include Federally licensed firearms
dealers and that residents of noncompliant States could be blocked from
purchasing firearms. One commenter
encouraged DHS to consider all the
ways in which REAL ID could be used
and not limit it to boarding of Federallyregulated commercial aircrafts, entering
of Federal facilities, and nuclear power
plants.
Response: DHS agrees with those
commenters who noted that the
proposed definition of ‘‘official
purpose’’ is consistent with
Congressional intent. DHS is neither
expanding nor limiting the definition
further in this rule. DHS will continue
to consider additional ways in which a
REAL ID license can or should be used
and will implement any changes to the
definition of ‘‘official purpose’’ or
determinations regarding additional
uses for REAL ID consistent with
applicable laws and regulatory
requirements. DHS does not agree that
it must seek the approval of Congress as
a prerequisite to changing the definition
in the future (except of course to remove
one of the three statutorily-mandated
official purposes) as § 201(3) of the Act
gives discretion to the Secretary of
Homeland Security to determine other
purposes.
DHS does not intend that a REAL ID
document become a de facto national ID
based on the actions of others outside of
DHS to limit the99ir acceptance of an
identity document to a REAL IDcompliant driver’s license or
identification card.
Comment: Commenters proposed
other acceptable documents, including
over-the-counter interim identification
cards and tribal identification
documents that should be accepted for
official purposes. Another State noted
that Canadian citizens drive to the
United States and fly out of local
airports and that it would benefit them
economically to accept Canadian
passports as identification cards for
Federal purposes. AAMVA wrote that
for States choosing not to comply with
REAL ID, an alternate form of
identification is essential to ensure that
commercial carriers and drivers who
deliver to Federal facilities continue to
have unimpeded access to these
facilities and that interstate commerce is
not impeded. One commenter wrote that
tribal ID issues must be incorporated
into the regulation at the outset. One
commenter wrote that DHS’s
disallowing of Transportation Worker
Identification Credential (TWIC) as an
alternative to a REAL ID document

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

because of ‘‘slow progress’’ in
implementing the TWIC program will be
invalid if DHS extends REAL ID
implementation. The commenter
suggests permitting use of TWIC
because like REAL ID, TWIC also is a
Federally-vetted identification card.
Response: As noted in other
responses, the REAL ID rule does not
control what other, if any, alternative
documents can be accepted by Federal
agencies where an individual seeks to
present an identification document
other than a State-issued driver’s license
or identification card (which, under the
Act and this final rule, must be REAL
ID-compliant).
2. Other Definitions
Comment: One State asked for several
amendments to the rule definitions.
Specifically, the State asked that
‘‘ability to affect’’ be clarified to mean
‘‘direct ability to affect’’; that digital
photograph should read as ‘‘a digitally
printed color reproduction of the face of
the holder of the license or ID card’’;
that a definition be added for foreign
passports; clarification that providing a
foreign passport with a valid visa is an
acceptable document for validating a
REAL ID; clarification that ‘‘principal
residence’’ is not a residency
requirement, but merely defines
principal address; and clarification that
Secretary means ‘‘Secretary of the U.S.
Department of Homeland Security.’’
AAMVA suggested that the term
‘‘reissued’’ be amended to include ‘‘only
when material changes are required
such as name changes.’’
Response: DHS agrees that the term
‘‘principal residence’’ needs additional
clarification and has defined the term in
the rule to mean the location where a
person is currently domiciled (i.e.,
presently resides even if at a temporary
address) in conformance with the
residency requirements of the State of
domicile, if such requirements exist.
DHS agrees with the comment regarding
material changes and the rule now states
that a State may conduct a remote
reissuance if State procedures permit as
long as there has been no material
change in the applicant’s information
since prior issuance. DHS believes that
the definitions of ‘‘ability to affect’’ and
‘‘foreign passport’’ do not need further
clarification. DHS decided against the
proposed definition of ‘‘digital
photograph’’ since certain high-security
features work best with a black and
white photograph and DHS does not
want to preclude States from using such
technology to secure their licenses.

PO 00000

Frm 00018

Fmt 4701

Sfmt 4700

C. Compliance Period
Comment: Many commenters,
including at least twenty States and
AAMVA, wrote that the compliance
period is too short and is impossible to
meet. Specific reasons cited for why the
compliance period is too short included
the following: The compliance deadline
fails to take into account the States’
cycles for valid driver’s licenses and
identifications; systems that DMVs must
use to verify documents under REAL ID
either do not exist or are not
operational; the compliance deadline
compels States to take on the unfunded
expenses of hiring and training more
staff and making significant
infrastructure changes, waiting times for
customers at DMVs will increase, the
compliance deadline reflects a failure to
understand how State legislatures work
and how complex the process is for
issuing State driver’s licenses and
identification cards, and compliance
deadline leaves insufficient time for
States to appropriate funds for the cost
of implementing REAL ID. Commenters
also wrote that States have no incentive
for requesting such extensions, and
several State legislatures have declined
to even attempt compliance with the
Act or the rule.
Response: DHS agrees with the
commenters that States would be unable
to fulfill the entire range of REAL ID
regulatory requirements by May 11,
2008. Therefore, DHS is taking several
measures to reduce the impact of the
rule. First, States meeting specific DHS
benchmarks for progress toward REAL
ID compliance will be granted
additional extensions until no later than
May 10, 2011. Second, DHS is adopting
an age-based approach to REAL ID
enrollment and will only require
individuals born after December 1, 1964
to enroll by December 1, 2014, in order
to receive cards acceptable for official
purposes on December 1, 2014. Thus,
individuals aged fifty or older on
December 1, 2014, will not be required
to be enrolled until December 1, 2017.
These measures will substantially
reduce the impact of REAL ID
enrollment on DMV operations and
budgets.
DHS has chosen this approach as the
most effective and expeditious way to
achieve the purposes of the Act. DHS
believes that this approach balances the
strong national security objective of
improving the reliability of
identification documents presented for
official purposes, including the
boarding of commercial aircraft, with
the needs of the States to spread out
their compliance costs over a greater
period of time and to obtain the

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
necessary legal and budgetary approval
from within their State to comply with
the regulations.
Comment: Many commenters and
States did not agree on the proposed
compliance period and suggested
additional ideas, from basing the
compliance period on the natural
license expiration date to extending
compliance through 2018. Two
commenters wrote that a six-month
planning deadline after possible
publication of a final rule is unrealistic,
and once there are operational systems
available to all jurisdictions for
implementing REAL ID, States should
have at least one year to connect to
those systems before issuing compliant
cards. Other commenters suggested
delaying the full implementation date
by some other term of years
commensurate with State driver’s
license renewal periods. Another
commenter wrote that State legislatures
need two years after issuance of a final
rule to enact enabling legislation. One
State suggested a four-year compliance
delay, as the State has a lack of funding;
other States proposed a delay of five
years following final rule publication
because those States will not complete
legislation and budget actions before
that time. One commenter wrote that the
compliance date would result in every
State requesting a waiver and
compressing the enrollment process
from five years to something less.
AAMVA suggested a ten-year
compliance period, to 2018, and also
recommended that DHS avoid setting
the implementation period until there
are systems for verification accessible in
all jurisdictions.
Response: As noted above, DHS
agrees that the compliance date should
be extended and therefore has extended
the enrollment deadline to December 1,
2014, for drivers after December 1, 1964
(that is, under age fifty), and to
December 1, 2017 for all other drivers as
described above.
Comment: Commenters wrote that
DHS should permit States to grandfather
into REAL ID compliance those
individuals who have held a driver’s
license for ten years. Another
commenter wrote that DHS should give
States the flexibility to delay reverifying certain populations so that
States maximize their resources and
avoid severe service disruptions. Where
a State can verify customer data before
issuing a license or identification
document, DHS should permit States to
use ‘‘alternative renewal processes’’
during the REAL ID enrollment period.
Another commenter wrote that a State
should be able to waive verification
requirements for members of the

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

military, Federal employees, and
passport holders who already have been
through a Federal vetting process.
Another commenter proposed
grandfathering in any State that can
demonstrate that its process for issuing
driver’s licenses or identification
documents is similar to REAL ID.
Response: The REAL ID Act does not
authorize Federal agencies to accept
non-compliant cards from specific age
groups or other populations through a
grandfather clause. DHS, as discussed
above, recognizes the operational
burden on States if they were required
to reenroll all licensed drivers by the
initial proposed enrollment date of May
2013. DHS has determined, based on
comments received requesting
deferments or exemptions for
populations based on age and a
statistical analysis of TSA incident
report data, that an age-based
enrollment would provide States with
the most reasonable implementation
options.
DHS has determined that, based on
TSA incident report data it has
reviewed, that a logical dividing point
for age-based enrollment would be fifty
years of age. As a result, the rule
requires the States to focus first on
individuals born after December 1,
1964, when issuing REAL ID cards.
These individuals will be under fifty
years of age on December 1, 2014. DHS
has determined that deferring the REAL
ID enrollment requirements until
December 1, 2017, for those individuals
born on or before December 1, 1964,
will relieve the States of some
operational burden associated with relicensing their license holders. This
provision will enable States to extend
the enrollment of this lower-risk
population until December 1, 2017.
This approach is based on a review of
several data sets that correlated age and
the propensity to commit a terrorist act
and age and the likelihood to commit a
criminal act.
Depending on the specific data set
examined, different age cutoffs starting
at the age of thirty-five would be
appropriate for the REAL ID final rule.
Of the several data sets that were
examined, the best data set is one from
TSA, because it is the only one that
shows a correlation between activities
occurring within TSA’s purviews, an
incident resulting in a arrest, the age of
the individual and the use of a
fraudulent identification.
For this final rule, data was collected
and analyzed on the total number of
TSA incidents involving the use of
fraudulent identification representing
the time period from October 1, 2004
through July 25, 2007. The data was

PO 00000

Frm 00019

Fmt 4701

Sfmt 4700

5289

then sorted and those potential
incidents involving the use of a
fraudulent identification (using the key
words fraud, false, fake, and ID) were
extracted. Each incident report was read
and those incidents that were not
germane to the REAL ID rulemaking
were purged. Finally, DHS, using both
the raw data as well as the calculated
rates (based on the number of
individuals flying), grouped the
incidents into different age groups. The
results were a data set that correlated
one of the primary requirements of this
rulemaking (the need to present an
appropriate identification prior to
boarding an airplane) to the use of a
fraudulent identification by the age of
an individual.
A total of 98 incidents of where an
individual was arrested that involved
the use of a fraudulent identification
was included in this group. The age of
the individuals arrested was available
for 86 of the arrests. The weighted mean
age of an individual arrested was 32
years of age with a standard deviation
of 8.95 years. This means that about
two-thirds of those individuals who
were involved in an incident where an
arrest occurred were between the ages of
23 and 41. About ninety-five percent
were between the ages of 14 and 50.
Using this data, DHS estimated the
percentage of individuals who would be
prevented from using a fraudulent
identification (as a result of the REAL ID
rule) for the age cutoffs 41, 45.5, and 50.
Based upon a normal distribution,
66.7% of all individuals using a
fraudulent identification would be
between the ages of 23 and 41 (1
standard deviation) and 95% of all
individuals would be between the ages
of 41 and 50. These statistics were then
used to estimate the risks associated
with the age cutoffs of 41, 45.5, and 50.
An age cutoff of 41 would allow DHS to
potentially prevent the likelihood of
83% of all individuals from using a
fraudulent identification. But as a
means of providing additional national
security, the final REAL ID rule would
not have prevented 17% of the
individuals from using a fraudulent
identification.
With a cutoff of age 50, DHS would
potentially prevent the likelihood of
97% of all individuals from using
fraudulent identification. But as a
means of providing additional national
security, the final REAL ID rule would
not have prevented 3% of the
individuals from using a fraudulent
identification. Since the age cutoff 45.5
is the midpoint of the ages 50 and 41,
DHS estimated the likelihood that REAL
ID would prevent the use of a fraudulent
identification, by using the averages for

E:\FR\FM\29JAR2.SGM

29JAR2

5290

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

the age cutoffs 50 and 41 and found that
an age cutoff of 45.5 would prevent the
likelihood of 90% of all individuals
from using a fraudulent identification.
But as a means of providing additional
national security, the final REAL ID rule
would not have potentially prevented
10% of the individuals from using a
fraudulent identification (See Table
Below).

TABLE 1.—RISKS ASSOCIATED WITH
DIFFERENT AGE CUTOFFS
Risks associated with different age cutoffs
Potential
percentage
number of
incidents
prevented
(%)

Age cutoff

rwilkins on PROD1PC63 with RULES_2

41 ......................
45.5 ...................
50 ......................

Potential
percentage
number of
incidents
not
prevented
(%)

83
90
97

17
10
3

The TSA data was analyzed even
further by stratifying the universe of
these 86 arrests into three categories.
The categories are (1) Arrests where a
fraudulent identification was
discovered, but the fraudulent
identification was not the reason that
the individual became a suspect; (2)
arrests where the individual was a TSA
Selectee and during the process, a
fraudulent identification was
discovered; and (3) arrests where the
individual became a suspect because of
his/her use of that identification and the
use of a fraudulent identification was
the cause for the arrest. Because DHS
was not able to determine a priori the
characteristics of the population as a
whole as to who uses a fake
identification and who does not (in
order to determine an appropriate age
cutoff), the best that can be done is to
examine the ages of those who were
arrested when the use of a fraudulent
identification was the cause of the arrest
and compare that population to those
who were arrested where a fraudulent
identification was discovered at the
time of the arrest but the fraudulent
identification was not the reason to
suspect the individual. The results show
that the means of each population are
not statistically different from each
other. In other words, we cannot say
that the samples are from different
populations and we accept the null
hypothesis.
Comment: One commenter wrote that
the waiver process by which a State may
request an extension of the compliance
deadline to December 31, 2009 is
acceptable, as it gives States the time
they need to plan, budget, and

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

implement the regulations. Another
commenter wrote that compliance
related to the verification of lawful
status of aliens could be implemented
by all 56 states and territories by the
May 11, 2008 deadline, and that there
is no rational basis to extend the
specific deadline for SAVE compliance.
One commenter wrote that DHS should
institute a formal safe harbor so that a
State may be deemed compliant if it is
making reasonable progress toward
implementing REAL ID. One commenter
wrote that when there is a legitimate
reason to grant an extension for one
State, it should apply to all states.
Another commenter wrote that a State’s
request for an extension should be
deemed justified in the absence of
extraordinary circumstances. One
commenter wrote that DHS has
demonstrated flexibility by allowing
States to delay implementation and
creating a petition process for States
needing more time, and the commenter
encouraged DHS to continue
collaborating so that States have the
necessary flexibility to comply with the
law.
Response: Although the above
comments indicated that certain aspects
of the proposed rule do not require an
extended compliance period, all the
commenters observed that States would
be unable to meet the overall
compliance deadline proposed in the
NPRM. As noted earlier in this
preamble, in addition to the extension
proposed in the NPRM through
December 31, 2009, DHS is allowing a
second extension request valid until no
later than May 10, 2011.
Also as noted earlier in this preamble,
DHS has chosen this approach as the
most effective and expeditious way to
achieve the purposes of the Act. DHS
believes that this approach balances the
strong national security objective of
improving the reliability of
identification documents presented for
official purposes, including the
boarding of commercial aircraft, with
the needs of the States to spread out
their compliance costs over a greater
period of time and to obtain the
necessary legal and budgetary approval
from within their State to comply with
the regulations. Furthermore, because
some States are uniquely situated and
have taken different steps to come
potentially closer to compliance with
the REAL ID Act than other States, DHS
does not believe that ‘‘one size fits all’’
when it comes to the use of the
Secretary’s extension authority.
D. Privacy Considerations
Comment: DHS received numerous
comments regarding the need to protect

PO 00000

Frm 00020

Fmt 4701

Sfmt 4700

the privacy of REAL ID cardholders. The
comments raised a wide range of
concerns including the creation of a
national ID; establishment of a Federal
database on all ID holders; the uses of
the ID; the need to set specific standards
to protect privacy, including addressing
data storage, access rules, safeguarding
the data, and retention period for the
data; the need to provide a redress
process; limiting Federal access to the
data; who should operate or govern the
query system; and best practices for
privacy protection of the data. AAMVA
also commented that the States are
committed to protecting privacy and
that they are prepared to address
privacy in their security plans and many
already have such plans in place.
At least one State and several other
commenters, including NASCIO,
expressed concerns about the
development, governance, and
protection of privacy in Federal
reference databases. NASCIO
recommended collective State
governance. Many commenters wrote
that State information security requires
extreme caution, given that exposing
personal information in untested
databases would result in great harm if
a security breach occurred.
Response: DHS recognizes that
protecting the privacy of REAL ID
cardholders is a prerequisite to
obtaining the public’s trust in the REAL
ID card. DHS has addressed those
concerns in the final rule to the full
extent of its authority by mandating
protections for the personally
identifiable information DMVs collect,
store, and use pursuant to the REAL ID
Act and its implementing regulations.
1. Privacy Concerns Regarding a
National ID and a Federal Database
With regard to concerns that REAL ID
will create a national ID, DHS does not
intend that REAL ID documents become
a de facto national ID and does not
support creation of a national ID. The
REAL ID Act, however, does not provide
authority for DHS to issue restrictions
on who may or may not use REAL ID
cards. DHS can only define those
‘‘official purposes’’ for which a REAL ID
credential must be used in lieu of other
State-issued driver’s licenses. The final
rule has limited ‘‘official purposes’’ to
those set forth in the Act—accessing
Federal facilities, boarding Federallyregulated commercial aircraft, and
entering nuclear power plants. In
addition, the final rule does not require
that the REAL ID driver’s license or
identification card number or design be
unique nationally, thus possibly
limiting the functionality of the REAL
ID card or identification number as a

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
national ID card. It is unclear at this
early stage whether REAL ID cards in
fact will be used differently from
current State driver’s licenses and
identification cards; but if cardholders
experience specific abuses regarding
third-party misuse of these cards,
Congress and the States can determine
whether and how to address such
abuses.
With regard to concerns that REAL ID
will create a Federal database on all
REAL ID card holders, DHS does not
intend to own or operate a database on
all driver’s license and identification
card holders. REAL ID implementation,
however, will require a messaging
system (generally known as a ‘‘hub’’) to
serve as the backbone to support the
verification checks REAL ID requires. In
addition, the State-to-State data
exchange will likely require a software
application (likely an index or pointer
system) to enable the States to exchange
limited information to identify whether
an applicant for a card holds a card in
another jurisdiction.
DHS is mindful that the States expect
to continue to have control over their
systems, their information, and the
processes that govern any use or access.
DHS agrees that issues relating to the
governance of any State-to-State
exchange of information are critically
important, and that the States will need
to play an important role in determining
the governance structure of any
system(s) that may interface with State
licensing systems and the Federal
verification systems required to
implement REAL ID. Many of the
individual State comments emphasized
that they are committed to protecting
privacy and that they are prepared to
address privacy in their security plans
and already have such plans in place.
The governance of the system(s)
necessary to conduct the data checks
will be established in consultation with
DOT and the States during the first
phase of the REAL ID implementation.
The Privacy Impact Assessment issued
in conjunction with the final rule
discusses the governance issue in more
detail.
As described above, DHS is currently
working with AAMVA, DOT, the Social
Security Administration, the
Department of State, National
Association of Public Health Statistics
and Information Systems (NAPHSIS),
and State representatives to define
requirements for a messaging system to
support the multiple data verification
checks REAL ID requires. The backbone
of the messaging system could be
AAMVAnet, the network system
AAMVA already operates to facilitate
data verification for the State DMVs. It

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

is important to note for purposes of
privacy and security that the
AAMVAnet backbone resides on a
private network with no connectivity to
the Internet, making it much less
vulnerable to attacks. It has been, and
will continue to be, a highly secure
transportation layer for all
communications between the States and
agency databases. DHS will work with
DOT and AAMVA to build upon the
security, privacy, and governance
principles that have guided AAMVA
and the States for decades in conducting
licensing checks by reinforcing the
security and privacy features of the
AAMVA communications and systems
architecture.
In addition to potentially using
AAMVAnet as the backbone, DHS, DOT,
and the States are exploring the
alternative of using the Commercial
Drivers Licensing Information System
(CDLIS) as the platform for supporting
the State-to-State data exchange
requirements of the REAL ID Act and
regulation. CDLIS already supports
queries to every State DMV every time
an individual applies for a driver’s
license in any State or the District of
Columbia. Although privacy groups
urged DHS not to build upon CDLIS
since it is a centralized database, it is
more technically and economically
difficult to design a State-to-State data
exchange system that avoids using a
central repository (an index or pointer
system) to direct the checks to the
appropriate State. DHS understands that
State systems would not be able to
handle the volume of messages received
if all jurisdictions were sending and
receiving messages from all jurisdictions
at the same time. The central repository
would facilitate the check by identifying
which jurisdiction(s) has a match and
obtaining the relevant record
information. The repository would only
be used to facilitate the State-to-State
data exchange or for authorized law
enforcement personnel who are
checking a specific license or
identification card against the system.
Moreover, CDLIS is a secure, Stategoverned system that stores only the
minimum amount of personal
information necessary to minimize false
positives and to facilitate the routing of
queries and responses between States.
With regard to limiting access,
(Federal, State, and private-sector) to the
State DMV data stored in the data
verification system, DHS, DOT, and the
States will define the access rules. The
REAL ID Act does not create Federal
access rights to State DMV databases.
Moreover, DHS supports limiting access
to the data verification system to
authorized State DMV personnel and to

PO 00000

Frm 00021

Fmt 4701

Sfmt 4700

5291

Federal government agencies engaged in
official responsibilities pertaining to law
enforcement, the verification of personal
identity, or highway and motor vehicle
safety. For example, DHS personnel do
not currently access CDLIS or
AAMVAnet. Its law enforcement agents
obtain access to State driver’s license
information using National Law
Enforcement Telecommunications
System (NLETs) and commercial data
sources.
2. Protection of State DMV Databases
To help protect the privacy and
security of the personally identifiable
information (PII) held in State DMV
databases, § 37.41 of the final rule
requires States to prepare a security
plan for all State DMV facilities and
systems involved in the issuance,
enrollment, production, or manufacture
of driver’s licenses and identification
cards, and to submit the plan to DHS as
part of the State’s application for
certification. The final rule requirement
for the security plan to include
reasonable administrative, technical,
and physical safeguards to protect the
security, confidentiality, and integrity of
the personally identifiable information
collected, stored, and maintained in
DMV records and information systems
is consistent with key information
safeguards outlined in the Privacy Act
of 1974 (5 U.S.C. 552a) and the Federal
Information Security Management Act
of 2002 (44 U.S.C. 36).
The security plan requires a number
of important privacy and security
safeguards including, but not limited to:
(1) Procedures to prevent unauthorized
access, use, or dissemination of
applicant information and images of
source documents retained pursuant to
the Act; (2) standards and procedures
for document retention and destruction;
(3) a privacy policy; (4) a prohibition on
release and use of personal information
that, at a minimum, is consistent with
the Driver’s Privacy Protection Act, 18
U.S.C. 2721 et seq.; (5) access controls,
including employee access badges,
background checks and systems
controls; (6) emergency incident
response plans; (7) internal audit
controls; (8) physical security of
facilities where driver’s licenses and
identification cards are produced; (9)
security of the document materials and
papers from which driver’s licenses and
identification cards are produced
(§§ 37.41 and 37.43).
The requirement that the security
plan include a privacy policy regarding
the personally identifiable information
collected and maintained by the DMV
provides a key privacy protection.
Although the final rule does not define

E:\FR\FM\29JAR2.SGM

29JAR2

5292

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

the specific content of the privacy
policy, DHS expects that the policy will
reflect the fair information principles
noted in the NPRM, which call for
openness, individual participation
(access, correction, and redress),
purpose specification, data
minimization, use and disclosure
limitation, data quality and integrity,
security safeguards, and accountability
and auditing. These principles are
widely recognized and embodied in
numerous Federal, State, and
international law and codes of practice.
In addition to reflecting these
principles, DHS recognizes that the
privacy policies will need to be
consistent with State privacy laws
governing DMVs information practices,
and the final rule in no way reduces the
protections States already afford PII
held by DMVs.
With regard to concerns regarding
disclosure of PII from DMV databases,
the final rule requires that the security
plan include a prohibition on release
and use of personal information that, at
a minimum, is consistent with the
DPPA. Although the DPPA provides for
a large number of permissible uses, it is
the only Federal law that currently
applies to State DMV records and will
provide a floor that States can build
upon to further limit the disclosure of
DMV record information.
3. Privacy Concerns Regarding the
Machine Readable Technology
Employed by REAL ID
Section.IV.I.8 of the comments
discussion discusses the comments and
responses regarding the machine
readable zone (MRZ) on REAL ID cards.
In brief, commenters were split between
the privacy groups that were concerned
about third party ‘‘skimming’’ of
information from the MRZ if it is not
encrypted, and the State and law
enforcement groups that opposed
encryption because it could interfere
with speedy law enforcement access to
the information and it would be difficult
and costly to manage encryption keys
across so many jurisdictions.
Given law enforcement’s need for
easy access to the information, and the
complexities and costs of implementing
an encryption infrastructure, DHS is not
requiring encryption of the MRZ at this
time. If, in the future, the States
collectively determine that it is feasible
to introduce encryption, DHS may
consider such an effort so long as the
encryption program enables law
enforcement easy access to the
information in the MRZ. Moreover, in
the future, DHS, in consultation with
the States and DOT, and may consider
technology alternatives to the PDF417

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

2D bar code that provide greater privacy
protections after providing for public
comment.
As discussed in the Privacy
Considerations section of the NPRM (72
FR at 10824–25), DHS strongly
encourages the States to address
concerns about the ability of non-law
enforcement third parties to collect or
skim personal information stored on the
REAL ID driver’s licenses or
identification cards. Some States, such
as California, Nebraska, New
Hampshire, and Texas have passed laws
that prohibit the collection of
information on a driver’s license or
identification card. In addition,
AAMVA has drafted a Model Act 2 that,
if enacted by a State, would prohibit
commercial users, except as provided by
the State’s legislation, from using a
scanning device to: (1) obtain personal
information printed or encoded on the
card and; (2) buy, sell or otherwise
obtain and transfer or disclose to any
third party or download, use or
maintain any data or database, knowing
it to contain personal information
obtained from a driver’s license or
identification card. The Model Act
authorizes verification of age for
purchasing alcoholic beverages or
tobacco products, but with strict
limitations on the storage and use of
such information.
In addition to concerns about thirdparty skimming, privacy groups
commented that access to the MRZ
should be restricted to law enforcement,
while other commenters also supported
access without information collection
for bars and liquor stores to help
prevent underage drinking. In response
to commenters urging that the rule limit
Federal agency access to the MRZ, DHS
is not aware of any current plans by
Federal agencies to collect and maintain
any of the information stored in the
MRZ. If a Federal agency should want
to use the MRZ to collect and maintain
personally identifiable information in
the future, any such information
collected from the MRZ would be
subject to the protections of the Privacy
Act of 1974 (5 U.S.C. 552a), and other
Federal laws and policies regulating the
use and handling of personally
identifiable information, including
requiring appropriate time for public
notice.
A number of commenters also urged
DHS to limit the data elements in the
MRZ to the minimum necessary,
particularly if the MRZ is not encrypted.
DHS has reviewed the elements
2 ‘‘Model Act to Prohibit the Capture and Storage
of Personal Information Obtained from a Driver’s
License or ID Card,’’ AAMVA 26–8.2–03, 2003.

PO 00000

Frm 00022

Fmt 4701

Sfmt 4700

identified in the NPRM and eliminated
the requirement to include the name
history in the MRZ. All other data
elements are necessary for DMV and law
enforcement purposes.
4. Additional Privacy Concerns
The privacy groups and individuals
also filed comments on a number of
other privacy issues such as redress, the
confidentiality of the address for certain
at-risk individuals, and the Western
Hemisphere Travel Initiative (WHTI)compliant card and its use of Radio
Frequency Identification (RFID)
technology. The comments and
responses to these additional privacy
concerns are discussed in other sections
of this final rule.
Comment: Two States wrote that the
proposed rule did not provide adequate
safeguards for data storage, thereby
significantly increasing the risk of
identity theft. One commenter wrote
that even the most rigorous security
measures could be foiled by personnel
with legitimate access intentionally or
inadvertently exposing information.
Several commenters wrote that the
rule’s broad expansion of data collection
and storage creates a significant threat to
privacy and that guidance on access to
data and accountability should be
issued. Commenters also wrote that
stored data should be secured to protect
the identities of victims from abusers in
State government who have database
access.
Response: Section 37.41 of the final
rule helps address concerns about
adequate protections for the DMV
databases and information systems. It
calls for States to prepare a security
plan, including providing reasonable
administrative, technical, and physical
safeguards to protect the security,
confidentiality, and integrity of the
personally identifiable information
stored and maintained in DMV records
and information systems. The rule
specifically points out the need to
include access control measures to
prevent unauthorized access to the
information. States are already sensitive
to the importance of protecting their
data and systems. Section 37.33(b) will
help ensure that DMVs provide
comprehensive, layered security
protection to reduce the incidence of
unauthorized access and use. In
addition, this final rule does not
preempt States from implementing
privacy protections that are even more
protective.
Comment: One State wrote that DHS
should set standards for accessing the
required information from the Federal
government and other States so that the
verification process is performed

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
similarly by all States. Multiple
commenters stated that they want data
systems to be one-way and used solely
for the purpose of verification; Federal
system owners would not be able to
query State databases. Similarly, other
commenters wrote that the rule should
limit how States can access Federal
databases for purposes of verifying
source documents and should only
allow authorized DMV employees
access to Federal databases. One
commenter requested that the final rule
make clear that no State may
electronically access source documents
contained in DMV databases in other
States. Several States opposed Federal
government access to the extensive data
collected by States and suggested a
network interface that only allowed
State queries of the databases. One
commenter wrote that it is unclear from
the proposed rule how the federated
query service will operate and manage
the data between databases and DMVs,
and while strict access controls to REAL
ID data and documents will help
minimize security and privacy risks,
such controls will not be possible
without DHS answering these questions
prior to implementing REAL ID.
Response: DHS is working with DOT,
AAMVA, and the States to enhance
existing querying systems to meet the
requirements of the REAL ID Act and
rule. This ‘‘federated querying system’’
builds upon existing systems that
include verification of DMV applicant
birth certificates and social security
numbers. These existing systems enable
States to query the SSOLV database
managed by SSA and the EVVE database
managed by NAPHSIS. In both cases,
only State DMVs can initiate queries.
Moreover, SAVE, the USCIS system for
verifying the lawful status of
individuals in the United States, is
designed on a similar basis, with only
States able to initiate queries.
Enhancements to existing systems to
verify information held by the
Department of State will be designed
and built on the same principles.
In addition, State-to-State data
exchanges required by REAL ID may
consider leveraging the Commercial
Drivers Licensing Information System
(CDLIS) as the baseline platform for
systems design, development and
deployment. CDLIS is a secure, Stategoverned system that stores the
minimum amount of personal
information possible to facilitate the
routing of queries and responses
between States. Enhancements to CDLIS
to support the requirements of REAL ID
will not change the fundamental
architectural, security, and privacy
principles upon which CDLIS has been

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

built and operated by the States for
nearly two decades.
As noted above, § 37.41 of the final
rule addresses these concerns. It calls
for States to prepare a security plan,
including providing reasonable
administrative, technical, and physical
safeguards to protect the security,
confidentiality, and integrity of the
personally identifiable information
stored and maintained in DMV records
and information systems. The rule
specifically points out the need to
include access control measures to
prevent unauthorized access to the
information.
Comment: One State recommended
that paper document retention should
not be required once electronic formats
were secured. Another commenter
wrote that REAL ID should collect only
the data that is absolutely necessary and
keep it for only as long as necessary,
and requirements should be in place to
periodically review and purge
information.
Response: Section 202(d)(2) of the Act
mandates that States ‘‘retain paper
copies of source documents for a
minimum of 7 years or images of source
documents presented for a minimum of
10 years.’’ DHS does not have discretion
to change that requirement.
Accordingly, under this final rule,
States may choose to keep paper copies,
microfiche, or digital images of source
documents. Depending on the method
of document retention adopted by the
State, the State must maintain paper
copies for a minimum of seven years, or
microfiche or digital images of source
documents for a minimum of 10 years
pursuant to the Act. We note that the
NPRM proposed to allow retention of
microfiche for 7 years; however, as
discussed above the statute mandates
retention of ‘‘images’’ of source
documents for 10 years. A microfiche is
a film image, rather than a paper copy,
of a document; therefore, we have
corrected the error in the proposed rule
to more accurately reflect the statutory
mandate.
Comment: Many commenters wrote
that obtaining a REAL ID could become
a requirement for participation in
American life, and that a REAL ID could
be used for purposes beyond what is
contemplated today, such as controlling
gun ownership or smoking. Another
commenter wrote that implementing
REAL ID would undoubtedly result in a
system that political and agency heads
would not restrain themselves from
using and expanding in the future, and
that REAL ID would become a practical
necessity for anyone wishing to travel
on an airplane, open a bank account,
collect Social Security benefits, or take

PO 00000

Frm 00023

Fmt 4701

Sfmt 4700

5293

advantage of other government benefit
programs. Other commenters wrote that
the result would be a dividing of the
citizenry into those who have REAL
identification cards and those who do
not, with the later group subject to
suspicion. One commenter urged DHS
to make clear in the final regulations
that driver’s license numbers and ID
card numbers must be unique within a
State and that the REAL ID cards should
not have a nationally standard format.
Response: DHS agrees with the
comment that a driver’s license or
identification card number needs to be
unique only within a State and need not
be a unique nationally identifying
number. DHS also understands the
concerns raised in the comments about
how a REAL ID might be used outside
of the defined ‘‘official purposes’’
identified in the Act and this final rule.
DHS does not intend that a REAL ID
document become a de facto national
identification card. Whether States
choose to require presentation of a
REAL ID for State purposes is not
within the purview of DHS’s authority
under the Act—which applies to
documents that Federal agencies can
accept for official purposes—and thus is
outside of the scope of this rulemaking.
E. State to State Database Queries
Comment: Several commenters
suggested the following requirements
for State databases: using a single
agreed-upon naming record keeping,
clarifying ‘‘transferable’’ functionalities,
implementation of point-to-point
interfaces for data verification, a
decentralized query system, and a
system to check for duplicate
registrations in multiple States. One
commenter suggested that every State
have a data governance committee.
Several States offered best practice
suggestions to support State database
security, including encryption, annual
employee confidentiality agreements,
secured data centers, testing programs to
determine tampering, security audits,
and multi-factor authentication.
Response: DHS agrees that issues
relating to the governance of any Stateto-State exchange of information is
critically important, and that the States
will need to play an important role in
determining the governance structure of
any system(s) that may interface with
State licensing systems and the Federal
verification systems. DHS is mindful
that the States expect to continue to
have control over their systems, their
information, and the processes that
govern any use or access.
During the initial period of REAL ID
implementation, States will conduct
data verification using their current

E:\FR\FM\29JAR2.SGM

29JAR2

5294

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

methods of connection to SSOLV,
SAVE, and the other State DMVs. States
will continue to use AAMVAnet to
connect to these data sources.
AAMVAnet is governed by the Board of
AAMVA and is subject to the security
and privacy requirements established by
the association of DMVs. As DHS, DOT,
AAMVA, and the States complete the
upgrade of existing systems to meet the
requirements of REAL ID, these systems
will be deployed and operated on the
same basis as the current network of
AAMVAnet-based systems for DMV
verification of applicant data and Stateto-State exchanges of driver
information. The architecture of these
systems will determine the scope and
extent of the privacy concerns they
pose.

rwilkins on PROD1PC63 with RULES_2

F. Document Standards for Issuing
REAL ID Driver’s Licenses and
Identification Cards
1. Identity
Comment: One State agency asked
whether the term ‘‘source document’’ in
the proposed rule is synonymous with
‘‘identity document’’ used in the Act.
One State wrote that it was concerned
about individuals having to surrender
their REAL ID card from one State when
moving to a new State and applying for
a new card. Many commenters wrote
that certain applicants would have
difficulties obtaining proper source
documents, including refugees, lowerincome individuals, persons who live in
rural areas, the elderly, minorities, and
abuse victims. Another State suggested
that the rule should only specify criteria
and procedures rather than a list of
specific documents.
Response: DHS disagrees with the
comment that the rule should specify
criteria rather than a list of specific
documents acceptable to establish a
person’s identity. Limiting the number
of documents means that only the
documents which DHS has found to be
the most secure may be used to
demonstrate identity. Second,
identifying specific documents
improves the chances that DMV
employees will be able to distinguish
valid from fraudulent documents
because there will be fewer categories of
documents with which they will need to
be familiar. Third, a smaller list of
documents increases the ease of
verifying the documents independently,
a related statutory requirement and one
that will be very effective in reducing
document and identity fraud.
DHS does not agree that certain
categories of individuals cannot
reasonably obtain the identity
documents specified in the rule, but the

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

rule provides a reasonable level of
discretionary flexibility to address these
types of cases.
Comment: Commenters wrote that the
list should be expanded to include a
variety of documents, including
adoption papers, refugee status
paperwork, expired foreign passports if
USCIS documentation is current,
passports with expired visas, derivative
visas, Immigration Court documents,
foreign birth records, foreign national
identification cards, the I–94 (ArrivalDeparture Record), and the I–797
(Notice of Action). Refugees and asylees
are more likely to have these documents
before they receive an Employment
Authorization Document (EAD). Two
States suggested that documents that
can be electronically verified through
SAVE should be acceptable.
Commenters wrote also that foreign
applicants may have documents that are
not on the list but may have been issued
by DHS or the courts to prove
immigration status.
Response: The document list
provided in the proposed regulation and
adopted under this final rule is only for
demonstrating identity, not lawful
status in the United States. DHS agrees
with the commenters who suggest that
any document verifiable by SAVE is
acceptable for proving lawful status, and
that is what this final regulation
provides. These can include Forms I–
797 and I–94 as they provide sufficient
information for a State DMV to check
SAVE, which will be the method by
which aliens lawfully present in the
United States establish lawful status.
But because many of these documents
(including the ones listed above) cannot,
and are not intended to, prove a
person’s identity, an additional
document must be provided for that
purpose. In the case of refugees and
asylees, they will be able to obtain a
Form I–766, Employment Authorization
Document.
DHS cannot accept the comment that
foreign documents be included on the
list of acceptable documents to prove
identity. First, section 202(c)(3)(B) of the
Act specifically prohibits any States
from accepting any foreign document
other than a passport. Second, the Act
requires that documents presented for
proof of identity be verified by the
issuing agency. State DMVs cannot be
expected to verify with foreign
governments the validity of documents.
DHS has, instead, decided to use the
U.S. visa within the foreign passport as
the identity document that a
nonimmigrant alien can present.
Comment: One commenter wrote that
a delayed birth certificate should be
considered an acceptable document.

PO 00000

Frm 00024

Fmt 4701

Sfmt 4700

One State wrote that many births in
rural areas are not recorded, and States
should be able to use other documents.
One commenter wrote that a
requirement for a certified copy of a
birth certification would place a
hardship on poor persons. One
commenter supported the concept of reverification of birth certificates for
renewals of REAL identification cards,
except that the rule should allow the
option for the applicant to use
documents with the current legal name
instead of the name at birth.
Response: While confirming identities
with delayed birth certificates can be
problematic, this final rule does not
preclude a State from accepting a
validly-issued delayed birth certificate.
DHS agrees that some, mostly elderly,
individuals may not have a birth
certificate at all. As a result, the final
rule permits a State to use its exceptions
process to determine what alternative
documents an individual may present in
this limited circumstance to establish
his or her date of birth. DHS does not
agree that lower-income individuals
will have a hardship obtaining certified
copies of their birth certificates and
believes that States may be able to assist
those individuals for whom the cost of
obtaining a birth certificate is
prohibitive. Further, DHS believes that
there is value in re-verifying applicant
information upon renewal of driver’s
licenses and identification cards and
has amended the renewal sections to
require re-verification of SSN prior to
issuance.
Comment: Commenters requested a
variety of additional documents be
considered as acceptable source
documents, including Federally-issued
identification documents such as
military identification cards, the
Common Access Card, retired military
ID cards, dependent military ID cards,
Veteran Affairs Universal Access Photo
ID cards, and Transportation Workers
Identification Credentials (TWIC). Some
commenters also requested that Native
American Tribal Documents be deemed
acceptable source documents. One State
asked whether a tribal photo
identification card accompanied with a
Canadian birth certificate (which is
currently acceptable to the commenting
State) will be acceptable to DHS. If not,
these populations may encounter
particular difficulty obtaining a REAL
ID.
Response: DHS does not agree with
comments suggesting addition of Native
American Tribal Documents, TWIC
cards, or Common Access Cards (CAC)
or military identification issued by the
U.S. Department of Defense as identity
documents for REAL ID purposes at this

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

time. DHS continues to understand from
the Department of the Interior and
Bureau of Indian Affairs that Tribal
members are similarly situated to the
general population, and have access to
the identification documents set forth in
the rule. Where a Tribal member does
not have the necessary document to
establish identity, date of birth, or
lawful status, a State’s exception
process can take this into account based
on the State’s knowledge and
experience with Tribal documents in its
area of jurisdiction.
In regard to the use of a TWIC as proof
of identity, at this time, DHS does not
believe that it would be feasible for
States to accept TWIC cards as initial
proof of identity by persons applying for
a REAL ID card. First, section 202(c)(3)
of the REAL ID Act requires States to
verify all documents presented by
applicants as proof of identity. The
capability for States to verify a TWIC
card currently does not exist at this
time.
Second, although a TWIC holder must
have been determined to be lawfully
present in the United States to obtain
the TWIC, the TWIC does not
necessarily expire when the holder’s
lawful status expires. Therefore, a DMV
could not use the TWIC card alone as
evidence of lawful status and the
applicant would have to present both a
TWIC (for identity) and a separate
document (for status).
Accordingly, there is little benefit to
the individual or the DMV at this time
to include a TWIC as an acceptable
identity document. As such, the final
rule does not include TWIC as an
acceptable form of identification.
However, DHS will revisit this issue in
the future should such a capability
become available and will consider the
ability for States to verify TWICs with
the federal government as the standards
for the ‘‘hub’’ are developed.
2. Social Security Documentation
Comment: Several commenters,
including States, wrote that obtaining a
Social Security card can be a lengthy
process. They argued that some
individuals may have lost their original
card, a Social Security number (SSN)
does not enhance the identification
process, and ineligibility for a SSN is
difficult to determine and verify. One
commenter wrote that individuals might
not have a SSN because of religious
beliefs. One State wrote that States
should have the option of requiring a
Social Security card.
Response: The REAL ID Act requires
that individuals provide proof of their
Social Security account number or
verification that they are not eligible for

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

a Social Security account number.
While the typical proof submitted to
DMVs is a Social Security card, the rule
allows for the submission of alternate
documents, such as a W–2 form, SSA–
1099 form, or pay stub to establish the
SSN. Use and verification of the SSN is
widely seen by almost every State as an
effective tool in enhancing the
identification process. DHS has further
amended the rule to clarify for the
DMVs when an individual will have not
have a SSN, which is largely tied to
immigration status and identity
documents used to apply for a driver’s
license. Other instances may be
addressed in exceptions processing.
3. Principal Residence Documentation
Comment: Many commenters
suggested that the definition of
‘‘principal residence’’ be amended. One
State recommended that DHS define
‘‘principal residence’’ as the jurisdiction
in which an individual spends the most
time. Another commenter requested
‘‘principal residence’’ be defined as the
primary or most important place of
abode of an individual and at which he
or she presently has an intention of
living for an indeterminate period.
Another State suggested that the
definition be changed to require that a
person’s principal residence be within
the jurisdiction issuing the card and to
allow the States to issue exemptions.
One State suggested that DHS clarify the
definition so that students, military,
visitors, and others who are temporarily
residing in another jurisdiction are not
required to change their principal
residences.
Response: DHS agrees that the
definition of ‘‘principal residence’’
needs to be clarified in the rule. The
term is defined in the final rule as the
location where a person is currently
domiciled (i.e., presently resides even if
at a temporary address) in conformance
with the residency requirements of the
State of domicile, if such requirements
exist.
Comment: Commenters wrote that
requiring two documents proving
residence is burdensome on certain
individuals (i.e., recent movers, minors,
homeless, and those not listed as
primary payer on accounts) and
suggested use of the United States Postal
Service (USPS) National Change of
Address system as a verification tool.
One State recommended that the rule
allow use of an on-line address
verification system to replace the two
forms of address documents, at least for
remote renewals.
Response: DHS does not agree that it
is too burdensome to require an
individual to produce two documents to

PO 00000

Frm 00025

Fmt 4701

Sfmt 4700

5295

establish his or her address of principal
residence. Since the State has maximum
flexibility in determining what
documents are acceptable for this
purpose, DHS believes that the States
will be able to find a combination of
documents for each person eligible to
apply for a REAL ID driver’s license or
identification card. DHS believes States
may use the procedures established in
their exceptions processes when seeking
to document the address of principal
residence of the homeless or other
individuals who may not have a fixed
street address.
Comment: Commenters wrote that
there are certain groups of people
including students, long-haul truck
drivers, the homeless, migrant workers,
and others who do not have a single
fixed address and who will not be able
to meet this requirement. One
commenter requested that the rule be
strengthened by clarifying in the
exceptions process that the requirement
of a fixed address will be waived as long
as a REAL ID applicant can make a
showing that they have none and that
they can comply with other
documentation requirements.
Response: As noted above, DHS
believes that States will be able to
resolve these issues through the use of
their exceptions process.
Comment: Several commenters noted
the difficulty in providing a street
address because many rural addresses
use rural route numbers only, and
recommended new regulatory text: ‘‘An
acceptable street address includes rural
delivery route and/or box number or
other address convention used by the
USPS in all areas of the U.S. where a
number and street name has not been
assigned for U.S. mail delivery.’’ One
commenter wrote that in its jurisdiction,
it is common to find streets with same
names throughout different
communities and that rural addresses
are identified by kilometers and
hectometers within a street address or
neighborhood. Another commenter (a
State) has islands that do not have home
addresses; mail is delivered to post
offices where the residents must go to
retrieve their mail. One State noted that
many Native American populations do
not have physical addresses.
Response: DHS agrees with these
comments and has amended the rule to
define ‘‘address’’ as an address
convention used by the USPS in areas
of the United States and Territories
where a number and street name has not
been assigned for U.S. mail delivery.
Comment: One commenter wrote that
address changes make up the largest
number of driver record changes and
many States do not require issuance of

E:\FR\FM\29JAR2.SGM

29JAR2

5296

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

a replacement card until the next
renewal cycle. Several commenters,
including States, wrote that when an
address change occurs, no REAL ID card
need be required and that it is cost
prohibitive for States to issue new
documents for address changes.
Response: DHS agrees with these
comments and is no longer requiring an
in-person transaction for an individual
to change his or her address. DHS also
leaves it to State law and procedure
when and under what circumstances a
State requires issuance of a replacement
driver’s license or identification card.
4. Lawful Status Documentation
Comment: Several commenters wrote
that there are many examples of
lawfully present immigrants who may
not have the listed documents and that
the list should be expanded. One
commenter wrote that these omissions
violate the Constitution by denying to
individuals in these classes the rights
and privileges accorded to others, and
stated immigration documents do not
always reflect actual status. A State
wrote that Temporary Protected Status
aliens should be required to provide
documentation from DHS of an
established identity. Some commenters
objected to the need for an unexpired
U.S. visa on a foreign passport. They
pointed out that renewing a visa would
involve foreign travel, and in any case
a visa does not authorize a stay in the
U.S. for any particular period of time.
An alien with nonimmigrant status may
lawfully extend or change his or her
nonimmigrant status without
maintaining a valid visa stamp. One
State noted that in some cases a
passport might expire before the visa.
Response: DHS has included the list
of documents as verifying identity of the
person presenting them, not lawful
status. Lawful status may be determined
through verification against DHS’s
SAVE system. Aliens who are granted
Temporary Protected Status are already
eligible for EADs, Form I–766, and thus
have a document proving identity. DHS
does not believe that this rule treats
citizens and aliens differently—each is
required to prove identity and lawful
status to obtain a REAL ID driver’s
license. Further, DHS does not believe
that treating citizens and aliens
differently is in violation of the
Constitution, but an inherent right of a
sovereign nation and one that reflects
American constitutional law. Regarding
the visa in a foreign passport, DHS is
not treating the visa itself as a document
establishing lawful status. Again, the
check of DHS’s SAVE system will
accomplish that purpose. The visa is
used to verify identity and can be

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

verified with the issuing agency—the
U.S. State Department. DHS cannot
verify, with the issuing agency as
required by statute, foreign passports
because there is no guarantee that
issuing a foreign government would
respond to a DMV request for a specific
passport. Finally, like all documents
that verify identity, the document itself
must be unexpired to assure that a
significant amount of time has not
passed such that the person’s
appearance has changed. This is a
fundamental rule with issuance of all
types of documents that are designed to
prove a person’s identity.
5. Verification of Documentation
Presented
Comment: One commenter wrote that
DHS should partner with AAMVA in
implementing document verification
requirements. Several commenters
wrote that States need ongoing training
and guidance for verification and to be
advised what to do if documents cannot
be verified. A few commenters noted
that the verification of documents is
only a verification that paper contains
legitimate data and not that the
applicant is the owner of the paper or
that the document is authentic. A State
asked who makes the determination of
whether a State’s verification procedure
is ‘‘effective.’’ Several commenters
wrote that Federal electronic
verification systems do not exist yet or
need significant enhancements;
therefore, compliance requirements
should be delayed. One commenter
wrote that States must find their own
ways to verify documents but that States
lack the legal authority to force
compliance. Commenters suggested
States use third party databases or
automated document authentication
systems and share images to deter
identity fraud. One State asked whether
it would have to re-verify source
documents if the applicant already had
a REAL ID from another State.
Response: DHS is working with
AAMVA and State representatives to
design and implement verification
systems to support the requirements of
the REAL ID Act and this rule.
Representatives of numerous States and
the Federal agencies responsible for
verification of identity information for
REAL ID and related Federal
government programs are continuing to
meet to develop recommendations on
prioritization of data and document
verification systems based on risk and
value. Two verification systems are
currently available for use by all
States—the SSOLV system for
verification of social security numbers
with the SSA and the SAVE system

PO 00000

Frm 00026

Fmt 4701

Sfmt 4700

managed by USCIS for verifying that an
applicant is lawfully present in the
United States and for how long. These
systems have been in widespread use
for many years and are highly effective.
DHS is working to improve further the
usability and accuracy of these systems
and to meet REAL ID-specific
requirements. DHS is also working with
the appropriate Federal and
nongovernmental agencies to verify
other documents and applicant data
mandated by this rule. As these systems
are deployed and become widely
available for use by States, DHS plans to
publish notices of availability and
timetables for required use in the
Federal Register.
DHS recognizes that verification
consists of two separate elements: (1)
Determining that the source document
is genuine and has not been altered; and
(2) determining that the identity data
contained on the document is valid.
Electronic verification systems can
support these elements. However, DHS
recognizes that other methods can be
employed by States to confirm one or
more elements of identity assurance.
Electronic verification systems are only
one component of a suite of measures to
assure States that the applicants are who
they say they are and that they are
lawfully present in the United States.
DHS recognizes that there are many
different techniques for verifying the
identity and qualification of applicants
and will evaluate the effectiveness of
such techniques.
Comment: AAMVA and several States
wrote that a system of passport
verifications through the Department of
State is not available and it will be
difficult for States to determine name
matches. One commenter wrote that
States must find their own ways to
verify documents but that States lack
the legal authority to force compliance.
Commenters suggested that States use
third party databases or automated
document authentication systems and
share images to deter identity fraud.
One State asked whether it would have
to re-verify source documents if the
applicant already had a REAL ID from
another State.
Response: DHS is working with the
Department of State and AAMVA to
provide a capability to verify passports,
U.S. visas, and other information held
by the Department of State. When this
capability is widely available for State
use, DHS will publish a Notice of
Availability in the Federal Register and
establish timelines for State use of this
capability. DHS is also working with
Federal, State, and nongovernmental
organizations to identify and improve

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
name formats and matching algorithms
used by identity verification systems.
Comment: Commenters wrote that
they supported the use of a SAVE
system to verify lawful status because
State DMV staff should not have to be
immigration officials, but that many
improvements needed to be made to the
system. Commenters wrote that SAVE
needs to indicate the type of pending
nonimmigrant status the applicant has,
as well as work authorization
information. Another commenter wrote
that for students and exchange visitors,
information is provided in the Student
and Exchange Visitor Information
System (SEVIS) system, but SAVE and
SEVIS are not yet linked. Several States
wrote that they should not have to pay
transactional costs for Federallymandated verification through a Federal
system.
Response: The SAVE system has
proven to be a highly effective means of
verifying immigration status
information for many DMVs and other
Federal and State agency users for
twenty years. DHS is working with
AAMVA and USCIS to improve the
usability, accuracy, and reliability of the
SAVE system even further, to include
access to SEVIS and other data through
SAVE.
DHS is committed to expediting and
subsidizing the improvement, design,
development, deployment, and
operation of verifications systems to
support the requirements of the REAL
ID Act and this rule; however, the States
have typically borne the costs of
verifying the identity and qualifications
of applicants for driver’s licenses and
identification cards.
Comment: Several commenters
supported the use of the EVVE system,
but pointed out that it is not ready for
implementation, and that an exception
process would be needed. States
opposed having to bear the costs for
verification.
Response: DHS recognizes that the
EVVE system is not ready for full
implementation. The final rule provides
for additional time for States to
implement EVVE or another system that
provides for the verification of birth
records. Verification of identity
information is a valuable tool that many
DMVs utilize. Birth data is currently
collected and maintained by the States,
and DHS is not seeking to Federalize
these records.
Comment: A few commenters
supported the continued use of the
SSOLV system, even though manual
intervention is sometimes needed and
the system is sometimes not available.
One State wrote that it opposed having

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

to re-verify SSNs that were previously
verified through SSOLV.
Response: DHS agrees that the SSOLV
system is the best existing system to
verify an individual’s SSN. DHS does
not believe that the short amount of
time it takes a State to enter an SSN and
verify it through SSOLV is an
unreasonable burden to impose, even
for those persons whose SSN was
previously verified through SSOLV.
Forty-eight States and the District of
Columbia currently have the capability
to verify SSNs through SSOLV or other
means. This requires electronic
verification of SSNs with SSA but
allows States to use other means than
SSOLV. Verification of SSNs through
SSOLV costs pennies and is typically
completed in a few seconds. DHS,
AAMVA, and the States are working
with SSA to improve the accuracy and
reliability of the SSOLV system.
Comment: Several States and
commenters expressed concern that
States are required to verify an
individual’s address of principal
residence, yet DHS concedes in the rule
that no such method exists. AAMVA
wrote that in order for the States to
support the verification process, DHS
must clarify what the ‘‘system of
document verification acceptable to
DHS’’ really means. One State wrote
that DHS should develop national
standards for address requirements and
verification; AAMVA wrote that this
verification should be left to the States
to determine and provide to DHS in
their certification plans. Several States
wrote that development or
implementation of an electronic
verification system for proof of principal
residence is not feasible.
Response: DHS agrees that States are
best situated to verify an individual’s
address of principal residence. The rule
gives States maximum flexibility in
determining an individual’s address of
principal residence.
Comment: Many commenters wrote
that DHS should delay implementation
of this final rule until all system
components needed for verification are
in place and tested. AAMVA and
several States expressed concern about
the cost for verification processes,
particularly programming costs for
States to adapt State systems for the new
requirements and to establish
connections with verification systems.
States wrote that an all-driver
verification system is needed for
implementing the REAL ID program.
Commenters suggested expanded use of
the Commercial Driver License
Information System to satisfy the onedriver, one-record goal. Some
commenters objected to the concept of

PO 00000

Frm 00027

Fmt 4701

Sfmt 4700

5297

a national database. Some commenters
wrote that electronic verification
systems must be fast and reliable;
provide real-time, accurate information;
and be integrated into the REAL ID
issuance process. One commenter
favored a decentralized query system
where one DMV uses an applicant’s
basic identifying information to send
requests to other jurisdictions. A few
States asked how a compliant State
would interface with a noncompliant
State in verifying an out-of-State card.
Other commenters wrote that the
requirement to check with other States
to see whether a REAL ID had been
issued should apply to all driver’s
licenses, not just REAL ID identification
cards.
Response: Two of the critical systems
for verifying Social Security Numbers
and lawful status are fully operational
and currently used by many or most
States. As stated above, DHS is working
with other Federal agencies,
nongovernmental agencies like AAMVA
and NAPHSIS, and the States to design
and deploy additional systems as
quickly as possible. These systems will
be integrated with the licensing
issuance process in each State. States
cannot and will not be required to use
systems that are not fully operational
and available for use.
DHS is also working with the
Department of Transportation, AAMVA,
and the States to enhance the
functionality of CDLIS to meet the
requirements of the REAL ID Act and
this regulation. Neither the Act nor this
regulation requires the design or
deployment of a new national database
or any new system of exchanging of
information between States beyond that
already implemented through CDLIS
and the National Driver Register. All
States currently participate in the
exchange of driver information
mandated under these processes. The
REAL ID final regulation simply
requires States issuing REAL ID driver’s
licenses or identification cards to verify
that an individual does not possess a
valid driver’s license or identification
card in another State. This requirement
is similar to the existing statutory and
regulatory requirements for commercial
driver’s licenses. When this
functionality is available, DHS will
publish a Notice in the Federal Register
detailing the procedures and timeline
for State-to-State exchange of data
required under the Act.
G. Exceptions Processing for
Extraordinary Circumstances
Comment: Three States and three
other commenters said that DHS should
set minimum standards for the

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5298

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

exceptions process so that there is
consistency across the States. However,
other States noted that the process
should not be too rigidly defined,
because the very nature of an exception
will by necessity deviate from the
current process, and that there are too
many variables that need to be analyzed
on a case-by-case basis to develop a
rigid exceptions process.
Response: DHS disagrees with the
comments that DHS should establish a
uniform exceptions process for each
State. DHS recognizes that each
jurisdiction may face its own unique
and particular set of facts and
circumstances to resolve and that DHS
is unable to address all such
circumstances. DHS believes that States
must have the flexibility to craft an
exceptions process adequate to the
needs of their States and recognizes that
no two State exceptions processes may
be identical.
Comment: AAMVA and multiple
States opposed the requirement that
States submit quarterly reports to DHS
analyzing their exceptions processes.
Four of these commenters suggested that
the information could be included in a
State’s annual certification report
instead. Further, AAMVA and many
States opposed the provision requiring
State exceptions processes to be
approved by DHS and said this
requirement would reach too far into the
day-to-day operations of State agencies.
Response: DHS agrees that the
proposed rule’s requirement for a
quarterly report on the use of the
exceptions process is too burdensome a
requirement for the States. The final
rule strikes the quarterly reporting and
requires States to submit a report as part
of the recertification package a State
will submit to DHS in connection with
REAL ID. As necessary and appropriate,
a State can designate this report as
Sensitive Security Information (SSI).
Comment: One commenter said that
DHS should allow States to employ
exceptions processing on any list of
documents that they deem
circumstantially appropriate. Numerous
commenters opposed prohibiting use of
the exceptions process to demonstrate
lawful status. In general, these
commenters believed that many legal
immigrants and other groups of people
would not be able to meet the rule’s
requirements for proving lawful status.
One commenter said that the scope of
the exceptions process described in the
proposed regulatory text does not
correspond to the scope of the
exceptions process described in the
rule’s preamble. The commenter urged
DHS to revise the proposed regulation to
explicitly include all data elements

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

required under the REAL ID Act within
the scope of the exceptions process.
Response: DHS agrees in part with the
comments submitted. Under this rule,
the exceptions process can now also be
used by a U.S. citizen to establish his or
her lawful status in the United States.
This will accommodate the needs of
elderly or rural residents, for example,
who have not obtained a birth certificate
but were born in the United States. The
exceptions process may not be used by
non-citizens to establish lawful status in
the United States. That status must be
verified in all instances with DHS.
Comment: Several commenters
requested that State records not include
a ‘‘full explanation’’ regarding why
alternative documentation was
accepted. These commenters expressed
concern that victims of domestic
violence would be forced to disclose
their history of abuse and that
information about their location and any
name changes would be widely
accessible in State databases of driver
records. They recommended that a
generic statement be added to records of
victims of domestic abuse that would
indicate that alternative documents
were accepted ‘‘for reasons of public
safety.’’ Three commenters said that it
would not be feasible for States to mark
exceptions in their data files until they
complete computer system upgrades.
Response: DHS agrees that States may
use statements like ‘‘for reasons of
public safety’’ or similar generic
expressions when using the exceptions
process for victims of domestic violence
or others, where the State feels it is
necessary to preserve the confidentiality
of the reason the exceptions process was
used.
Comment: Some commenters
suggested that the exceptions process be
broadened to include specific
populations of individuals who may
have problems producing the required
documents, who may not spend the
majority of time at home (out-of-State
students, active military personnel), or
who may not be able to come to the
DMV in person (individuals with
disabilities). Other commenters,
including AAMVA, suggested that the
exceptions be related to risk and could
factor in year of birth or duration of
continuous relationship with the State
of licensure. Similarly, one State
suggested that the rule grandfather all
current holders of driver’s licenses or
identification cards that were previously
verified as lawfully-present through
SSOLV and/or SAVE.
Response: As noted above, DHS does
not believe it would be beneficial to
establish a uniform exceptions process
for all States. DHS recognizes that each

PO 00000

Frm 00028

Fmt 4701

Sfmt 4700

jurisdiction may face its own unique
and particular set of facts and
circumstances to resolve and that DHS
is unable to address all such
circumstances. DHS believes that States
must have the flexibility to craft an
exceptions process adequate to the
needs of their State and recognizes that
no two State exceptions processes may
be identical.
DHS does not agree with the comment
that individuals can be ‘‘grandfathered’’
for REAL ID purposes. The fact that an
individual once had lawful status in the
United States when checked through
SAVE is not indicative of his or her
present status. As noted elsewhere
above, DHS does not believe it is
burdensome to require an SSOLV check
for all persons seeking a REAL ID
driver’s license or identification card.
H. Temporary or Limited-Term Driver’s
Licenses and Identification Cards
[§ 37.21]
Comment: Two commenters said that
use of the term could cause confusion
with other license types and requested
that another label such as ‘‘limitedterm’’ be substituted to avoid confusion.
One commenter suggested that
temporary cards indicate on the face
whether the holder is a citizen or noncitizen because any immigration status
can be lost or revoked or expire at any
time during life of the card.
Response: DHS agrees with these
commenters. DHS has added the phrase
‘‘limited-term’’ to avoid any confusion
with existing State licensing schemes
involving temporary driver’s licenses or
identification cards. The section of the
rule is now entitled ‘‘Temporary or
Limited-Term Driver’s Licenses and
Identification Cards.’’
Comment: Two States said that
matching the expiration date of a
temporary driver’s license or ID card to
the end date of an applicant’s
authorized stay would require major
internal system and business process
changes and may also require a
legislative change in some States.
Response: DHS notes that matching
the expiration date of a temporary or
limited-term driver’s license to the end
date of an applicant’s authorized stay in
the United States is a requirement of the
statute that DHS lacks the authority to
change.
Comment: Several commenters
opposed the provision limiting the
duration of temporary licenses or ID
cards to the duration of admission or to
one year if the applicant’s authorized
stay does not have a fixed expiration
date. Numerous commenters cited
concern with how the period of
authorized stay is determined, in the

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
event, for example, that a person has a
visa that expires in two years but the I–
94 expires in two months. One country
urged DHS to accept the term of validity
of the visa, which are generally valid for
relatively long periods, as the ‘‘period of
time of applicant’s authorized stay.’’
Response: These comments cannot be
accepted. Section 202(c)(2)(C)(ii) of the
Act requires that the duration of the
driver’s license to be limited to the
period of the person’s authorized stay or
in the case of no specific period, a
duration of one year. DHS does not have
the authority to amend or change this
direct statutory requirement. The period
of admission will be determined not by
documents themselves, but with the use
of the SAVE system which can best
identify a person’s lawful period of
admission. Finally, a visa cannot be
considered to be a person’s period of
authorized stay as a visa only allows a
person to apply for admission to the
United States. It does not represent, in
any sense, permission to stay within the
United States for any particular period
of time.
Comment: Commenters said that this
provision would be unduly burdensome
for many individuals who have lawful
status for extended periods of time, such
as F and J visa holders, and specifically
expressed concern that the rule is
eliminating a long-standing provision
for J–1 participants, who, under State
Department regulations, are entitled to a
thirty-day grace period after completion
of their programs to travel within the
United States One of these commenters
suggested that States be allowed to use
the end dates listed on the certificates
of eligibility for each of these visa types
as the ‘‘ending date’’ of status for the
purpose of obtaining a driver’s license.
Response: Again, the determination
for lawful status in the United States
will be made by the SAVE system, not
particular documents. SAVE takes into
account the grace periods to which
those in certain F and J statuses are
generally entitled. It should be noted,
however, that since F and J nonimmigrants are admitted for ‘‘duration
of status,’’ which is an indeterminate
period, they would normally be issued
licenses valid for one year.
Comment: Two States said that
annual, in-person enrollment for these
individuals would provide little added
homeland security value while
overcrowding DMV offices.
Response: DHS agrees in part with
these comments. The final rule provides
that individuals holding REAL ID cards
that are not temporary or limited-term
may renew remotely where there has
been no material change in the
individual’s information (i.e., name or

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

lawful status) and the State re-verifies
the individual’s lawful status and SSN
where applicable. Because lawful status
can change over time, DHS believes that
it is necessary for a State to determine
that these individuals remain in lawful
status prior to extending the validity
period of any REAL ID-compliant
driver’s license or identification card.
Comment: Three commenters asked
DHS to clarify whether temporary
driver’s licenses and ID cards need to
have the security features of REAL IDcompliant documents.
Response: Temporary or limited-term
driver’s licenses and identification cards
qualify as REAL ID-compliant
documents so they must contain the
same security features as any full-term
REAL ID driver’s license or
identification card.
Comment: One commenter asserted
that temporary driver’s license or
identification cards should not be
permitted because international and
foreign licenses are valid for individuals
who are in the United States for less
than one year.
Response: The REAL ID Act permits
States to issue temporary or limitedterm driver’s licenses and identification
cards. States will continue to determine
how long an individual must be present
or have residence in a State before the
State requires that person to obtain a
driver’s licenses or identification card.
Nothing in these rules precludes States
from permitting an individual to use an
international or foreign license to
operate a motor vehicle in a State.
Comment: Commenters had specific
comments about how this annual
renewal provision would affect
particular groups. Several domestic
abuse advocacy organizations said that
the annual requirement would give
more power to abusers who have
confiscated or destroyed the
identification documents of their
victims. One commenter said that DHS
needs to amend the rule because the
confidentiality requirements under the
Violence Against Women Act (VAWA)
preclude entry of certain immigrant
victims into the SAVE system. The
group suggested that if yearly renewal is
required of immigrant victims, it should
use the fax-back system developed by
the INS to verify eligibility for Federal
public benefits. A State expressed
concern with DHS having defined
‘‘sexual assault,’’ ‘‘stalking,’’
‘‘[d]omestic violence,’’ and ‘‘dating
violence’’ in establishing exceptions for
the REAL ID requirement to display an
individual’s principal residence address
on the license or identification card.
The State argues that the proposed
regulation would require that any State

PO 00000

Frm 00029

Fmt 4701

Sfmt 4700

5299

wishing to comply with the regulations
must adopt the Federal definition of
these crimes. This commenter argues
that DHS can avoid this Federalism
implication by allowing States to
continue to decide who should be
protected under address confidentiality
programs.
Response: DHS agrees, in part, with
these comments. The final rule clarifies
any misperception in the NPRM that a
State would have to adopt the VAWA
definition of certain terms, and makes it
clear that States can continue to enroll
and safeguard victims based on their
own laws. DHS disagrees with the
comments that the renewal requirement
conflicts with any provisions of VAWA.
If an individual’s identity documents
have been destroyed by an abuser, a
State can address this situation through
its exceptions process.
Comment: AAMVA, two other
commenters, and four States expressed
concern with the proposed requirement
that a temporary document clearly state
on its face that it is temporary. The
commenters said that modifying cards
to comply with the proposed rule would
be costly and suggested that the rule
instead allow States to use a restriction
code on the front with clarifying
language on the back. One State
requested that DHS provide the exact
wording that must be displayed on the
face of a temporary card. One privacy
group said that identifying the card as
temporary on its face would amount to
a ‘‘scarlet letter’’ for immigrants and
would lead to discriminatory
interactions with police and other
individuals. One State commented that
it does not support the ‘‘facial branding’’
of cards.
Response: DHS does not agree with
these comments and has clarified the
rule to state that a temporary or limitedterm license must indicate on the
license and in the machine-readable
zone that it is temporary. States may use
different methods to indicate the
temporary nature of the license, such as
using restriction codes on the front of
the card and explanatory text on the
back of the card.
Comment: AAMVA and one State said
that they support in-person renewals for
temporary REAL ID driver’s licenses or
identification cards because lawful
status can change and the population of
individuals with temporary lawful
status is far smaller and easier to
manage with in-person renewals than
the larger population of U.S. citizens. In
contrast, one State requested that DHS
allow applicants to mail in copies of the
appropriate documents proving lawful
status as long as the State verifies the
information via the SAVE system. One

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5300

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

commenter suggested that foreign
students be allowed to renew online if
they are required to do so annually. One
State questioned how many one-year
terms of extension would be permitted
if length of stay is not specified on a
submitted Federal immigration
document. Two States wrote that after
an applicant obtains a REAL ID card, the
applicant should not have to re-supply
source documents for renewals or
conversions. Several States suggested
that the rule state that notice of change
of address may be made on-line or by
mail as long as electronic verification
can be accomplished.
Response: DHS agrees with the
AAMVA comment that individuals
holding a temporary or limited-term
license must renew in person in order
to present evidence of continued lawful
status. DHS believes that this is
necessary because lawful status can
change, and this policy is consistent
with the language of the REAL ID Act.
As such, the requirement remains
unchanged from the NPRM.
Changes of address may be made online, by mail, or as otherwise permitted
by the DMV. There are no limits on how
many years a State can issue a one-year
license or identification card to an
individual who is present for an
undetermined ‘‘duration of status’’ as
long as that individual remains in that
lawful status or another.
Comment: Numerous States expressed
concern that the current processing time
involved in USCIS review of
applications for various immigration
statuses impacted by REAL ID will
result in a large number of applicants
who wish to renew their licenses but
their applications to extend their status
has not been acted on by USCIS within
the year. Two States suggested that
States issue interim documents that
would be valid for very short periods
until an applicant receives his or her
permanent document demonstrating
lawful status. Another commenter
suggested that such an interim card be
based on the applicant’s visa until
authorization is received and verified
through SAVE, which should be
programmed to contact the querying
State when there is an updated
applicant status. One commenter
recommended that the rule allow States
to use a license expiration date 90 days
beyond the expiration date of the
immigration document to allow for
USCIS processing of applications to
extend lawful status. Commenters said
that individuals in certain statuses will
not be able to comply with the
requirement to present documentation
showing extended lawful status upon
renewal because in most cases, their

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

statuses will not have been extended but
merely continued.
Response: Again, State DMVs will use
the SAVE system, and not particular
documentation, to determine that the
license applicant is in lawful status. An
application that is properly filed with
USCIS entitles the person to remain in
lawful status beyond the period listed
on the person’s Form I–94 or other
immigration document, that information
is reflected in the SAVE system. Thus,
aliens in these situations would be able
to obtain REAL ID-compliant licenses
and States would not have to add any
additional processes with USCIS.
I. Minimum Driver’s License or
Identification Card Data Element
Requirements
1. Full Legal Name
Comment: Many commenters raised
issues about the concept of full legal
name. One commenter stated that the
provision infringes on powers reserved
to the States in that it dictates to the
States acceptable methods for name
changes, and that it effectively nullifies
the common law name change process
that some States permit. Proposed
§ 37.11(c)(2) would have required the
applicant to present documents showing
a legal name change, but several
commenters pointed out that these
documents may come from local or
foreign government sources in addition
to Federal and State governments. Two
States opposed the proposed
requirement to present these
documents, and an individual opposed
having name change information on the
REAL ID. One State suggested that the
rule also should provide instructions for
individuals whose gender has been
legally changed.
Response: DHS agrees that where
State law or regulation permits an
individual to establish a name other
than that contained on the identity
document he or she presents for a REAL
ID driver’s license or identification card,
the State shall maintain copies of the
documentation presented pursuant to
§ 37.31 and maintain a record of both
the recorded name and the name on the
source documents in a manner to be
determined by the State. The use of
initials or nicknames shall not be
permitted, except to the extent that an
initial is necessary to truncate a name
longer than 39 characters in length, in
which case the name should be
truncated pursuant to ICAO–9303
standards. DHS also agrees that local or
foreign government-issued documents
can be used to establish a name history.
The final rule reflects these changes.

PO 00000

Frm 00030

Fmt 4701

Sfmt 4700

Comment: Numerous States and
AAMVA stated that there is no standard
naming convention for Federal agencies
and as a result passports, immigration
documents, and social security cards list
disparate names, making identifying the
full legal name difficult. Many States
commented that the Federal government
needs to adopt a single standard for full
legal name and apply it to all Federal
records, rather than depending on the
State DMVs to resolve this in the face of
multiple Federal approaches. Due to
discrepancies among naming
conventions, one commenter suggested
that DHS provide a list of most
acceptable to least acceptable
documents used to establish full legal
name. Several commenters wrote that
documents evidencing a name change
may come from local or foreign
government sources in addition to
Federal and State governments.
Response: DHS agrees that there is no
standard naming convention currently
used by Federal agencies. It would be
beyond the scope of DHS’s rulemaking
authority to impose such a convention
on all Federal agencies. Nevertheless,
the lack of a common Federal standard
does not mean that DHS should not
establish minimum standards for the
States to follow as required by the REAL
ID Act. However, based on comments
received, DHS is slightly modifying the
definition of the definition of ‘‘full legal
name’’ to bring it closer to existing name
conventions used by the Social Security
Administration, the Department of
State, and other issuers of source
documents.
Comment: AAMVA and numerous
States commented that the States need
flexibility and DHS should drop the
prohibition against using initials and
nicknames. One State wrote that the
name on the driver’s license should be
the one the person chooses to use, with
the full legal name stored in the
database and in the MRZ, and that
without common naming conventions,
it is imprudent to assume that a
regulatory requirement forcing the
public to adopt a single name will
achieve any desired end. One State
commented that it should be able to use
an alternative name if the applicant’s
source documents clearly show a link
between that name and the name
presented on other source documents.
Response: As noted above, DHS
agrees that where State law permits an
individual to establish a name other
than that contained on the identity
document presented for a REAL ID
driver’s license or identification card,
the State must maintain a record of how
the name was established in a manner
to be prescribed by the State. The use

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
of initials or nicknames shall not be
permitted, except to the extent that an
initial is necessary to truncate a name
longer than 39 characters in length, in
which case the name should be
truncated pursuant to ICAO–9303
standards. Where the individual has
only one name, that name should be
entered in the last name or family name
field, and the first and middle name
fields should be left blank. Place holders
such as NFN and NMN should not be
used.
Comment: Both States and victim
advocacy groups objected to the full
legal name requirement because the rule
would not provide exceptions for
victims of domestic violence. The rule
would require that past names be
included in DMV records, which would
expose victims to danger. In addition,
the SSA requires victims to change their
names before changing SSNs and
prohibits them from revealing previous
names and SSNs. Commenters wrote
that the proposed rule conflicts with
this prohibition by requiring that the
previous names be revealed as well as
with the court orders under which many
victims are granted new identities.
Response: The REAL ID Act does not
include any exceptions for victims of
domestic violence not to provide their
full legal names. DMVs may want to
take appropriate measures to protect the
confidentiality of those records so that
a stalker or victimizer could not use the
DMV database to locate the individual.
Comment: Many commenters noted
concern with the name requirement for
the MRZ, particularly inclusion of the
name history on the MRZ. States
questioned whether some name
histories would fit on the MRZ. Others
questioned the need for the requirement
if the history is available in the State
DMV database and cited the potential
for abuse. Many also commented that
the requirement would result in a
complete rewrite of States’ systems and
is one of the most costly parts of the
rule. For example, one State commented
that the 125-character field would delay
its implementation for 3 to 5 years until
it can obtain a new mainframe.
Response: DHS agrees with the
comments and is no longer requiring
that the name history be stored on the
MRZ.
Comment: One State asked for
guidelines for translating names from
other alphabets: a name in the Cyrillic
alphabet can be changed to the Latin
alphabet a variety of ways. Another
commenter recommended referencing
the AAMVA name specifications
generically rather than a particular
edition. The commenter also suggested
changing ‘‘Roman alphabet’’ to ‘‘Latin

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

alphabet.’’ Commenters noted other
problems with the full legal name
requirement, such as naming
conventions in other countries and
cultures, conversion of these names
onto various immigration documents,
and the ‘‘Americanization’’ of foreign
names when living in the United States.
Response: DHS has changed ‘‘Roman’’
alphabet to ‘‘Latin’’ alphabet in the final
rule. DHS is not requiring any particular
transliteration method, but notes that
both AAMVA and ICAO have published
standards that address the issues raised
in these comments.
2. Gender
Comment: Two States raised issues
about how gender is determined for
transgender individuals and whether
gender will be included as a verifiable
identifier through EVVE.
Response: DHS will leave the
determination of gender up to the States
since different States have different
requirements concerning when, and
under what circumstances, a
transgendered individual should be
identified as another gender. Data fields
in EVVE are outside the scope of this
rulemaking.
3. Digital Photograph
Comment: A number of States
objected to the requirement to take the
applicant’s photograph at the beginning
of the licensing process because doing
so would require extensive changes to
State processes, facilities, and vendor
contracts. According to one commenter,
only seven States currently take an
applicant’s photo at the beginning of the
process. One State requested a costbenefit analysis for taking the
photograph at the start of the process.
One commenter suggested using an
inexpensive image capture at first, then
replacing the image with the final
digital photo on issuance.
Response: Under § 202(d)(3) of the
REAL ID Act, States must subject each
person applying for a driver’s license or
identification card to a mandatory facial
image capture. Submission of an
application for a driver’s license occurs
at the beginning of the licensing
process, and as such, requires that the
photo be taken at the beginning of the
process. Additionally, from a law
enforcement and operational
perspective, an up-front image capture
process serves as a deterrent to
individuals attempting to present
fraudulent documents or to ‘‘office
shop’’ within a jurisdiction when their
application may have been already
denied in another office.
Comment: A number of commenters
objected to the requirement for a color

PO 00000

Frm 00031

Fmt 4701

Sfmt 4700

5301

photograph because it would bar the use
of laser engraving. One commenter
stated that photographs are better for
checking identities. However, AAMVA
and other States recommended that the
required image be in color.
Response: DHS agrees with those
commenters that a black and white
photograph should also be acceptable in
order to facilitate the use of laser
engraving technology by States choosing
to employ this technology to deter
counterfeiters, and the altering and
tampering of their driver’s licenses and
identification cards. The final rule has
been changed accordingly.
Comment: One commenter suggested
that DHS replace the ICAO 9303
standard’s aspect ratio with the
AAMVA’s aspect ratio, which is the
Universal Camera Aspect Ratio.
Response: DHS believes the proposed
ICAO aspect ratio, with an Image Width:
Image Height aspect ratio range of 1:1.25
and 1:1.34, will accommodate the
AAMVA Universal Camera Aspect Ratio
of 1:1.33.
Comment: Several commenters wrote
that requiring photographs could
burden the free exercise of religion for
some groups, such as Amish Christians
and Muslim women. One commenter
noted that banning the wearing of veils
and scarves would require new State
legislation. Another commenter asked
DHS to clarify that a person may not
wear any garment that affects the
reliability of facial recognition
technologies. Another State said the
regulation should require States to
refuse a license or ID to anyone who
appears in disguise or distorts the face
when photographed.
Response: As DHS stated in the
preamble to the NPRM, the REAL ID Act
requires a facial photograph, which
serves important security purposes.
Given these security concerns and the
clear statutory mandate, DHS believes
that a driver’s license or identification
card issued without a photograph could
not be issued as a REAL ID-compliant
driver’s license or identification card.
Many States now issue non-photo
driver’s licenses or identification cards
based on the applicant’s religious
beliefs. States may continue to issue
these driver’s licenses or identification
cards to such individuals and DHS
recommends that these driver’s licenses
and identification cards be issued in
accordance with the rules for noncompliant driver’s licenses and
identification cards at § 37.71.
While the final rule does not
specifically address individuals who
appear in disguise or who distort their
face when photographed, DHS expects
that States will implement their own

E:\FR\FM\29JAR2.SGM

29JAR2

5302

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

procedures to ensure that the
photographs are accurate
representations of the individuals.
Comment: Some States objected to the
requirement for a profile photograph for
people under 21 years of age because it
will defeat biometric facial recognition
systems. One commenter suggested
printing the cards with a different
orientation to differentiate under-21
licensees while allowing for facial
recognition technologies.
Response: A typographical error in
the NPRM left the misimpression that
DHS was requiring a profile photograph
for individuals under age 21. The final
rule does not require a profile
photograph for people under 21, and
instead requires a full facial digital
photograph.
Comment: One commenter
recommended that States be required to
share their images. Another State
commented that the requirement to
retain images of people suspected of
fraud would mean that they had to keep
all images because the suspicion of
fraud may occur long after the license is
issued, and data storage costs would be
significant.
Response: DHS agrees that there
would be substantial value in
preventing the acquisition of multiple
identity documents if States were able
to exchange images of their license
holders with one another. DHS believes
that the States have the same interest
and therefore States must ensure that
the same individual does not have
multiple driver’s licenses or
identification cards from the same State.
DHS also encourages States to
participate in AAMVA Fraud Early
Warning System (FEWS) or similar
system for exchanging information on
fraud or attempted fraud in the issuance
of driver’s licenses or identification
cards. DHS believes that the volume of
images of individuals who start, but do
not complete the application process,
will not be so great as to impose
substantial data storage costs on the
States.
4. Address of Principal Residence
Comment: One State noted that it has
a ‘‘homeless exception’’ to its proof of
residency requirement where proof of
residency documents are waived if the
applicant provides a letter, on
letterhead, signed by the director of a
homeless shelter, certifying that the
individual is homeless and stays at that
shelter. It suggested that this be an
acceptable action under an ‘‘exceptions
process’’ for the homeless. Other States
voiced concern that the rule does not
address the ‘‘truly homeless,’’ those not
living in a shelter.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

Response: DHS agrees that a letter, on
letterhead, signed by the director of the
homeless shelter, certifying that an
individual is homeless and stays at that
shelter, should be sufficient to establish
an individual’s address of principal
residence under a State’s exceptions
process. As noted above, States have
wide latitude to address issues
concerning an individual’s address of
principal residence within their Statespecific exceptions process.
Comment: AAMVA, other
commenters, and many States
commented that DHS allow States the
authority to provide for the
confidentiality of individual’s address
of principal residence, including the
categories of individuals who would be
subject to the address exception. One
commenter suggested that DHS devise
standard rules governing address
confidentiality rather than allowing
each State to devise separate and unique
requirements. One State claimed that a
confidential address program is
unnecessary.
Response: DHS agrees that States
should have broad authority to protect
the confidentiality of the address of
principal residence for certain classes of
individuals. DHS has added additional
clarifying language in the final rule that
should help to alleviate any
uncertainties.
Comment: Numerous commenters
claimed that the confidential address
provision in the rule did not address all
individuals who may have legitimate
reasons for protecting their addresses
from public disclosure. Commenters
noted that § 37.17(f)(1) was too narrow
and would not qualify individuals who
would otherwise be protected under
State law. Several States recommended
additional address exceptions for the
following categories: sitting and former
judges, Federal officials in limited
circumstances, covert law enforcement
officers as long as the officer provides a
letter of authorization, State
administrative personnel engaged in law
enforcement, participants in the witness
protection program, and victims of
domestic violence. One commenter
stated that the exemption should
include family members when laws or
court orders suppress the addresses of
those individuals.
One commenter claimed that the
partial exemption to the principal
address requirement is inadequate by
removing the option of not listing an
address and relying solely on State laws
that cover a limited number of
individuals. The commenter noted that
only 24 States have confidentiality
programs in place, which is a
requirement for the exemption to apply.

PO 00000

Frm 00032

Fmt 4701

Sfmt 4700

Victims in the remaining jurisdictions
will not be protected unless they can
obtain a court order suppressing their
addresses. Another commenter wrote
that States have created formal address
confidentiality programs and have also
provided general measures of residential
address privacy and this rule overrides
these substantial protections.
Response: As noted above, DHS
agrees that States should have broad
authority to protect the confidentiality
of addresses. DHS has clarified language
in the final rule so that it is clear that
a DMV may apply an alternate address
on a driver’s license or identification
card if the individual’s address is
entitled to be suppressed under State or
Federal law or suppressed by a court
order including an administrative order
issued by a State or Federal court.
Comment: A few States claimed that
use of alternative addresses is justified
on the REAL ID cards, but that the
principal residence must be captured
and stored in a secure database. They
requested clarification from DHS on
how States would meet the
requirements related to the protection of
the principal residence addresses.
Another State noted that it has no
confidential address program, but it
permits a post office box to be displayed
on the identification document if
requested, but again it retains the
permanent address in a database. One
commenter stated that the better level of
protection would be to note in the MRZ
that the individual’s address is
protected and provide a pointer to
whatever relevant authority handles
those addresses for that jurisdiction.
This process would also serve a
secondary purpose in that anyone
seeking the address would make a
request that could be logged and
validated.
Response: DHS agrees that an
individual’s true address must be
captured and stored in a secure manner
in the DMV database even if an alternate
address appears on the face and MRZ
portions of the driver’s license or
identification card.
Comment: One commenter
recommended that the final rule allow
courts to issue administrative orders
suppressing the collection of REAL ID
information or its display on
identification documents in any
jurisdiction where the legislature has
not acted to protect privacy.
Response: DHS agrees with this
comment and has changed the final rule
to reflect that an address may be
suppressed by a court order including
an administrative order issued by a
State or Federal court.

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
5. Signature
Comment: Two States and another
commenter stated that the rule needs to
allow for people who cannot sign the
card, such as minors, and older or
disabled persons. If States use a
signature match, an alternative process
must be available.
Response: DHS agrees with these
comments. Section 37.17(g) now
provides that a State ‘‘shall establish
alternative procedures for individuals
unable to sign their names.’’ This
language gives the States wide latitude
in how to address situations where an
individual is unable to sign his or her
driver’s license or identification card.

rwilkins on PROD1PC63 with RULES_2

6. Physical Security Features
Comment: Numerous States and other
commenters stated that DHS should
provide security objectives or
performance standards, and not specify
particular technologies, materials, or
methods. AAMVA wrote that States are
using the AAMVA Driver Licensing/
Identification Card Design Specification
as the minimum standard and to change
direction now would be costly for
States. AAMVA further commented that
restricting all State-issued driver’s
licenses and identification cards to a
single security configuration could
introduce new security vulnerabilities
rather than protect the driver’s licenses
and identification cards against fraud.
AAMVA wrote that it is not aware of
any jurisdiction that uses all the listed
security features with the proposed card
stock in its card design or production.
Numerous commenters stated that the
proposed requirements would eliminate
over-the-counter issuance systems and
place an unnecessary financial burden
on States.
Response: DHS understands that there
are challenges States may face in
producing secure driver’s licenses and
identification cards. The final rule
removes requirements to use specific
technologies, and provides the
flexibility for States to implement
solutions using a combined set of
security features that provide maximum
resistance to counterfeiting, alteration,
substitution, and the creation of
fraudulent documents from legitimate
documents. DHS will work with
stakeholders to develop performance
standards and a methodology for
adversarial testing.
Comment: Commenters were
concerned that DHS was not targeting
its security enhancement properly, and
that increased security features would
not accomplish the goal of reducing
fraud. AAMVA and another State
commented that major DMV fraud and

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

abuse issues are not associated with the
cards, but with source documents that
cannot be verified, system breakdowns,
and people who breach integrity.
Another State commented that unless
airports, Federal facilities, and nuclear
plants have document authentication
systems, implementation of REAL ID is
without purpose. One State also stated
that unless inspectors are trained in
fraud detection or equipment is
available for detection, fraud will
continue. One commenter
recommended that the AAMVA
fraudulent document recognition
training be used.
Response: DHS agrees, generally, that
no single solution eliminates all fraud
relating to an identity document. That is
why the NPRM proposed, and the final
rule requires, steps to improve internal
procedures at DMVs as well as the
physical driver’s license or
identification card issued by the States.
DHS agrees that fraud detection training
is an important element in an anti-fraud
regime and endorses the use of
AAMVA’s fraudulent document
recognition training or equivalent by the
States.
Comment: AAMVA stated that States
cannot consider making any changes
until existing contracts with card
integrators expire or they will face high
penalties for breaking existing contracts;
any change would require States to
proceed though the competitive bidding
processes, evaluate proposals, award
new contracts, and implement the
complex and expensive process of reengineering their issuance processes.
Any wholesale change in card design
will be costly, complex, and time
consuming. Several States also noted
that contractual processes will slow
implementation.
Response: DHS understands that
existing vendor contracts make it
difficult for some States to make
changes during the term of their card
contracts. The final rule provides
flexibility in card solutions. DHS will
require States to take appropriate
measures to issue driver’s licenses and
identification cards that are resistant to
tampering, alteration or counterfeiting.
Comment: Commenters, particularly
States that issue driver’s licenses and
identification cards ‘‘over the counter,’’
objected to check digit specification,
unique serial number, application of
variable data, and laser printing. One
commenter supported associating card
stock serial number with a customer.
One State agreed with incorporation
into the card of taggant (a radio
frequency identification chip) and
marker, but said that only State
employees need to know if the State is

PO 00000

Frm 00033

Fmt 4701

Sfmt 4700

5303

using such embedded technology. One
State noted that it uses seventeen overt,
covert, and forensic security features to
make counterfeiting difficult; it
recommended that States use different
designs and combinations of security
features to deter counterfeiters. One
commenter wrote that the proposed rule
includes a requirement for an optically
variable feature and suggests that a
‘‘diffractive optically variable feature’’
be included to enhance protection. The
commenter said it is unclear how this
feature enhances protection over
existing State-issued driver’s licenses
and identification cards as many already
use such technology. The commenter
recommended optically variable ink as
a security feature. This ink technology,
currently used in U.S. passports and
outlined in the FIPS 201 security
standards, is not reproducible using
commonly used or available
technologies, and requires much less
training to authenticate quickly. No
readers or special equipment are
required to observe the color shifting
effect, meeting the requirements in the
proposed rule for a Level 1 security
feature. Additional forensic security,
such as micro-flakes with etched on
numbers, logos or words that are visible
under low-power magnification can be
included in the micro-flakes of the overt
optically variable color shift technology,
meeting the requirements in the
proposed rule for Level 2 and Level 3
security features.
Response: The final rule provides for
a performance-based, not prescriptive,
approach to card solutions. Specific
security requirements are not mandated
in the rule. However, the final rule
includes requirements for three levels of
document security designed to provide
maximum resistance to counterfeiting,
alteration, substitution, and the creation
of fraudulent documents from legitimate
documents that are not reproducible
using common or available
technologies. DHS encourages States to
explore the range of existing and stillto-be developed technologies in this
area. The final rule requires States to
use card stock and printing materials
that are not widely available
commercially in order to significantly
decrease the likelihood that a driver’s
license or identification card could be
easily counterfeited or altered.
Comment: One commenter
recommended inclusion of a digital
signature as a Level 3 security feature.
Response: The final rule provides for
performance-based, not prescriptive
requirements for implementation. While
digital signatures offer a higher level of
security, States may choose to invest in
other, similarly secure technologies.

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5304

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

DHS encourages States to consider the
use of this and other security features.
Comment: States asked for
clarification as to the meanings of
‘‘inspector,’’ ‘‘microline text,’’ ‘‘micro
print,’’ ‘‘external surfaces,’’ ‘‘taggant,’’
and ‘‘marker.’’
Response: DHS has removed the
requirements involving these terms, so
does not need to clarify these terms.
Comment: Two commenters stated
that security features should not make it
impossible to copy or create a digital
image of a license, and that the rule
should make it clear that any print on
the image must not obscure the features.
One State asked that DHS remove
language forbidding reproducible
security features and retain § 37.15(f)(2).
Response: DHS agrees that the
security features employed should not
make it impossible to copy or create a
digital image of a license. Many private
sector industries, including the banking
sector, often need to reproduce and
retain a copy of an individual account
holder’s driver’s license or
identification card. DHS also agrees that
print on the image should not obscure
the individual’s features.
Comment: One commenter
recommended incorporating some
security features in the substrate.
Response: The final rule requires level
1, 2 and 3 security features that provide
multiple layers of security, and States
may adopt security features that meet
their needs, including incorporating
security features into the substrate.
Comment: One commenter stated that
requiring a color photo and laser
printing means that two printers will be
needed.
Response: The final rule allows for
either a color or black and white
photograph. Laser engraving, while a
very effective security measure, is not a
requirement of this rule.
Comment: One State commented that
it currently uses adversarial testing for
its cards and provided detailed
information on its process. AAMVA and
several States said that there are no
adversarial testing standards and that
DHS should develop them and either
take responsibility for testing the cards
or certify the testing organizations.
Another commenter recommended that
there should be a single center for
adversarial testing using a single set of
criteria to avoid the undue influence of
vendors and disparate standards. Some
States suggested alternatives to
adversarial testing, such as card design
security programs or security audits.
One commenter suggested that
adversarial testing occur only if the
State card has changed rather than
annually. Another commenter

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

recommended testing every five years or
at contract changes.
Response: The development of
standards and adversarial analysis and
testing of driver’s licenses and
identification cards is an effective
approach to ensuring that these
documents provide maximum resistance
to counterfeiting, simulation, alteration
and creation of fraudulent driver’s
licenses and identification cards. DHS
will work to develop performance
standards and adversarial analysis and
testing.
Independent adversarial testing is an
important tool in limiting the ability of
someone to tamper, alter, or counterfeit
a driver’s license or identification card.
DHS agrees with the comments that
there are no recognized testing
standards to date and a lack of available
and accredited testing facilities.
Therefore, DHS has removed the
requirement for States to obtain an
independent adversarial test of their
card security.
Comment: Numerous commenters
objected to the card stock requirement,
stating that the NPRM design
specification essentially calls for
polycarbonate material and AAMVA
and its members do not support
polycarbonate as the only option for the
cards. This material is not used
anywhere in the United States today, is
the highest cost card material in
production today, and is only available
from a limited number of vendors,
which negates State requirements for
competitive bidding. Another
commenter noted an inconsistency
between polycarbonate card stock and
the requirement to meet ICAO 9303. The
ICAO standard requires a color photo,
but polycarbonate card stock allows
only black and white photos.
Privacy groups supported use of
polycarbonate cardstock in conjunction
with laser engraving because laser
engraving on other card stocks may be
removable. One commenter indicated
that other stocks would function as
well. Another commenter stated that
requirements for card stock durability
should be based on the renewal period
used by the State. One State asked to
whom missing card stock should be
reported.
Response: The final rule reflects a
less-prescriptive approach to card
security, and does not mandate the use
of a specific card stock and prescriptive
security features. The final rule requires
States to use card stock and printing
methods that are not widely available
commercially in order to significantly
decrease the likelihood that a driver’s
license or identification card can easily
be counterfeited or altered. States

PO 00000

Frm 00034

Fmt 4701

Sfmt 4700

should develop and utilize a system of
reporting missing card stock and other
secure supplies and equipment related
to the production of driver’s licenses
and identification cards to other State
DMVs and law enforcement.
7. Machine Readable Technology
Comment: Privacy groups and several
States recommended laws limiting the
collection and storage of Machine
Readable Zone (MRZ) data by third
parties. Several other States commented
on the importance of accessibility for
law enforcement and noted that the
same information is available on the
front of the identification cards in
human-readable form. Some
commenters wanted MRZ access
restricted to law enforcement, while
others supported also providing access
for bars and liquor stores to help
prevent underage drinking but limiting
their collection and storage of the
personal information. One commenter
stated that nothing in the REAL ID Act
authorizes Federal agencies to read and
collect information contained in the
MRZ and cited to the Conference Report
statement that the MRZ must only be
able to be read by law enforcement
officials. One commenter opposed any
indication in the MRZ that a person was
an owner or buyer of firearms or was
licensed to carry a firearm; the
commenter also asked that DHS forbid
the inclusion of this information unless
required by State law.
Response: The REAL ID Act does not
provide DHS with authority to prohibit
third party private-sector uses of the
information stored on the REAL ID card.
As noted in the proposed rule and the
PIA issued in conjunction with the
rulemaking, at least four States
(California, Nebraska, New Hampshire,
and Texas) currently limit third-party
use of the MRZ, and AAMVA has issued
a model Act limiting such use. DHS
encourages other States to take similar
steps to protect the information stored
in the MRZ from unauthorized access
and collection. In response to
commenters urging that the rule limit
Federal agency access to the MRZ, DHS
is not aware of any current plans by
Federal agencies to collect and maintain
any of the information stored in the
MRZ. If a Federal agency should decide
to use the MRZ to collect and maintain
personally identifiable information in
the future, any such information
collected from the MRZ will, of course,
be subject to the protections of the
Privacy Act and other Federal laws and
policies regulating the use and handling
of personally identifiable information.
This final rule does not require (and the
NPRM did not propose) that the MRZ

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
contain any information about firearm
ownership.
Comment: Many commenters
suggested data elements that should or
should not be in the MRZ. AAMVA
stated that the final rule should limit the
MRZ elements to those set out in its
driver license card design standard.
Another commenter wrote that DHS
should set the minimum data elements
in the MRZ at zero and the maximum
at full legal name, date of birth, and
license number. Other commenters
stated that data on the MRZ should be
limited to what is on the face of the
document. One State recommended
inclusion of the issuing State in the
MRZ to facilitate the routing of NCIC
inquiries by law enforcement agencies
using in-car bar code reading
equipment. Another commenter
suggested limiting the MRZ data to a
pointer that does not correspond to the
ID number that would link to a database
limited to law enforcement. One
commenter recommended including the
digital image in the MRZ using the ISO/
IEC 18013–2 standard. Two States
opposed including an inventory control
number (ICN). One commenter objected
to the PDF standard because the NPRM
preamble had referenced adopting most
of the data elements in the 2005
AAMVA Driver’s License/Identification
Card Design, which includes coding for
race.
Response: The final rule mandates
that the States use the PDF417 2D bar
code standard with the following
defined minimum data elements:
Expiration date; holder’s legal name;
issue or transaction date; date of birth;
gender; address; unique identification
number; revision date (indicating the
most recent change or modification to
the visible format of the license or
identification card); inventory control
number of the physical document; and
State or territory of issuance. The
proposal in the NPRM to include the
full name history, including all name
changes, has been dropped. Race is not
a data element contemplated in this
rulemaking and the reference in the
NPRM to the AAMVA standard was not
intended to include race as a data
element in the MRZ for REAL ID.
The majority of commenters on the
issue of data elements recommended
limiting the data elements to those
needed by law enforcement and the
DMVs to carry out their duties. The final
rule sets the minimum elements to
include, but recognizes the authority of
the individual States to add other
elements such as biometrics, which
some currently include in their cards.
Changes in technology in the future
may enable the States to reduce the

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

elements to a pointer that would
electronically link to a database and
provide only authorized parties access
to information that today is stored in the
MRZ. The current technology available
to State DMVs and most law
enforcement officers, however, does not
provide that capability.
Comment: Several commenters said
the 2D barcode is easily copied and
reproduced. One commenter supported
the 2D barcode, but noted that it is not
meant to be a security feature; the 2D
barcode does not allow an upgrade of an
encryption scheme, does not employ
dynamic forms of authentication, does
not store audit trails, and does not use
other security features. One commenter
stated that the rule for the barcode was
insufficient, particularly that there was
no barcode standard specified which
would facilitate the common machine
readable technology requirement
mandated by the REAL ID Act. Two
existing standards could provide the
basis for what is needed: One is the
AAMVA format and the other is the
format in the draft of part 2 ISO
standard 18012. However, the proposed
rule required fields that are specified
differently or are just not in either of
these standards. One commenter
objected to the standard because the
selected version includes coding for
race. One commenter stated that
mandatory requirements make it
difficult to keep up with technology. A
security group and one State stated the
bar code should include a revision date.
Response: DHS recognizes that a 2D
barcode may have security
vulnerabilities and technology
limitations compared to other available
technologies. However, the PDF417 2D
barcode is already used by 45
jurisdictions and law enforcement
officials across the country. A different
technology choice could hamper law
enforcement efforts and may pose an
additional financial burden on the
States. DHS supports efforts of States to
explore additional possible technologies
in addition to the PDF417 2D barcode.
DHS disagrees with the notion that
the standard selected should be rejected
because it includes coding for race. DHS
has never stated that race should be
encoded on the license, and specifically
stated in the proposed rule that it was
not incorporating wholesale the card
data elements currently required by
AAMVA.
Comment: One commenter supported
the decision to omit an RFID device. It
stated, however, that the NPRM does
not discuss what information from a
card should be made available digitally
and what purpose it would serve.

PO 00000

Frm 00035

Fmt 4701

Sfmt 4700

5305

Response: DHS is not requiring that
States employ RFID in REAL ID Act
cards; rather the only technology
required by the final rule is the use of
the PDF417 bar code, which most States
already use on their cards. The
information stored on the MRZ enables
law enforcement officers to compare the
information on the MRZ with the
information on the front of the card to
determine whether any of the
information on the front has been
altered and to automatically populate
law enforcement reports, increasing
officer safety. The ability to run the
MRZ through a scanner device also
enables an officer to quickly retrieve the
information on the card and request
from their dispatch office additional
information on the individual, while
maintaining visual contact with a
suspect, a safety consideration for the
officer.
8. Encryption of MRZ Information
Comment: Commenters were divided
on whether some or all data in the MRZ
should be encrypted. In general, groups
concerned with privacy issues
supported encryption, although one
commenter argued that encryption
would provide a false sense of security.
Three States supported encrypting MRZ
data. Groups supporting encryption
cited the following:
—The capture of data by other users,
such as financial, retail, or
commercial institutions that could
retain, use, and sell the personal data.
—The possible inclusion of additional
private information in MRZ, such as
residential address, race,
[trans]gender, or legal name history
that could expose the holder to harm
if captured and revealed.
—Congressional intent to limit use of
the data to law enforcement.
Some commenters stated that if DHS
does not mandate encryption, it should
at least not prohibit it. Others supported
encryption of only some data,
specifically data not available on the
front of the card. One supporter stated
that DHS should have done a
comprehensive analysis of encryption
systems and their costs and presented
that data.
Numerous other commenters,
including the States and AAMVA,
opposed encrypting the data. Other
commenters were divided among those
who believed it is feasible to encrypt the
data, those who considered it infeasible,
and those who offered alternative
technologies, particularly smart cards
and public key infrastructure.
Commenters opposing encryption cited
the following reasons:

E:\FR\FM\29JAR2.SGM

29JAR2

5306

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

—The difficulty of managing encryption
keys that could be used to decrypt any
REAL ID. If a single key was used,
once the key was compromised, every
driver’s license issued with the key
would be insecure. If multiple keys
are used (e.g., different keys for each
State), then every law enforcement
agency would have to be able to
access all of the keys. Multiple keys
would limit the threat because key
compromise would affect fewer
driver’s licenses, but would increase
the difficulty of using the MRZ data
across the country. Once a key is
compromised, any license issued
using that key would have to be
replaced to be secure.
—The cost of systems for law
enforcement. The costs cited included
the cost to replace existing readers
plus the cost of setting up an
encryption system and the ongoing
costs of managing keys.
—The additional time required for law
enforcement. Particularly if multiple
keys are used, law enforcement and
DMV officials may need more time to
read the data. This added time
requirement would limit the ability to
check the validity of documents
quickly, particularly those from other
States.
—The inability of non-law enforcement
to use the data to verify the validity
of the information on the face of the
card. Businesses also use the MRZ
data to determine if the document is
genuine. Eliminating that ability
would harm businesses that rely on
the driver’s license and would affect
the ability of restaurants and bars to
confirm ages. These businesses can
help identify criminal use of false
documents using the MRZ. Some
commenters argued that the
government should set limits on the
retention and use of the data rather
than encrypt the MRZ.
—The futility of encrypting data present
on the front of the card. Commenters
stated that if the data included in the
MRZ are readable on the front of the
card, encrypting the MRZ provides no
protection because optical scanning
readers are capable of translating the
card data into a database. The
information can also be copied or
transcribed.
Response: DHS considered the many
comments on this issue and
acknowledges that the skimming of the
personally identifiable information from
the MRZ raises important privacy
concerns. Nevertheless, given law
enforcement’s need for easy access to
the information and the complexities
and costs of implementing an

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

encryption infrastructure, no encryption
of the MRZ will be required at this time.
If the States collectively determine that
it is feasible to introduce encryption in
the future, DHS will consider such an
effort, as long as the encryption program
enables law enforcement to have easy
access to the information in the MRZ.
Moreover, DHS, in consultation with the
States, DOT, and after providing for
public comment, is open to considering
technology alternatives to the PDF417
2D bar code in the future to provide
greater privacy protections.
J. Validity Period and Renewals of REAL
ID Driver’s Licenses and Identification
Cards
1. Validity Period
Comment: At least two commenters
said that the proposed eight-year
validity period is too long, because it
would give counterfeiters and forgers
too much time to learn how to simulate
or alter cards in circulation. The groups
recommended that DHS require States
to adopt a validity period of no more
than five years. AAMVA and one State
said that State DMVs should be allowed
to determine the duration of their
licenses based on business processes
and needs. A few States said that a
validity period of no more than eight
years would create difficulties for
elderly and some disabled persons who
are clearly not national security risks.
These States asked for the flexibility to
grandfather these populations or to
issue cards with extended validity
periods.
Response: The REAL ID Act
establishes a maximum license validity
period of eight years. Nothing in the Act
or the rules precludes a State from
adopting a shorter validity period for
business, security, or other needs.
2. Reverification of Source Document
Information
Comment: AAMVA and several States
expressed strong opposition to the
requirement that States re-verify
information and source documents for
renewals and replacements of driver’s
licenses and identification cards. They
said that this requirement would be
costly, burdensome, and unnecessary in
part because of the processes that many
States already have in place for
renewals and replacements. In addition,
some commenters claimed that the
requirement to re-verify source
documents such as address
documentation is impossible to comply
with because there is no electronic
system to do so. One State DMV pointed
out that because Federal and State
databases are not updated in real time,

PO 00000

Frm 00036

Fmt 4701

Sfmt 4700

it is likely that changes would not be
immediately verifiable.
One State supported requiring reverification of birth certificates because
changes to the birth certificate, such as
a name change, could be made after the
original birth certificate verification
occurred. This suggestion would also
allow for matching against State death
information to prevent fraud. Another
State endorsed the re-verification of
information for temporary REAL ID
licenses and for driver and ID card
holders who do not have Social Security
numbers.
Response: DHS agrees with the
comments that it is not necessary to reverify all source documents at renewal.
DHS proposed this requirement in the
NPRM since it recognized that the
quality of recordkeeping in both Federal
and State databases would improve over
time. Instead DHS has amended the rule
to require reverification of SSN and
lawful status prior to renewal and
verification of information that the State
was previously unable to verify
electronically.
Comment: Several State DMVs asked
DHS to clarify exactly what they would
need to do to ‘‘re-verify’’ information.
For example, one State asked if States
would be required to verify each source
document and imaged piece of
information if electronic verification
systems were not available at the time
of initial enrollment. One State asked if
States could use original source
documents to re-verify applicant
information if the documents have
expired since the date of original
verification. Another State asked DHS to
explain the difference between
‘‘verified’’ and ‘‘validated’’ as referenced
in § 37.23(b)(1)(ii) of the NPRM.
Response: As noted above, DHS is not
requiring States to re-verify source
documents at renewal. However, States
must reverify the SSN and lawful status
upon renewal and electronically verify
information that the State was
previously unable to verify
electronically.
Comment: AAMVA said that DHS
should allow States to determine if they
want to re-verify information that has
already been verified by another State.
AAMVA said that the new State of
residency should be able to determine
whether to ‘‘re-vet’’ an applicant’s
information. One State requested that
DHS allow a license transferred from
another State to be renewed or replaced
remotely, even if the new State of
residence does not have electronic
copies of the applicant’s identity
documentation. One State said that the
renewal of a REAL ID-compliant card
should only require the minimum

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

combination of a REAL ID document
and some proof of address. Another
State suggested that States be allowed to
exempt from re-verification applicants
who have been verified at initial
enrollment as U.S. citizens and who
have had no changes to name or Social
Security information. A few
commenters mentioned that a birth
certificate should not be re-verified if
there was a copy of it maintained at the
DMV.
Response: The NPRM did not propose
any requirements for how a State should
treat a REAL ID issued by another State
except to propose that a REAL ID
driver’s license or identification card be
accepted as an identity document, to
establish name and date of birth. When
an individual moves from one State to
another, the new State would still be
required to verify the individual’s SSN
and ensure that he or she is lawfully
present in the United States
3. Renewals
Comment: AAMVA recommended
that § 37.23 be entirely stricken except
for paragraph (b)(2)(iii) of the NPRM,
which would require holders of
temporary REAL ID cards to renew them
in person each time and to present
evidence of continued lawful status.
Response: DHS disagrees with the
comment and believes that it is
necessary to have standards governing
the renewal of a REAL ID-compliant
driver’s license or identification card.
Comment: One commenter wrote that
the rule would make it far more difficult
and expensive for current holders of a
commercial driver’s license (CDL) to
renew or replace their licenses, that
delays and the expense in having a
license renewed or reissued are
particularly important for this segment
of the population, and that they might
force drivers to seek other employment
altogether.
Response: DHS disagrees with this
comment. DHS has not been presented
with evidence that CDL holders will be
affected disproportionately by the REAL
ID requirements or that the REAL ID
requirements will force commercial
driver’s license holders to seek other
employment.
Comment: Commenters expressed
strong opposition to the restriction that
remote transactions would be allowed
only if ‘‘no source information has
changed since prior issuance’’
(§ 37.23(b)(1) of the NPRM). In
particular, many States, AAMVA, and
other commenters wrote that applicants
should be able to make address changes
without having to appear in a DMV
office, and that only material changes
(e.g., name change) should prompt the

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

need for an in-person visit. In general,
commenters wrote that they do not
currently require an office visit for
address changes, and some said they do
not issue a new card when notified of
an address change. They said that
requiring in-person visits for address
changes would dramatically increase
the number of visitors to DMV offices,
with huge cost increases for State
agencies (which some DMVs said the
Federal government should cover),
without necessarily improving national
security. Some States further
commented that making address
changes more difficult for customers
will result in these individuals simply
not notifying the motor vehicle
department of new addresses, which
creates greater problems for State and
local government and law enforcement.
Response: DHS agrees with these
comments and has removed the
requirement that an address change
must be accomplished through an inperson visit to the DMV. Additionally,
there is no requirement in the final rule
for States to issue a new card when
notified of an address change.
Comment: DHS received several
comments on some of the methods
listed in the preamble for authenticating
identity prior to issuing a renewed
license.
Response: Since DHS is only
requiring that States establish a
procedure to ensure that the proper
individual is receiving a renewed
document and is not requiring any
specific method, these comments are
not discussed as they are deemed
outside the scope of the regulation.
Comment: AAMVA commented that
the requirement that every other
renewal take place in-person to allow
for an updated photo would penalize
residents of States with shorter renewal
cycles. One State suggested that
§ 37.23(b)(2) of the NPRM should be
changed to require in-person renewals
and recapture of a digital image once
every sixteen years, regardless of the
period of validity of a State’s cards. Two
commenters stated that allowing sixteen
years between photo updates might be
too long because a person’s appearance
can change significantly during that
time, and that the usefulness of the
photos for facial recognition (manual or
computerized) would greatly diminish
over a sixteen-year time period. One
State recommended that DHS adopt a
ten-year in-person renewal cycle. Two
States commented that exceptions to inperson renewals should be established
for active military and the elderly.
Response: DHS disagrees with the
comments and is retaining the
requirement that a new photo be taken

PO 00000

Frm 00037

Fmt 4701

Sfmt 4700

5307

at every other renewal of a REAL ID
driver’s license or identification card.
Enabling States to maintain their own
renewal cycles permits States to plan for
the flow of people through the DMVs.
While DHS agrees that an individual’s
appearance can change significantly
over sixteen years, DHS has concluded
that an every-other-cycle photo
requirement will meet State needs to
reduce in-person visits at the DMVs
while not posing an unacceptable
security risk. States are free to impose
a more frequent photo requirement.
4. Reissuance of Documents
Comment: One State said that it
would be overly burdensome to require
all applicants for replacement driver’s
licenses or ID cards resulting from lost,
stolen, or mutilated documents to
personally appear at a DMV office.
Another State wrote that, in many
instances, the affected customer will not
have the supporting documents readily
available, which may result in some
individuals driving without a license.
Response: DHS agrees with the
comments. In the final rule, States may
replace a lost, stolen, or mutilated
document without requiring an inperson transaction. Current State
practices will dictate what
documentation needs to be presented
for replacement driver’s licenses and
identification cards.
Comment: Some States, AAMVA, and
several other commenters recommended
against requiring a new card for address
changes and asked that DHS allow
States to propose interim methods of
tracking address changes between
renewal cycles without the requirement
for issuance of a replacement card
(unless State law requires it).
Response: DHS agrees with the
comments. The final rule does not
mandate that a State reissue a driver’s
license or identification card for an
address change unless otherwise
required by State law.
Comment: A number of States
suggested that the definition of
‘‘reissued’’ be changed to indicate that
the license contains material changes to
the personal information on the
document. An applicant for a
‘‘reissued’’ document would be required
to personally appear at a DMV office to
provide proof of the change.
Furthermore, the State suggested that
DHS create a definition of ‘‘duplicate’’
as a card that was issued subsequent to
the original document that bears the
same information and expiration date as
the original.
Response: DHS agrees with the
comments. The final rule does not
mandate a personal appearance at a

E:\FR\FM\29JAR2.SGM

29JAR2

5308

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

DMV for a reissued driver’s license or
identification card unless material
information, such as name or lawful
status, has changed. The final rule
adopts the proposed definition for a
duplicate card.
K. Source Document Retention
Comment: AAMVA expressed
concern about the proposed
requirements dealing with transferring
document images and linking document
images to the driver record, and opined
that the requirement to color scan and
exchange documents using AAMVA’s
Digital Image Exchange program is
misplaced. Another commenter stated
that this program deals only with photos
and that ‘‘it would be a giant leap to
consider its use for documents.’’ Several
commenters objected to the costs of
purchasing scanners, using computer
storage space, retaining color images,
and integrating the image into the driver
record. Some commenters believed the
document retention period should be
the same for paper copies and electronic
storage, while others believed that the
retention period for paper copies should
be shorter than electronic. A few
commenters pointed out that the Driver
Privacy Protection Act and State laws
had their own record retention
requirements. Some commenters
objected to the storage of documents
containing sensitive personal
information as such documents are
attractive target for criminals and
hackers, and thereby pose significant
privacy and security risks.
Response: The specific record
retention period for imaged documents
and paper documents is required by the
REAL ID Act and the final rule applies
those time periods. However, DHS
agrees with the comments that some
source documents may contain sensitive
personal information and has modified
the document retention requirements for
birth certificates. Under the final rule, a
State shall record and retain the
applicant’s name, date of birth,
certificate numbers, date filed, and
issuing agency in lieu of an image or
copy of the applicant’s birth certificate,
where such procedures are required by
State law and if requested by the
applicant.

rwilkins on PROD1PC63 with RULES_2

L. Database Connectivity
Comment: AAMVA stated that DHS
has yet to provide specific information
on how this ‘‘query’’ system will work
and does not expect to provide that
information until the comment period is
over. AAMVA wrote that final
rulemaking should not take place until
there is opportunity for another round

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

of comments and an extension of
compliance dates.
Privacy groups argued that the
proposal does not define security
standards or a governance structure for
managing any of the shared databases
and systems. In their view, this
abdication places the States in an
impossible position: they are being
forced to make their own citizens’
personal information available to every
other State with no guarantee of privacy
or security.
One commenter recommended that
the PCI Data Security Standards that
apply to the credit card industry should
be applied to DMV databases. One
group suggested a decentralized query
system that allows States to check all
other States to see if an applicant
already holds a REAL ID and returns a
yes or no answer, rather than providing
detailed data. One commenter
recommended audit logs and audits to
ensure compliance with privacy
policies.
Response: DHS has provided a brief
overview of the proposed architecture
for data verification and State-to-State
data exchange in the sections above.
This architecture will likely build on
the existing architecture of AAMVAnet
and the systems design principles of its
hosted applications. The proposed
architecture will also build upon the
security, privacy and governance
principles that have guided AAMVA
and the States for decades.
In addition, DHS will work with DOT,
AAMVA and the States to reinforce the
security and privacy features of this
communications and systems
architecture.
Comment: A commenter stated that
DHS had exceeded its authority in the
requirement that interstate access must
be ‘‘in a manner approved by DHS.’’
This commenter stated that since the
rule does not describe, even in general
terms, what the approval is based upon,
States are left to guess at the DHS
criteria for approval. Since the database
exchange and the connectivity thereto
are of utmost importance to States, the
conditions upon which approval will be
based need to be specified in the rule.
They should not be provided by some
yet to be developed guideline issued by
DHS after the rule has become final.
Response: DHS will work with DOT,
AAMVA, and the States to develop a
path forward for both verification
systems and State-to-State data
exchange, including criteria DHS will
employ to evaluate the adequacy,
security, and reliability of such data
exchanges.

PO 00000

Frm 00038

Fmt 4701

Sfmt 4700

M. Security of DMV Facilities Where
Driver’s Licenses and Identification
Cards Are Manufactured and Produced
1. Physical Security of DMV Facilities
Comment: A few States said the
security requirements would force
closure of many DMV offices. At least
one State said that the security
requirements would lead to closure of
remote offices, and that this could lead
the State to opt out of complying with
REAL ID requirements.
Response: In general, DHS does not
agree with comments that indicate a
State would prefer to have a security
vulnerability rather than take the
necessary steps to close it. There have
been a number of well-documented
instances where DMV offices have been
burglarized and the equipment and
supplies to manufacture driver’s
licenses and identification cards taken,
highlighting the need to ensure that
adequate procedures are in place to
protect the equipment and supplies
necessary for the production of REAL ID
driver’s licenses and identification
cards. Protecting these materials and
equipment are critical to reducing the
possibility of fraud and identity theft.
Comment: While a few States
supported the proposed ANSI/NASPO–
SA–v3.OP–2005, Level II standard,
numerous States said that this standard
was intended to apply to manufacturing
facilities, not to the issuance of driver’s
licenses. The commenters opposing use
of the ANSI/NASPO standard stated that
until a reasonable standard is
developed, States should have the
flexibility to determine what works for
their issuance processes. Privacy groups
are concerned that without a uniform
standard, States could have 56 different
security and privacy policies with
different levels of protection.
One State supported a narrow
application of the ANSI/NASPO
standard only to the DMV facility
containing the database on license
holders, while another State thought
that the standards should apply only to
the DMV production facilities. One
commenter wrote that the NASPO
standard needs to be reviewed every
two years and that requirements should
be added throughout the supply chain.
Response: DHS agrees with the
comments that the proposed NASPO
standard may be more appropriate to
manufacturing and production facilities,
as opposed to issuance sites. DHS is not
requiring the use of the ANSI/NASPO
standard in the final rule, but
commends to the States the proposed
standards as a good practice for securing
materials and printing supplies.

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

Comment: One commenter proposed
additional requirements for alarm
systems, disposals, and suppliers.
Another commenter suggested allowing
DMVs to secure part of a building,
rather than the whole building. The
commenter wrote that the standard did
not address the security of work stations
and recommended biometric passwords.
One commenter noted that providing
the license directly to the person, rather
than mailing it, was more secure; one
State noted that the Post Office does not
guarantee delivery.
Response: The final rule specifies
what must be addressed in a security
plan, including physical security of the
buildings used to produce driver’s
licenses and identification cards, storage
areas for card stock and other materials
used in card production, and security of
Personally Identifiable Information (PII).
If a DMV is located in a building
shared by other offices or tenants, the
area dedicated to the manufacture or
issuance of driver’s licenses and
identification cards, storage of card
stock and related materials, and PII
must be secured in such a fashion to
prevent unauthorized access. This
requirement covers any equipment
utilized to produce driver’s licenses and
identification cards as well as storage,
access and retrieval of PII. States will
determine how these items are protected
in their security plans.
The rule does not mandate central
issuance versus over-the-counter
issuance.
2. Security Plan
Comment: One State said that DHS
had exceeded its authority under the
Act in the requirement that a State’s
security plan address ‘‘reasonable
administrative, technical and physical
safeguards to protect the security,
confidentiality, and integrity of * * *
personal information stored and
maintained in DMV * * * information
systems.’’ Another State wrote that the
Act does not authorize DHS to compel
States to establish or make available
standards or procedures for
safeguarding the information collected
by motor vehicle agencies. AAMVA
asserted that tools such as information
security audits, individual employee
access audits, employee confidentiality
polices, and privacy and security plans
are already used in many DMVs.
Privacy groups commented that the
rule must provide meaningful privacy
and security protections and that the
lack of clear privacy and security
guidance in the Act does not preclude
DHS from providing strong protections
in the regulations. In fact, they urged
DHS to include specific standards or

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

minimum criteria against which the
State plans could be evaluated.
At least two States objected to the
provision that DHS could require ‘‘other
information as determined by DHS.’’
The States argued that any further
requirements should be agreed upon
and clearly identified in the regulations.
One State said that unspecified
requirements should not be left to DHS
to develop outside of the regulatory
process. Another State wrote that the
access badge requirement is unrealistic.
Response: DHS believes that it has the
authority to require States to take
reasonable measures to safeguard the
confidentiality of PII maintained in
DMV information systems pursuant to
the REAL ID Act. DHS believes that
inherent in the Act’s requirement that
States must provide electronic access to
the information contained in their
databases is the principle that such
information must be protected, and this
concept is supported in the legislative
history for section 202(d) (12) of the Act
which states that ‘‘DHS will be expected
to establish regulations which
adequately protect the privacy of the
holders of licenses and ID cards * * *.’’
H.R. Rep. No.109–72, at 184 (2005)
(Conf. Rep). Failure to protect the PII
held in DMV databases could result in
identity theft and undermine the very
purpose of the Act, which is to
strengthen the validity of the cards. DHS
also believes that it can require States to
provide other, reasonable information
that DHS determines is necessary in the
future without requiring future
rulemaking.
Comment: AAMVA and several States
requested guidance on what ‘‘written
risk assessment of each facility’’ means
and a template. Another State asked for
guidance on which law enforcement
officials should be notified. One State
recommended that the rule limit the
amount of data in any State’s database
and create stronger protections for
information to limit the danger of
aggregating information on 240 million
Americans.
Response: DHS, DOT, AAMVA and
the States will work together to develop
best practices for risk and vulnerability
assessments as well as for security plans
for DMV facilities.
Comment: A trade association
objected to the lack of standards for the
security plan and further stated that
because the State databases must be
interconnected, the lack of standards
would mean that the weakest plan
implemented by any State would put all
States at risk. DHS should require clear,
strong, and verifiable minimum security
measures. An association said that DHS
was ignoring the threat posed by

PO 00000

Frm 00039

Fmt 4701

Sfmt 4700

5309

insiders, employees and contractors.
According to this association, the rule
should recognize the threat and the
importance of training to mitigate those
risks.
Response: The final rule specifies
what must be addressed in a security
plan, including: Physical security of the
buildings used to produce driver’s
licenses and identification cards, storage
areas for card stock and other materials
used in card production; security of
personally identifiable information
including reasonable administrative,
technical, and physical safeguards, a
privacy policy, and limits on disclosure;
document and physical security features
for the face of the driver’s license or ID
card, including a description of the
State’s use of biometrics and the
technical standards utilized (if any);
access control, including employee
identification and credentialing,
employee background checks, and
controlled access systems; periodic
training requirements in fraudulent
document recognition for covered
employees; emergency/incident
response plan; internal audit controls;
and affirmation that the State possesses
both the authority and the means to
produce, revise, expunge and protect
the confidentiality of REAL ID driver’s
licenses and identification cards issued
in support of Federal, State or local
criminal justice agencies or similar
programs that require the safeguard of a
person’s identity in the performance of
their official duties. Such requirements
shall also apply to contractors involved
in the manufacture or issuance of REAL
ID-compliant driver’s licenses and
identification cards.
3. Background Checks for Covered
Employees
Comment: Generally, States did not
support the proposed background check
provisions. A few States objected to
these provisions as too broad and
impractical. AAMVA stated that these
requirements are a Federal intervention
into State personnel rules and one
commenter stated that these provisions
are a particularly invasive intrusion on
State autonomy to decide the
qualifications and conditions of persons
within its employ, which is a
fundamental attribute of State
sovereignty. States also objected to
§ 37.45(c), the provision instructing the
States to notify persons of unfavorable
checks and provide them appeal rights,
and claimed that this provision may
grant rights nonexistent in State law.
Numerous States said that background
checks and the standards applied
should be at the discretion of the State
and not required. AAMVA and several

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5310

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

States suggested that existing employees
should be grandfathered in to allow
States to determine whether they want
to do complete background checks on
such employees.
Response: DHS disagrees that it
cannot require background checks of
covered employees. Such checks are a
necessary step to protect against insider
fraud, one of many vulnerabilities to a
secure licensing system. DHS also
disagrees with the concept of
‘‘grandfathering’’ existing personnel
since there is no way to know in most
States whether employees who have not
been subject to a background check
would satisfy this important
requirement. Further, § 202(d)(8)
expressly directs States to ‘‘[s]ubject all
persons authorized to manufacture or
produce driver’s licenses and
identification cards to appropriate
security clearance requirements.’’ The
background checks required under this
final rule are authorized by and
consistent with that statutory mandate.
The statute does not provide for an
exemption for personnel employed by a
State DMV before the effective date of
the Act or this final rule and thus DHS
cannot include a grandfather clause in
this rule.
Comment: Some States believed that
DHS has exceeded the authority granted
by the Act on background check
provisions because of its expansive
definition of ‘‘covered employees.’’
These States asserted that DHS is
without authority to extend the
background check requirements beyond
employees who ‘‘manufacture or
produce’’ cards. Similarly, one State
asked that employees at branch offices
who are not involved in the production
and manufacture of driver’s licenses or
identification cards be exempt from the
background check requirements. One
State noted that the rule attempts to
subject ‘‘covered employees,’’
‘‘prospective employees,’’ and
‘‘applicants’’ to the criminal history
record check, yet only defines the term
‘‘covered employee.’’
Response: DHS disagrees that its
definition of a covered employee is too
expansive. DHS, the agency charged
with interpreting and enforcing the Act,
interprets ‘‘persons authorized to
manufacture or produce’’ REAL ID cards
to include those individuals who collect
and verify required source documents
and information from applicants as such
information is a necessary part of the
production of a REAL ID card. It would
be illogical to cover only those DMV
employees and contractors who carry
out only the physical act of cutting or
printing a license while exempting
those individuals who interact with the

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

public and may be most able to
introduce fraudulent information into
the system and thus thwart the intent of
the Act.
Comment: Commenters wrote that
States currently only undertake
background investigations at the time of
hiring, and that since existing
employees are not applicants, it is
entirely reasonable for labor
organizations and permanent State
employees not covered by collective
bargaining agreements to argue that nonprobationary employees fall outside the
scope of the background check
provisions. Some commenters claimed
that the requirement that all designated
employees, including those who are
already employed, undergo background
investigations is contrary to many State
labor contracts and personnel practices.
Numerous employees were hired under
terms and conditions not requiring a
security clearance. Should these
employees be disqualified under the
new regulations, States may be obligated
to provide them with alternative
employment or severance.
Response: As noted above, DHS
believes that it would be a significant
security vulnerability to exempt current
DMV employees from a background
check.
Comment: One commenter claimed
that the use of the phrases ‘‘applicant’’
and ‘‘application’’ in the rule governing
interim disqualifying criminal offenses
poses a practical problem, since the
time periods are defined in terms of the
date of the application. Existing
employees would have been considered
applicants on the date they filed the
application for the position in which
they are currently employed, which may
be well outside the time period that
applies to interim disqualifying offenses
(five years from the date of application).
Thus, commenters argued, the time
period for interim disqualifications
should start from the date of
employment, not application. With
regard to the proposed list of
disqualifiers, AAMVA and some States
wrote that States should determine their
own disqualifying crimes and could
outline those disqualifiers in the DHS
certification package. Several States
objected to the disqualification of
people who have not been convicted on
the grounds that such person should be
considered innocent until found guilty.
Response: DHS agrees that the time
period for interim disqualifications for
existing employees should start at the
date of employment, not application.
DHS agrees that States may supplement
the list of disqualifying offenses with
their own lists, but those lists cannot
replace the Federal list. Finally, DHS

PO 00000

Frm 00040

Fmt 4701

Sfmt 4700

agrees that States may make different
decisions about whether to move an
individual from a covered to a noncovered position even though the
individual has not been convicted, and
can exercise his or her waiver authority
for this purpose under § 37.45(b)(1)(v).
Comment: A few States argued that
States should have the option to give
employees provisional clearance
pending background check results, and
that States could outline the procedures
for provisional clearance in their
certification packages.
Response: As discussed above, DHS
believes that it would be a significant
security vulnerability to exempt current
DMV employees from a background
check. DHS has included language that
substantially similar background checks
(i.e., those that use a fingerprint-based
CHRC check and have applied the same
disqualifiers as this rule; that include an
employment eligibility determination;
and that include a reference check)
conducted on current employees on or
after May 11, 2006, need not be reconducted.
Comment: One commenter wrote that,
of the twenty-nine States that currently
carry out some level of employee
background checks, only two conduct
credit checks. AAMVA and many States
objected to the credit check as costly
and in conflict with State personnel
rules. One State noted that the Equal
Employment Opportunity Commission
(EEOC) has determined that unless
justified by business necessity, it is
unlawful to reject candidates based on
poor credit ratings.
One State asserted that this
requirement is a Federal encroachment
into an area historically reserved to
States. Some States questioned the link
between an employee’s financial history
and the propensity to commit a crime
and posited that implementing this
provision as written would cause many
union-related issues affecting existing
and future employees. Other States
pointed out that many law enforcement
personnel are not subject to this level of
checking. Another commenter objected
to the financial check as an invasion of
privacy that would not provide useful
information, and if DHS requires a
financial history check, it should
provide standards on how the results of
that check should be used by the States.
Response: DHS agrees that it would be
difficult to make conclusive judgments
about an employee or prospective
employee’s vulnerability to bribery
based on a financial history check alone.
Since the financial history check would
not be determinative, DHS is
eliminating the requirement for a

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
financial history check from the final
rule.
Comment: AAMVA said that lawful
status checks are unnecessary and
excessive because States already
conduct such checks as part of the
hiring process. One State noted that the
requirement differs from current Federal
requirements for completion of the
Form 1–9. Other States pointed out that
SAVE only covers immigrants, not
native born Americans. AAMVA and
several States noted that lawful status
checks are often addressed in union
bargaining contracts, and are covered by
State personnel laws.
Response: In response to these
comments and further consideration of
this matter DHS has revised the final
rule. Employment eligibility verification
using Form I–9 procedures is required
for all employees (whether U.S. citizens
or aliens) hired for employment at
DMVs (or any other U.S. employer) on
or after November 7, 1986. REAL ID
defines lawful status in a way that is not
synonymous with employment
eligibility under the INA. Thus, the final
rule now cross-references current Form
I–9 requirements under section 274A of
the INA rather than requiring employees
to be checked through SAVE. As part of
its background check process, the State
must ensure that it has fully complied
with Form I–9 requirements with
respect to covered employees (including
reverification in the case of expired
employment authorization), but
additional status checks are not
required. Nothing in this rule in any
way modifies any Form I–9
requirement; rather, the background
check, if done at a later time than the
initial hire, provides another
opportunity for the State to check its
previous compliance and correct any
deficiencies. Form I–9 completion is, of
course, required no later than three days
subsequent to the first day of
employment for all employees.
USCIS operates, in partnership with
the Social Security Administration
(SSA), an electronic employment
eligibility verification program called
E-Verify (formerly known as the Basic
Pilot program). Participants in E-Verify
can query SSA and DHS databases to
verify the documentation provided by
new employees when completing the
Form I–9. States are strongly encouraged
to enroll in this program, but, consistent
with the voluntary nature of the
E-Verify program as provided by the
statutory provisions authorizing the
program, it is not required by the final
rule.
Comment: One commenter stated that
background check processes are flawed,
misidentifying people five percent of

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

the time. According to this commenter,
in half the States, forty percent of the
arrest records have not been updated in
five years to indicate disposition of the
case. Another State wrote that it would
be easier to run checks if they could
interface with the FBI database. One
State wrote that States should not have
to repeat FBI checks if done within the
past five years. One commenter asked
that the FBI not charge States for
accessing their systems.
Response: DHS believes that a
fingerprint-based background check is
the most efficient way to determine if an
individual is subject to a disqualifying
offense. FBI checks conducted on or
after May 11, 2006 would not need to
be conducted again.
Comment: One commenter said that
workers subject to a background check
deserve a clear and quick process to
clear their names and win their jobs
back with full restitution of any lost
wages. Another commenter suggested
that TSA should incorporate provisions
from the HAZMAT rules which provide
instructions for applicants on how to
clear criminal records into the REAL ID
rule.
Response: DHS believes that an
individual denied employment based on
the results of a background check
should have the ability to challenge the
accuracy of those records. States should
make instructions available on how best
to contest any inaccurate records or
results.
N. State Certification Process;
Compliance Determinations
1. Certification Process
Comment: Several commenters
requested that DHS receive input and
collaborate with States and other
organizations on certification guidance
and standards. One commenter
requested that DHS provide certification
packets outlining specific requirements
as well as a clear definition of ‘‘until all
requirements are met.’’ AAMVA and
several States recommended that States
work with DHS in the development of
a streamlined self-certification process
to meet the requirements of the Act. One
commenter suggested that risk
assessment and mitigation plans be
included in States’ self-certification, and
that States participating in the Driver’s
License Agreement should be able to
substitute their compliance review
process for DHS audit requirements.
One commenter recommended that DHS
establish a committee composed of
Federal and State officials and
representatives of groups which face
unique challenges with respect to the
REAL ID Act to recommend proposed

PO 00000

Frm 00041

Fmt 4701

Sfmt 4700

5311

content for the guidance documents on
certification. Some States asked DHS to
clarify the requirement for States to
provide DHS with any changes to the
information requiring certification.
Regarding guidance requests, a few
States requested a template for the
certification document and the security
declaration as well as a quarterly
reporting standardized format.
Response: DHS has streamlined the
certification process, and includes a
compliance checklist with this rule. The
Material Compliance Checklist will
document State progress toward
meeting DHS security benchmarks and
will serve as the basis for DHS approval
of additional extensions until no later
than May 10, 2011.
Comment: Several States argued that
the certification requirements are too
burdensome, citing staffing issues as
well as the need for ample preparation
time and flexibility to comply with
regulations. Similarly, many States
argued that the frequency of
certification reporting is too
burdensome and questioned the need
for quarterly certification reporting. One
State recommended a triennial review.
Other States thought the requirement to
track all exceptions and to notify DHS
30 days before program changes were
over-reaching and not authorized by
statute. One State recommended that the
DHS establish a system of measuring
performance instead of recertification.
Response: As documented above,
DHS has simplified the certification
process.
Comment: Some States suggested
allowing States whose DMVs fall under
a jurisdiction other than the Governor
the ability for the relevant public official
to certify compliance. AAMVA and one
State argued that the rule should
provide that certification be signed by
the highest-ranking State official
overseeing the DMV, including the DMV
Administrator, and not require
additional certification from the
Attorney General.
Response: DHS agrees that requiring
the Governor of each State to personally
certify State compliance is too
burdensome and has amended the
requirement to allow either the
Governor or the highest-ranking
executive official with oversight
responsibility over the operations of the
DMV to certify State compliance.
2. Compliance Determination
Comment: One State argued that
unless and until a State loses a judicial
review, it should be considered in
compliance. Another State
recommended that DHS recognize States
that have implemented a number of

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5312

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

requirements and plan to continue
making substantial progress as
compliant. A State asked DHS to allow
for the Governor to indicate that the
State will remain in compliance until it
withdraws from the program. Some
States argued that a phased approach
was the only viable means to bring
States into compliance. One State
recommended that DHS convene a
working group with AAMVA to develop
a phasing plan for compliance.
Response: As documented above,
DHS has adopted a compliance process
that significantly lessens the burden of
REAL ID implementation on the States.
Comment: Various State and nonState commenters addressed
noncompliance issues. One State asked
how licenses issued during a compliant
period would be treated if a State later
fell out of compliance. Another State
requested that DHS provide written
notification of preliminary noncompliance determination and notice of
final determination of noncompliance
which would not be effective for 30
business days following receipt. A State
indicated it would not agree with noncompliance issues until the standards
are clearly identified and agreed upon.
One commenter opposed DHS’s ability
to withdraw a State’s certification to
issue REAL ID driver’s licenses and
identification cards on short notice,
noting that decertification would
negatively impact truck driver
communities, government facilities, and
the overall economy of the State.
Response: REAL ID driver’s licenses
and identification cards issued when a
State was in compliance with REAL ID
will remain acceptable for official
purposes until they expire, even if the
State subsequently becomes noncompliant. The REAL ID certification
process will provide a standardized
means of measuring and monitoring the
DMVs’ compliance with REAL ID
requirements. DHS will not withdraw a
State’s compliance on short notice, as
certification reporting dates will be
established in advance.
Comment: A commenter requested
that DHS provide written statements of
notice prior to inspections, interviews,
or any noncompliance determinations.
Some States asked for flexibility and
reasonable prior notice when
scheduling site visits and REAL ID
compliance audits, in order to have
appropriately trained staff available to
answer questions and to prevent audit
overlaps. Commenters believed that
States should have ample opportunity
for review and appeal of decisions
regarding self-certification.
Response: DHS agrees with these
comments. Language has been added to

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

§ 37.59(a) to indicate that DHS will
provide written notice of inspections,
interviews and audit visits. States will
be provided with a sufficient
opportunity for review and appeal of
decisions regarding their selfcertification.
Comment: Commenters addressed
various training issues. One
recommended that DHS allow the
current AAMVA fraudulent document
recognition training program to be used
to meet the REAL ID Act’s requirements.
This program has been used by States
and ‘‘is widely recognized as
comprehensive, directly related to and
easily comprehended by DMV staff.’’
One commenter objected to the
requirement for DHS approval of
fraudulent document training. Another
commenter emphasized the need for
ongoing evaluator/authenticator
training. Without specific requirements
for the training, States lack notice as to
whether or not the training will comply
with the regulations and will be subject
to the unfettered discretion of DHS.
Response: DHS agrees that AAMVA’s
training program on fraudulent
document recognition will be acceptable
to meet the requirement of the Act and
the final rule. The majority of States
currently utilize AAMVA’s program.
Comment: One commenter requested
a definition of ‘‘expedited
consideration’’ of a request for an
extension. Other States requested
opportunity for input, justification, and
consulting in the extension process and
assistance with development of the
quarterly and annual reports. One nonState commenter requested standards
for the issue of redress, and another
suggested that DHS develop standards
and plans to audit States’ security plans.
Response: The final rule spells out a
simple and straightforward process for
States to request an extension to the
REAL ID implementation deadline. DHS
will also allow States to receive an
additional extension based on
achievement of certain benchmarks
established by DHS until no later than
May 10, 2011. DHS will notify a State
of its determination on a request for
extension no later than 45 days of
receipt of the request. DHS will work
with States and territories throughout
the implementation process to assist as
required.
The input DHS receives from its
stakeholders has been of tremendous
value in crafting a final rule that the
States may implement and that achieves
a greater level of security and
confidence in the State-issued driver’s
licenses and identification cards. DHS
will continue engaging its valued
stakeholders to shape the exceptions

PO 00000

Frm 00042

Fmt 4701

Sfmt 4700

processes as well as other requirements
of the rule.
O. Driver’s License and Identification
Cards That Do Not Meet the Standards
of the REAL ID Act
Comment: One commenter did not
agree with DHS that foreign nationals
denied REAL ID licenses, even though
they are lawfully present but do not yet
have the documentation required to
demonstrate such status, can simply
obtain a non-REAL ID alternative. The
commenter wrote that a driver’s license
increasingly has become a ticket to daily
living, and a non-REAL ID license will
unfairly and improperly tag the holder
as ‘‘illegal’’ and result in discrimination.
One commenter wrote that it is not a
valid assumption that most States will
issue some other kind of license for
immigrants who cannot obtain a REAL
ID license. Another commenter wrote
that marking non-REAL ID cards would
divide the country into two groups and
that those with other cards would
instantly be suspect and subject to
delay, harassment, and discrimination.
One commenter noted that many
people such as the elderly or disabled
will not need a REAL ID and asked that
the State be able to issue a noncompliant identification card to them.
By excluding them from the REAL ID
process, it will be easier for the State to
process those who do need a REAL ID
within the time allowed.
AAMVA stated that although DHS has
argued that States do not have to
comply with the Act, the Act and DHS
still impose requirements on States for
the issuance of noncompliant licenses.
AAMVA wrote that this requirement
forces States to be in compliance and
that the rulemaking goes well beyond
Congressional intent in prescriptively
outlining State requirements for ‘‘noncompliant’’ REAL ID cards. One State
and one individual commenter noted
that requiring States to follow these
standards imposes a cost on States that
choose not to comply, a violation of the
10th Amendment. Another State said
that the Federal government cannot
require a redesign of documents if the
State is not complying. The Federal
government should acknowledge the
sovereignty of States’ rights and respect
the traditional State function of
licensing drivers.
Response: DHS does not agree that an
individual carrying a non-compliant
driver’s license or identification card
from a State issuing REAL ID-compliant
driver’s licenses or identification cards
would be subject to discrimination.
States will make their own business and
policy decisions about whether to issue

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

noncompliant cards under 202(d)11 of
the Act.
DHS has clarified in the rule that it
interprets § 202(d)(11) of the REAL ID
Act, which provides requirements for
the issuance of driver’s licenses and
identification cards that will not be
accepted by Federal agencies for official
purposes, as applying only to States
participating in the Act that choose to
also make these types of documents
available. This might apply, for
example, to individuals with a religious
objection to having their photos taken.
DHS does not interpret this section to
apply to States that choose not to
participate in the Act.
P. Section 7209 of the Intelligence
Reform and Terrorism Prevention Act of
2004
Comment: AAMVA, some States, and
several additional commenters support
the development of REAL ID cards that
are WHTI-compliant. AAMVA stated
that this is an important direction to
ensure the free flow of commerce and
travel between the United States and
Canada. Some States said that they
already collected citizenship data and
adding this to REAL ID cards will have
little to no additional cost impact.
Several States argued against
development of a WHTI-compliant/
REAL ID-compliant card. One State said
that citizenship is the purview of the
Federal government and not that of
States, and making a State DMV
responsible for verifying citizenship
places State employees in a Federal role.
This State also noted that citizens with
no desire to cross the border will derive
no additional benefit from obtaining a
REAL ID card that also denotes
citizenship. A few States made similar
arguments that very few of their
residents would find it useful to have a
WHTI-compliant REAL ID card. These
States also argued that the expense to
implement a WHTI-compliant solution
would be cost prohibitive.
One commenter emphasized that
REAL ID cards must not include
citizenship information because of the
potential of discrimination against those
who choose not to carry a national
identification card. Another commenter
said that the creation of a dual-use
driver’s license should be a decision
that is made by individuals, after they
are fully informed of the benefits, risk,
costs, and other details of the programs
consistent with the Fair Information
Principles.
A few commenters stated that they
did not support States listing
citizenship information on the REAL ID
card or using a REAL ID card as an
immigration/border document. These

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

individuals believed that that WHTIcompliant REAL IDs would be
significantly more useful to criminals
and terrorists and therefore targeted for
theft, counterfeiting, and fraud. One
individual suggested that DHS could
mitigate some concerns that the
Department is trying to create a Federal
ID by not requiring DMV to denote
citizenship on REAL ID cards.
All of the organizations that
responded to the question on where
citizenship should be listed on the card
stated that it should be on the machinereadable zone (MRZ) portion of the card.
There were no supporters for listing the
citizenship information on the face of
the card. These organizations all
claimed that placing citizenship
information on the face of the card
could result in discrimination against
the bearer of the card; placing it on the
MRZ portion of the card could prevent
this from happening.
One commenter described in great
detail the need to develop two
encrypted MRZs on the card; one zone
that can only be accessed and used by
DMV and law enforcement officials, and
another zone that can only be accessed
and used by border and immigration
officials. A few organizations
commented that placing the WHTI
information on a card may be
challenging without increasing the size
of the card itself. However, increasing
the size of the card would be extremely
costly.
Response: DHS welcomes the various
helpful comments submitted in
response to DHS’s questions in the
NPRM relating to WHTI. In June 2007,
DHS published a NPRM to implement
the land and sea phases of WHTI. While
DHS acknowledges the desire of some,
but not all, States and other commenters
to use a REAL ID-compliant driver’s
license or identification card as a WHTIcompliant border crossing document,
DHS did not propose that a REAL IDcompliant driver’s license or
identification card serve as a WHTIcompliant document in that NPRM and
does not propose such in this
rulemaking. While the proposed REAL
ID requirements include proof of legal
status in the U.S., the EDL will require
that the cardholder be a U.S. citizen. In
addition, EDLs will include
technologies that facilitate electronic
verification and legitimate movement of
travelers through land and sea ports-ofentry.
Comment: A few commenters
provided suggestions on the types of
business processes and procedures that
a State DMV could adopt to create a
REAL ID that is also WHTI-compliant.
One group suggested that citizens who

PO 00000

Frm 00043

Fmt 4701

Sfmt 4700

5313

desire to have a REAL ID that allows for
WHTI border entry should be vetted by
the State Department in the same
manner as a person applying for a
passport. The State Department would
verify that the individual is eligible to
receive WHTI identification and inform
the appropriate State DMV that the
individual has been approved to obtain
a WHTI-compliant REAL ID. The State
DMV should create the license/ID card
as it normally would and then send it
to the State Department to add the
WHTI MRZ. There should be two
machine-readable zones; one zone
would only be able to be used and
accessed by law enforcement and
DMVs, and another MRZ that would
only be able to be accessed and used by
immigration/border officials.
One organization commented that
State DMVs will need to be able to
utilize the State Department’s
citizenship adjudication process or
create a similar process for adjudicating
citizenship.
One State opposed storing citizenship
data on the MRZ, preferring to store this
information centrally and access it via
electronic means.
Response: DHS welcomes the
comments submitted concerning
potential business practices a DMV
could follow to issue both a REAL ID
and WHTI-compliant driver’s license or
identification card, including issues
surrounding the adjudication of
citizenship for WHTI purposes. As
noted above, DHS published a NPRM to
implement the land and sea phases of
WHTI. At this time, DHS has decided
not to incorporate requirements
necessary for a WHTI-compliant
document into the REAL ID rulemaking.
Comment: Many commenters said
that RFID technology, the proposed
technology for WHTI documents,
should not be used on REAL IDs.
Because RFID can be read from up to
thirty feet away there are significant
privacy and security risks. A few
commenters noted that the DHS Data
Privacy and Integrity Advisory
Committee and the Government
Accountability Office both advised
against using RFID technology. One
organization felt strongly that the use of
RFID technology without the use of
Basic Access Control and other
safeguards would contravene the basic
security features that the Department of
State has included in new U.S.
passports.
Another group believed that States
can leverage the same infrastructure that
they will need to purchase for REAL ID
to incorporate MRZ, proximity chips,
and vicinity chip technology onto a
driver’s license. The only difference

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5314

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

would be the cardstock and the quality
assurance processes to ensure that
electronics within the card are
functioning properly. Another
organization suggested that its product
can turn the wireless function on or off
as needed.
One State suggested that DHS not
identify a specific technology to be
used, but leave it up to the States to
decide.
Response: The use of RFID is essential
to the WHTI program in order to ensure
facilitation at crowded U.S. land and sea
crossing points. Similar concerns are
not implicated by REAL ID, which is
one of the factors that led DHS to select
the 2D bar code as the common machine
readable technology on driver’s licenses
and identification cards. DHS
encourages States to explore alternative
technologies on their driver’s licenses
and identification cards in order to
promote security and technology
advances as well as e-government
initiatives a State may wish to explore.
Comment: There were several other
comments related to the issue of
creating WHTI-compliant REAL ID
cards. One commenter requested
clarification on why REAL IDs
themselves would not be sufficient
documentation to re-enter the United
States. The commenter noted that REAL
ID issuance standards require proof of
lawful residence status within the
United States, and the overall higher
standards will make the cards more
resistant to tampering and
counterfeiting. Therefore, the
commenters argued, it may be presumed
that a holder of a REAL ID license has
the right to re-enter the United States.
Another commenter requested
clarification on whether ‘‘enhanced’’
driver’s license (EDLs) and ID cards that
are issued through pilot programs will
also have to be REAL ID-compliant. The
commenter also requested clarification
on how DHS will respond to States, like
Washington State, that have passed
legislation refusing to comply with the
REAL ID Act unless the Federal
government fully funds the State’s
implementation of the Act.
One commenter requested that DHS
consult with tribal governments on how
to best implement the REAL ID Act and
that DHS consult with tribal leaders on
the development of an Indigenous
Identification Card for international
border crossing.
One individual urged DHS to allow
Canadians who are residents of the
United States to be allowed to obtain
REAL ID/WHTI-compliant driver’s
licenses or ID cards, as these individuals
make up a significant portion of

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

individuals who cross the border
frequently.
Response: DHS acknowledges the
desire of some, but not all, States and
other commenters to use a REAL IDcompliant driver’s license or
identification card as a WHTI-compliant
border crossing document. In the WHTI
NPRM, DHS included a specific
discussion of its ongoing efforts with
Washington State regarding the issuance
and use of an EDL as a WHTI-compliant
document. EDLs can only be issued to
U.S. citizens since the EDL would serve
as the functional equivalent of a
passport or passport card at land and
sea border crossings. In addition, EDLs
must also incorporate the technology
specified by DHS to facilitate the
legitimate movement of travelers
through land and sea ports of entry.
With respect to other holders of REAL
ID-compliant driver’s licenses or
identification cards, any assumption
that lawful status as defined for REAL
ID purposes equates to a right to reenter
the United States is incorrect. For
example, applicants for adjustment of
status typically must obtain advance
parole in order to depart the United
States and lawfully return. DHS has
decided not to incorporate requirements
necessary for a WHTI-compliant
document into the REAL ID rulemaking
at this time.
Q. Responses to Specific Solicitation of
Comments
Question 1: Whether the list of
documents acceptable for establishing
identity should be expanded.
Commenters who believe the list should
be expanded should include reasons for
the expansion and how DMVs will be
able to verify electronically with issuing
agencies the authenticity and validity of
these documents.
Comment: Several commenters did
not think the list of documents
acceptable for establishing identity
needed to be expanded, at least for U.S.
citizens, and they were concerned that
expanding the list would place a burden
on State DMVs. One State did not know
of any additional documents that would
be electronically verifiable. Another
State recommended that the list should
not be included in the rule, so that
future changes can be easily made. One
commenter favored the use of the
‘‘acceptable verifiable resource list’’ of
identity documents approved by
AAMVA. Another State suggested that
the rule should only specify criteria and
procedures rather than a list of specific
documents for establishing identity.
Response: As noted above, DHS has
decided not to alter the list of acceptable

PO 00000

Frm 00044

Fmt 4701

Sfmt 4700

documents proposed and discussed in
the NPRM.
Comment: One commenter thought
that § 37.11 should require non-citizen
applicants to provide their alien
registration documents so that State
officials can compare it to the name on
other documents. Various commenters
pointed out that foreign applicants
would have documents that are not on
the list but may have been issued by
DHS or the courts to prove immigration
status. Some commenters supported
other immigration forms, such as Form
I–94 (which may indicate lawful status
in the United States) and I–797 (which
may be evidence of a pending
application). Refugees and asylees are
more likely to have these documents
before they receive a Form I–766
Employment Authorization Document
(EAD). Canadians present in the United
States might have these forms rather
than a visa. Two States suggested that
any document that can be electronically
verified through SAVE should be
acceptable. Others argued for refugee
status paperwork, expired foreign
passports if USCIS documentation is
current, as well as passports with
expired visas and Immigration Court
documents. One group recommended
that DHS expand the list of acceptable
documentation to include family
members in the United States on
derivative visas. Another group
suggested that USCIS consider issuing a
temporary refugee photo ID card that
could be used to apply for a REAL ID.
Response: State DMVs will use the
SAVE system to verify whether an
applicant for a driver’s license or
identification card is lawfully present in
the United States. Part of the
information required in order to query
SAVE is the name of the individual,
which can be confirmed through one of
the source documents for proving
identity. Applicants are free to use any
other documentation available,
including an I–94 or an I–797, in order
to demonstrate lawful status and assist
the State in making a SAVE check. DHS
also agrees with the commenters who
suggested that any document that can be
electronically verified through SAVE
should be acceptable, since the purpose
of providing that document is to prove
lawful status, not identity. Neither the
I–94 nor the I–797, for example, is
sufficient to prove identity. DHS
believes that refugees and asylees are
issued EADs within a reasonable
amount of time such that they are able
to obtain REAL ID driver’s licenses and
identification cards, and so there is no
reason to include other refugee or asylee
paperwork or documentation to the list
of documents used to establish identity.

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
Applicants who need an immediate
driver’s license can obtain a non-REAL
ID document from States issuing such
cards.
Canadians, however, will need to use
their Canadian passport or obtain a U.S.issued document in order to establish
identity for a REAL ID license, as
neither DHS nor the States can verify in
a timely way that the document has
been issued by the issuing agency (a
foreign government in this case) as the
statute requires. Canadians, however,
can typically drive using their Canadian
driver’s license in the United States and
can also obtain a non-REAL ID driver’s
license from States issuing such cards.
Comment: Some commenters had
specific thoughts about the proposed
provisions on birth certificates. A State
agency suggested that a delayed birth
certificate should be specifically named
as an acceptable document. Other
commenters argued for acceptance of
hospital records or baptismal certificates
within a year of birth and adoption
papers. Another State noted that many
births in rural areas are not recorded,
and suggested that States should be able
to use other documents. Many
commenters wrote that the proposed
requirement for a certified copy would
place a hardship on poor persons and
the homeless.
Response: If State law permits the use
of a delayed birth certificate, that
document can be used by a State.
Hospital and baptismal records are not
acceptable documents to establish
identity, though, in appropriate
circumstances, can be used in a State’s
exceptions process to establish date of
birth or lawful status in the United
States.
Comment: Two commenters
recommended that current State-issued
non-compliant driver’s licenses and
identification cards and bank-issued
credit cards be included on the list of
documents acceptable to prove identity
because technology exists to verify and
authenticate these documents.
Commenters were divided on the
acceptance of Native American Tribal
Documents, with a few commenters,
some Tribes, AAMVA, and two States
supporting acceptance of the documents
(particularly for birth records), and a
few States opposing acceptance of these
documents.
Response: DHS does not believe that
non-compliant driver’s licenses or credit
cards are acceptable documents to
establish identity. No identity
verification has taken place with respect
to these documents. Tribal documents
are addressed elsewhere in the
responses to comments.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

Question 2: Whether the data
elements currently proposed for
inclusion in the machine readable zone
of the driver’s license should be reduced
or expanded; whether the data in the
machine-readable portion of the card
should be encrypted for privacy reasons
to protect the data from being harvested
by third parties; and whether encryption
would have any effect on law
enforcement’s ability to quickly read the
data and identify the individual
interdicted. What would it cost to build
and manage the necessary information
technology infrastructure for State and
Federal law enforcement agencies to be
able to access the information on the
machine readable zone if the data were
encrypted?
See full discussion of comments and
responses to this question in section I.
Question 3: Whether individuals born
before 1935 who have established
histories with a State should be wholly
exempt from the birth certificate
verification requirements of this
regulation, or whether, as proposed,
such cases should be handled under
each State’s exceptions process.
Comment: Numerous commenters
favored the premise that individuals
born before 1935 with established
histories should be exempt from the
birth certificate verification
requirements. Some States added that
States should be allowed to establish
alternative documents acceptable for ID
verification in this circumstance.
AAMVA and some States acknowledged
that many in this age group may not be
able to obtain a birth certificate or
related documents. AAMVA also said
that citizens born before 1951 with ten
or more years of history with the State
DMV and who have passed Stateapproved verifications should be
exempt. Several States said that
electronic verification would likely be
incomplete and non-electronic
verification would be too burdensome
for persons born before 1935. Another
commenter said jurisdictions should be
allowed to segregate the population by
risk assessment to enable a managed
approach to enrollment in REAL ID.
One commenter added that it explicitly
proposes using the term ‘‘American
citizens born before 1935’’ rather than
the term ‘‘individuals.’’ A couple of
States suggested granting an exemption
based on the age of the applicant instead
of an exemption based on a fixed date,
with one suggesting 62 years of age,
based on eligibility to receive social
security benefits, for those persons with
established histories with the State.
Response: DHS has determined that it
will not allow a broad birth certificate
exemption for those persons born before

PO 00000

Frm 00045

Fmt 4701

Sfmt 4700

5315

1935, and allows States to accommodate
such persons as necessary in their
exceptions process.
Comment: States requested
clarification regarding ‘‘established
histories with a State’’ i.e., whether this
means individuals who already have a
license or identification card in the
State where they are seeking a product.
One commenter suggested a history
with the State for a minimum period of
time, such as twenty to thirty years.
This exemption should be part of each
State’s security plan so risks can be
further mitigated through the overall
REAL ID plan at the jurisdictional level.
A couple of States also said that
individuals without established
histories should be handled through the
State exceptions process, enabling
qualified drivers to obtain a compliant
license or identification card. A number
of organizations said that these cases
should be handled under the State
exceptions process. One commenter
wrote that DHS should establish a
standard to which all States should
conform in issuance of birth certificates.
Another wrote that the process should
be thoroughly documented, reviewed,
and updated on an on-going basis. One
commenter wrote that the process
should substitute some form of identity
verification that precludes imposter
fraud. Another commenter wrote that
this elaborate process is itself another
argument in favor of restricting the
Federal role in licensing altogether.
Response: DHS has taken a different
approach to reducing the number of
people that a State DMV must process.
DHS consulted with intelligence
analysts and experts about how best to
target preventive efforts against an
individual attempting to fraudulently
obtain an identification document to
gain access to a Federal facility, nuclear
facility, or commercial aircraft.
DHS has determined that, based on
information it has reviewed, there is a
higher risk that individuals under age
50 will obtain fraudulent identification.
As a result, the rule requires States to
focus enrollment first on individuals
born on or after May 11, 1965 when
issuing REAL ID cards. DHS has further
determined that there is an acceptable
level of risk in deferring the REAL ID
enrollment requirements until
December 1, 2017 for those individuals
who are older than age 50 as of
December 1, 2014.
Comment: Two States said that
customers born before 1935 should
make every attempt to comply with
REAL ID rather than being granted a
blanket exemption. If compliance is not
possible, exceptions procedures (along

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5316

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

with other documents to reasonably
prove identity) should be the next step.
Response: DHS agrees with these
comments and has decided not to adopt
an exemption for individuals born
before 1935, as discussed above.
Comment: AAMVA and several States
said that individuals born before 1935
should not only be exempted from the
birth certificate requirements, but also
wholly exempt from the entire
enrollment process since these
individuals do not pose any potential
threat. However, one State said it lacks
the expertise to opine on the risk of
terrorism this exemption would pose.
Response: As noted above, DHS is not
proposing to exempt any individuals
from the REAL ID enrollment process.
Comment: Other commenters
suggested the following exemptions
from reenrollment: individuals for
whom proof of identity, residency,
lawful status and SSN can be proven
electronically, and citizens who are
elderly, disabled, in nursing homes or
mental institutions and who will not be
getting on an airplane or entering a
Federal facility.
Response: As noted above, DHS is not
proposing to exempt any individuals
from the REAL ID enrollment process.
DHS urges States to make appropriate
accommodations for handling the
elderly, disabled, and those in nursing
homes or mental institutions. Section
202(d)(11) of the Act gives States the
opportunity to issue non-compliant
licenses that are not accepted for official
purposes and may not necessarily
require an in-person enrollment,
depending on the State’s issuance
process.
Question 4: If a State chooses to
produce driver’s licenses and
identification cards that are WHTIcompliant, whether citizenship could be
denoted either on the face or machinereadable portion of the driver’s license
or identification card, and more
generally on the procedures and
business processes a State DMV could
adopt in order to issue a REAL ID
driver’s license or identification card
that also included citizenship
information for WHTI compliance. DHS
also invites comments on how States
would or could incorporate a separate
WHTI-compliant technology, such as an
RFID-enabled vicinity chip technology,
in addition to the REAL ID PDF417
barcode requirement.
See full discussion of comments and
responses to this question in section P.
Question 5: How DHS can tailor the
address of principal residence
requirement to provide for the security
of classes of individuals such as Federal
judges and law enforcement officers.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

See full discussion of comments and
responses to this question in section I.
Question 6: What benchmarks are
appropriate for measuring progress
toward implementing the requirements
of this rule and what schedule and
resource constraints will impact
meeting these benchmarks.
Comment: AAMVA listed ten criteria
for measuring a State’s progress towards
implementation of the REAL ID
requirements—procurement practices,
process changes, contractual
arrangements, funding, legislative
authority, personnel, facilities,
computer systems, new verification
systems, and existing verification
systems. Some States suggested
variations on these themes, proposing
that a set of standardized benchmarks
was not realistic. Rather, each State
should be able to determine appropriate
benchmarks depending on what they
had to do to implement REAL ID.
Progress could be measured against
implementation plans States submitted
to DHS and should be based on a
phased approach. One State suggested
that DHS create a matrix that could be
used to show progress for the major
components of REAL ID. Another State
argued that it is difficult to establish
benchmarks before all regulatory
requirements have been finalized. One
State recommended a ‘‘strategic’’ rather
than ‘‘prescriptive’’ implementation
approach.
One privacy group stated that the
final rule must include robust security
standards for national querying systems.
A vendor association provided detailed
recommendations on access control and
authentication practices. One State
made very detailed recommendations
on privacy standards including a predefined audit requirement. A vendor
association recommended strong
sanctions for violations of procedures to
deter the insider threat and notification
of anyone whose information is
breached.
Response: The final rule specifies the
elements necessary to be REAL IDcompliant, and DHS has proposed a
checklist process for States to
demonstrate completion of certain
compliance benchmarks, and full
compliance with the Act and these
regulations.
Question 7: Adoption of a
performance standard for the physical
security of DMV facility, including
whether DHS should adopt the ANSI/
NASPO ‘‘Security Assurance Standards
for the Document and Product Security
Industries,’’ ANSI/NASPO–SA–v3.OP–
2005, Level II as the preferred standard.
See comments and responses to this
question in section M.

PO 00000

Frm 00046

Fmt 4701

Sfmt 4700

Question 8: How DHS can better
integrate American Samoa and the
Commonwealth of the Northern
Marianas into the REAL ID framework.
Comment: Several States indicated
that individuals from American Samoa
and the Commonwealth of the Northern
Marianas should be issued a REAL ID if
they provided acceptable documents
like birth certificates, valid passports,
unexpired driver’s license, or U.S.
issued immigration documents.
In addition, a few States supported an
exception process for these territories.
One State said that without Federal
funds, it would be difficult if not
impossible for both territories to comply
due to complexity, cost and timing
issues. Some States questioned whether
American Samoa would be able to issue
driver’s licenses and identification cards
under the REAL ID Act and regulations.
Other States claimed that without
evidence of U.S. citizenship, Northern
Marianas residents would not be able to
obtain a license or card. One State
recommended that DHS accept the
Northern Mariana Card (I–873) to
establish identity and residency.
Customers without this card could be
assisted under current State exceptions
processes. Another State also suggested
acceptance of the Re-entry Permit/
Refugee Travel Document (I–327, I–
571).
AAMVA and some States requested
clarification as to the specific issue
caused by these groups of applicants.
Response: DHS believes that
American Samoa and the
Commonwealth of the Northern
Marianas will be capable of complying
with the REAL ID requirements in the
same time frame as other States and
Territories.
Question 9: Whether the physical
security standards proposed in this rule
are the most appropriate approach for
deterring the production of counterfeit
or fraudulent documents, and what
contractual issues, if any, the States will
face in satisfying the document security
requirements proposed in this rule.
Comment: See comments and
responses to this question in section I.
Also, AAMVA commented that States
will face significant contractual
conflicts if the document security
standards in this NPRM remain in the
final rule. States are using the AAMVA
Driver Licensing and Identification Card
Design Specification as the model to
prepare bid packages for new contracts
or renewals. Contract periods for card
vendors vary by State and are driven by
procurement rules. One State, for
example, has a contract in place for the
next seven years. Most States have at
least five year contracts. AAMVA

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
recommended that DHS use the
AAMVA Driver Licensing and
Identification Card Design Specification
as the minimum card security standard,
allowing States to build on its
provisions. States should not be
expected to break or amend existing
contracts and should not be expected to
implement any changes to card security
until their existing contracts expire.
Response: See comments and
responses to this question in Section I.
Question 10: The Federalism aspects
of the rule, particularly those arising
from the background check
requirements proposed herein.
Comment: Several commenters said
that REAL ID was beyond Congress’s
enumerated powers because the States
have a valid immunity claim. Another
commenter wrote that REAL ID usurped
States’ traditional authority. One
commenter wrote that it is a violation of
the tribal-Federal relationship to require
a tribal government official to go to a
State government official in order to
obtain proof of identification in order to
travel and conduct official tribal-Federal
government business. One commenter
said that State DMVs cannot revoke
licenses or identification cards issued
by another State. One State found no
Federalism issues as States are able to
control the design, and, potentially, the
security features of its cards. However,
other States voiced a number of
Federalism concerns.
One State presented a list of impacts
flowing from the REAL ID program:
Procurement practices, process changes,
existing contractual arrangements that
cannot be altered without significant
penalty, fund appropriations, laws,
facilities, computer systems,
requirement of new verification
systems. Similarly, some States argued
that the REAL ID regulation could not
survive a challenge brought under the
10th Amendment of the Constitution. It
continued, ‘‘Given an affidavit issued by
the Governor of the Commonwealth,
DHS would have universal, unfettered
access to employees and systems that
are dedicated to a traditionally State
function.’’ Another State wrote that DHS
should not intrude into the traditional
State function of licensing drivers and
issuing identification cards by
attempting to prescribe the processes for
creating, issuing, and administering
REAL ID cards, and that DHS should
specify the security, performance, and
quality characteristics that REAL ID
participating jurisdictions must achieve.
Some commenters believed that the
REAL ID Act violates both the spirit and
the letter of Federalism law. The
commenters wrote that the REAL ID Act
aims to conscript the States into creating

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

a national ID system, and that it is ‘‘this
kind of scheme’’ that the Framers
expected Federalism to guard against.
Because of this, many States have
passed anti-REAL-ID resolutions and
legislation.
Response: The REAL ID Act provides
the Secretary of Homeland Security
with authority to issue regulations. DHS
understands that there is a balance
between Executive discretion in
interpreting the REAL ID Act through
regulation, while also respecting the
States’ autonomy to govern an
inherently State function—the driver’s
license and identification card issuance
process. DHS has attempted to preserve
State autonomy wherever possible,
while remaining consistent with the
Act, and believes these regulations
represent a logical interpretation of the
Act and Congressional intent.
Comment: One commenter argued
that States should have discretion to
determine whether to conduct
background checks on State employees.
One State DMV said that because it
conducts a fingerprint-based
background check on its employeeapplicants, implementing the REAL ID
requirement would have ‘‘minimal’’
impact. In contrast, one State said that
in requiring a background check for
State employees, DHS is
‘‘overreaching.’’ Because the
requirement includes several checks,
only one of which a DMV could use to
disqualify an employee from performing
certain REAL-ID-related activities, a
State argued that the rule impacts both
the individuals a State may hire and
retain in certain positions. It also
requires a collection of information for
no stated reason. Another State DMV
wrote that DHS goes beyond the
statutory language in requiring a
background check, and suggested that
DHS strike the provision.
With regard to the financial history
check, one State noted that this aspect
of the draft regulation would intrude
into the relationship that State
governments have with their employees.
It argued that DHS could avoid
Federalism issues by having its
regulations ‘‘express the security
characteristics that a State would need
to achieve rather than prescribe how
State processes should operate.’’ The
Federal government, it said, should not
regulate hiring practices for State
employees. One State wrote that it has
discontinued credit checks because it
was not an adequate indicator of a
person’s behavior or ethics.
Response: As noted above, DHS
believes it has the authority to require
background checks. Based on the
comments received, DHS has decided to

PO 00000

Frm 00047

Fmt 4701

Sfmt 4700

5317

eliminate the financial history check of
DMV covered employees and
prospective employees.
Comment: Although one State agreed
that DHS has authority to review State
compliance within the scope and
criteria of the auditing granted by the
statute, this State asserted that DHS
exceeded the scope of its authority in
promulgating § 37.59(a), which lacks a
check on seemingly unlimited Federal
authority to inspect State processes.
Response: DHS does not believe the
language of § 37.59(a) provides DHS
with unfettered authority to oversee the
actions of State government. Indeed, the
section provides the opportunity for
States to challenge a DHS determination
of non-compliance, rather than a
Federal authority with no right of
appeal. DHS has also relaxed the
reporting requirements in this final rule
in response to comments that the
reporting requirements in the NPRM
were too burdensome.
Comment: One State asserted that it is
beyond DHS’s authority to compel nonparticipating States to maintain a motor
vehicle database with the minimum
required REAL ID information and to
share access to any such database with
other States.
Response: DHS is not compelling nonparticipating States to meet any of the
requirements of these rules.
Comment: A State objected to the
requirement that a REAL ID
cardholder’s address change requires
the person to report and document the
change in person at a DMV office. The
State says it is apprehensive that the
proposed rules erode the important
principles of Federalism, especially
regarding managing elections. When a
driver applies for voter registration, the
State automatically checks to see
whether the address given on that card
is the same as the address on a Stateissued driver’s license or identification
card. If there is a mismatch, State law
requires automatically changing the
license or identification card address to
match that on the voter application
form. This State requested that DHS give
serious consideration to allowing this
automatic updating practice to continue.
Another commenter said DHS should
ensure that the final regulations
continue to provide States maximum
flexibility to determine which
employees are subject to the
requirements of this section.
Response: As noted elsewhere, the
final rules do not require an individual
to have an in-person transaction with
the DMV to change their address.
Comment: One commenter said that
because direct regulation of the States
would be unconstitutional, the REAL ID

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5318

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

Act inappropriately conditions Federal
acceptance of State-issued identification
cards and driver’s licenses on their
meeting certain Federal standards. The
commenter was also concerned that
DHS was using State machinery to
implement a Federal program. However,
the commenter asserted that it is within
Federal power for DHS to condition
acceptance of identification cards and
driver’s licenses on priorities closely
related to national security, including
meeting standards for privacy and data
security.
Response: Congress passed the REAL
ID Act to implement a recommendation
of the 9/11 Commission Report to
increase the security, credibility and
confidence in identification documents.
Congress, in drafting the law, and
understanding the Constitutional
concern of directly regulating the States,
made the law binding on Federal
agencies in specifying that only REAL
ID-compliant driver’s licenses would be
accepted by Federal agencies for official
purposes after the law is implemented.
DHS agrees with the commenter that the
Federal government has the authority to
condition acceptance of driver’s licenses
and identification cards on the meeting
of certain standards and requirements as
defined in the REAL ID Act and the
implementing regulations.
Comment: One commenter concluded
that Congress and DHS could have
supported meaningful Federalism by
supporting States’ pre-REAL ID
initiatives to produce an interstate
compact to achieve interoperability of
State databases.
Response: This comment is outside
the scope of the rulemaking.
Question 11: How the Federal
government can better assist States in
verifying information against Federal
databases.
Comment: Several States and other
commenters had a number of
suggestions including the following:
—Develop and test or enhance Federal
databases to meet States’ needs.
—Establish standards for system
performance and connectivity.
—Ensure that matches can be made with
as little manual intervention as
possible.
—Establish standard naming
conventions.
—Put security standards in place.
—Fund system development and assist
States financially in performing
verifications.
Response: DHS is collaborating with
its Federal partners, AAMVA and the
States to design and implement
verification systems to support the
requirements of the REAL ID Act and

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

regulations. DHS is working on
improving the reliability, usability and
accuracy of existing systems like SSOLV
and SAVE to meet States’ needs to
minimize the manual intervention
necessary.
In addition, DHS will work with DOT,
AAMVA and the States to reinforce the
security and privacy features of this
communications and systems
architecture to include practices
consistent with fair information and
Federal Information Security
Management Act principles. In
partnership with DOT, AAMVA, and
the States, DHS will issue best practices
to guide future systems design,
development and operation. DHS is also
working with Federal, State, and
nongovernmental organizations to
identify and improve name formats and
matching algorithms used by identify
verification.
Question 12: In addition to security
benefits, what other ancillary benefits
could REAL ID reasonably be expected
to produce? For example, could REAL
ID be expected to reduce instances of
underage drinking through use of false/
fraudulent identification. If so, please
provide details about the expected
benefit and how it would be achieved
through REAL ID.
Comment: Several commenters wrote
that REAL ID will decrease identity
theft. Several other commenters thought
that a decrease in theft might not be
attributed to REAL ID but be due to the
fact that many States are implementing
more stringent rules for obtaining a
driver’s license.
A few commenters claimed that REAL
ID will have little to no impact on
identity theft. One commenter noted
that most instances of identify theft are
a result of a stolen social security
numbers or credit cards, and that REAL
ID does not address these types of thefts.
Another organization stated that
‘‘loopholes’’ in the source
documentation requirements for those
without a permanent addresses or birth
certificates take away any perceived
REAL ID benefit.
Most of the commenters thought that
REAL ID would increase identity theft.
Commenters wrote that the NPRM did
not propose sufficient protection and
security controls to ensure that the
information being collected and stored
will be immune to theft or misuse.
Several commenters said that the
databases storing digital images of social
security numbers, bank statements, and
birth certificates will be an identitythief’s dream target. These images, once
in the hands of criminals, will be easy
to counterfeit. If systems are linked, a
single breach in security will potentially

PO 00000

Frm 00048

Fmt 4701

Sfmt 4700

compromise 240 million individuals.
Several commenters also highlighted
that threat to this information may come
from within DMVs. One organization
quoted that over 100 million records of
U.S. residents have been exposed due to
security breaches.
Response: DHS provided a detailed
analysis on the ancillary benefits of the
proposed rule on REAL ID. We noted, as
the comments suggested, that the
proposed rule may have only a small
impact on reducing identity theft. REAL
ID will only have the ability to impact
those types of identity theft that require
a drivers license for successful
implementation and only to the extent
that the rulemaking leads to incidental
and required use of REAL ID documents
in everyday transactions, which is an
impact that also depends critically on
decisions made by State and local
governments and the private sector.
With the current costs of identity theft
being high, we believe that even if the
ancillary benefits associated with
identity theft are low, when these
benefits are combined with other
benefits of this rulemaking, that this
rule is cost-beneficial.
Many commenters believe that REAL
ID would increase identity theft. We
find, at the current time, that it would
be difficult to draw any conclusions
such as this since the effort or cost to
individuals to obtain and use a passable
fraudulent identification card is
expected to be much higher than it is at
present. Only those people who believe
that they will reap substantial benefits
would be willing to incur the cost of
creating and using a fraudulent
identification card.
With regard to the general comment
that REAL ID is expected to reduce
instances of underage drinking through
the use of false/fraudulent
identification, DHS believes that REAL
ID may reduce on the margin the rate at
which underage drinking occurs. The
rate at which it does so partly depends
on State and local authority and/or
private employer decisions as to what
form of identification is acceptable for
particular purposes, and the
effectiveness with which identification
checks are implemented. DHS is not
willing to quantify, at this time, the
expected benefits that would be
achieved from a reduction in underage
drinking.
Comment: Regarding the ancillary
benefits of REAL ID, some States
supported DHS’s suggestion that REAL
ID could reduce underage drinking and
purchase of cigarettes by making it
easier for vendors to identify fake
identification cards. Other commenters
wrote that REAL ID could also promote

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
highway safety by allowing law
enforcement officers to process
vehicular accidents and traffic citations
faster and more accurately, and
potentially aid other law enforcement
efforts.
Several commenters noted that one of
the possible ancillary effects of a REAL
ID is that commercial entities will be
able to market to individuals without
the individual’s permission. The MRZ
and the 2–D barcode technology
discussed in the NPRM makes it easier
for third parties to obtain sensitive
information about the holder of the
cards. Several commenters gave
examples of how commercial entities
will make REAL ID the default
document for everyday transactions and
thus will be able to obtain, store, and
track individual’s age, address, and
purchases.
Three organizations noted that State
transactions, such as the issuance of
professional/occupational licenses (for
example, licensing for doctors, lawyers,
nurses, real estate brokers) and hunting
and fishing licenses, could be done with
a higher level of assurance that the
license is being given to the right
person. Two other organizations also
said that health-related and financial
companies would also receive security
benefits associated with more trust in
the validity of the identification cards.
One commenter stated that all
employers would benefit because they
would be better able to determine
employment eligibility.
Response: DHS believes that the
potential ancillary benefits of this
rulemaking would be in many areas.
Should acceptance of REAL ID cards
become widespread, such ancillary
benefits may include reduction in
fraudulent access to public subsidies
and benefits programs, illegal
immigration, unlawful employment,
unlawful access to firearms, voter fraud,
underage drinking, and underage
smoking. DHS believes that REAL ID
may reduce on the margin, the rate at
which these fraudulent activities take
place. The degree to which they do so
will partly depend on State and local
authority and/or private employer
decisions as to what form of
identification is acceptable for
particular purposes, and the
effectiveness with which identification
checks are implemented. DHS cannot, at
this time, measure these benefits
quantitatively.
With regards to organizations,
businesses, etc., DHS is not preventing
the use of REAL ID in State transactions
and the individual who is having the
document presented to him can place

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

any level of trust he/she wants in the
REAL ID document.
Question 13: The potential
environmental impacts of the physical
security standards and other
requirements proposed under this rule.
Comment: A State recommended that
DHS seek out U.S. EPA or a similar
group to evaluate the potential
environmental impacts. One State DMV
wrote that the environmental impacts of
the rule would be minimal. States may
have to perform the required
environmental impact analysis if
changes to issuance facilities are
necessary. AAMVA suggested that
environmental impacts associated with
retrofitting the facilities to meet
physical security standards will result
in some environmental risks such as
asbestos removal.
One State asserted that the increased
visits by individuals to renew their
licenses and corresponding activities
associated with creating a license (for
example, increased usage of electricity,
scanners, copiers, printers, and paper)
will impact air, ground, and water
quality, and result in unnecessary waste
disposal and consumption of natural
resources, electricity, and other fuels
and add to traffic congestion. This State
recommended that DHS revise the rule
to employ a phased approach which
could allow States to certify and renew
on schedules that will not adversely
impact the normally occurring renewal
cycle.
One commenter suggested that the
durability provided by longer life
driver’s licenses and identification cards
could result in less material going into
the waste stream resulting in an
environmental benefit.
Response: DHS carefully evaluated
those comments along with other
potential environmental impacts of this
rule. The comments show that, if the
States choose to create a REAL ID
process, any potential environmental
impacts which might be significant, can
be mitigated. DHS concludes that the
rule’s potential impacts are minimal and
notes that the rule does not force an
immediate action but only lays the
foundation for subsequent action. If
States seek follow-on DHS grant
funding, approval, or other activity for
implementation of the rule, then the
potential environmental impacts
associated with the follow on activity
must be reviewed.
Question 14: Whether other Federal
activities should be included in the
scope of ‘‘official purpose.’’
See comment and response to this
question in section B.
Question 15: How the REAL ID Act
can be leveraged to promote the concept

PO 00000

Frm 00049

Fmt 4701

Sfmt 4700

5319

of ‘‘one driver, one record, one record of
jurisdiction’’ and prevent the issuance
of multiple driver’s licenses.
Comment: Most commenters
supported the ‘‘one driver, one record
concept,’’ and most States said Federal
funding for an ‘‘all drivers’’ system
would promote the concept. A couple of
States specifically endorsed DRIVerS
(Driver Record Information Verification
System). Many States joined AAMVA in
endorsing a State’s initiative to enter
into a Driver License Agreement to
develop ‘‘a nationwide pointer system
with the driver record and driver history
transferred to a ‘change State record’
when the driver moves to a new State.’’
AAMVA and many States also endorsed
basing any such pointer system on the
Commercial Driver License Information
System (CDLIS).
One State said that any ‘‘all drivers’’
verification system must include
‘‘reciprocity rules’’ so that an individual
who is required to move frequently
across States need not undergo a
complete REAL ID check every time.
However, one commenter said a CDLIStype system is a concern because it is a
‘‘one person one license (or ID card) one
record system’’ with no regulatory or
statutory limitations on who can access
information and for what purpose. To
protect privacy and ensure driver safety
across States, the commenter said the
existing Problem Driver Pointer System/
National Driver Register is better.
A few commenters also joined
AAMVA in endorsing the AAMVA/
National Highway Traffic Safety
Administration joint initiative to
develop a digital image exchange project
to identify multiple State license
holders. Some States echoed a comment
from AAMVA that because a driver’s
license applicant must surrender his or
her current license from another State as
a condition of receiving a new license,
the States already follow a policy of one
driver, one license. Another State said
that States should require a driver’s
license applicant to self-declare the
existence of a prior compliant or noncompliant license or card and require
confiscation and notification to cancel
before the new State issues a document.
Several commenters endorsed using the
Driver License Agreement compact as
an extant system for promoting ‘‘one
driver, one record.’’
Other process recommendations
included the suggestion that a national
business process standard be developed
to let jurisdictions know of the theft or
loss of a REAL ID card and forming an
agreement similar to the DLA that both
REAL ID and non-REAL ID States can
use to ensure cross-checking before a
jurisdiction issues any driver’s license.

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5320

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

Requiring ‘‘cleaning’’ of existing
databases and comparing legacy
databases used to issue a REAL–ID
compliant card was also recommended.
One commenter said that having only
one license for multiple purposes would
better promote the concept than having
non-REAL ID and REAL ID driver’s
licenses. It also said that the United
States must accept standards
nationwide to be used with confidence
of driver’s license exchange to move
across boundaries and should
encourage/mandate reciprocity of like
licenses.
Some commenters noted problems
with implementing the ‘‘one driver, one
record’’ concept, stating that, without
participation by all States, the system is
fundamentally flawed in that a person
could hold multiple non-REAL ID driver
licenses and a REAL ID-compliant card.
One State said that DHS lacked
authority to compel a non-REAL ID
State to participate in systems that
promote the concept. It suggested that
the ‘‘one driver, one record concept’’
should only apply to the REAL IDcompliant system.
Other States said the rules should
allow a person to hold both a REAL IDcompliant card and a non-REAL ID card
in any combination ‘‘with the limitation
that a driver has no more than one
license and one card at a time.’’ One
State suggested that a person not hold
more than two REAL ID-compliant cards
at a time: a driver’s license and an
identification card. This commenter
said a person might wish to carry a
REAL ID-compliant card and keep
another at home. One State said that it
issues identification cards to
individuals who may hold a license in
another State.
Some States said that DHS’s proposal
and the REAL ID Act impede ‘‘one
driver, one record.’’ That would happen,
these commenters said, where these
authorities require ‘‘a State DMV to take
measures to confirm that an applicant
has terminated or has taken steps to
terminate a REAL ID driver’s license or
identification card issued in another
State.’’ One State proposed that DHS
change § 37.33(c) to state that a person
who applies for a REAL ID in his or her
State of residence has ‘‘taken steps to
terminate the prior card.’’ One State
wanted to know how DHS would define
‘‘terminate.’’
One State said that because there is no
system through which a State could
check whether a person already holds a
REAL ID driver’s license or
identification card in another
jurisdiction, DHS should eliminate the
requirement that States must make such
a check. Another State asserts that such

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

a capability should exist now across all
fifty States.
Several commenters remarked on the
use of technology to promote the ‘‘one
driver, one record’’ concept. One
commenter endorsed smart cardenabled REAL ID documents requiring a
one-to-one match. A consulting group
described a biometric identifier as the
only known manner to prevent one
individual from procuring more than
one license or identification document.
This commenter said DHS should
identify and standardize a suitable
biometric property and create a privacysensitive solution for performing the
necessary biometric comparisons.
One commenter said that DHS should
have presented and analyzed in detail
different architecture models (other than
CDLIS) for the system States can use to
check whether a REAL ID applicant
already holds a REAL ID card issued by
another jurisdiction. Noting that a
system promoting ‘‘one driver, one
record’’ must promote privacy, security,
and accuracy, another commenter said
CDLIS is not a federated query system,
but a national database. It commented
that simply scaling up this system will
not establish a federated query service,
but will create a national ID.
One commenter wrote that it is
concerned about DHS’s failure to
articulate what defines a person’s
unique driver’s license or identification
card number; the proposed rule is silent
on the form this unique number will
take and does not specify whether the
number will be unique nationally or
solely within a single State.
Response: Section 202(d) of the REAL
ID Act prohibits States from issuing
REAL ID cards to a person who holds
a driver’s license in another State
without confirmation that the person
has terminated, or is taking steps to
terminate, the other license. We have
amended this final rule to clarify this
statutory requirement. See § 37.33. DHS
supports the concept of one driver, one
license. DHS is not, however,
authorized under the REAL ID Act to
use this final rule to prohibit States from
issuing non-REAL ID driver’s licenses to
persons who hold licenses in other
States or to find that a State is not in
compliance with the minimum
standards of the REAL ID Act if such
State issues driver’s licenses to persons
holding licenses in other States. DHS is
limited under its authority in the REAL
ID Act to prohibiting States from issuing
REAL ID cards to persons who hold
licenses in other States or who hold
another REAL ID card.
Question 16: Whether DHS should
standardize the unique design or color
required for non-REAL ID under the

PO 00000

Frm 00050

Fmt 4701

Sfmt 4700

REAL ID Act for ease of nationwide
recognition, and whether DHS should
also implement a standardized design or
color for REAL ID licenses.
Comment: A few States said that
although a REAL ID should be
recognizable as such, a standardized
appearance would facilitate
counterfeiting. Another State suggested
that States should only have to mark
REAL ID-compliant cards, not mark
non-compliant cards. Other commenters
supported the use of an identifier for
non-compliant licenses and cards, as
DHS would need a mechanism to tell if
a license issued before the Act was
compliant. NGA recommended placing
a restriction code on the front of the
license with text on the back to denote
whether the license was REAL IDcompliant. AAMVA, several States, and
another commenter all argued against
standardizing a unique design or color
for the non-Real ID cards. Some
commenters wrote that DHS had no
authority to require States to adopt a
standard design or color for the nonREAL ID cards, citing Federalism. One
commenter wrote that mandating
distinct designs or colors for both REAL
ID and regular license and ID cards and
requiring non-REAL ID driver’s licenses
to have an ‘‘invalid for Federal
purposes’’ designation turns the
voluntary card into a mandatory
national ID. Several also expressed
concern that standardization would
make counterfeiting of the cards easier,
since counterfeiters would only have to
focus on one document. The
consequences of successful
counterfeiting would be more severe,
they said, since the whole system would
be compromised and all States would
then have to change their cards. Some
commenters said that diversity in
security features, as long as they met a
common performance standard, would
be best. Commenters said that a
standardized design would increase the
perception that a national identification
system was being created.
Response: While cards that do not
satisfy the requirements of the Act must
clearly state on their face that they are
not acceptable for official purposes,
DHS is not mandating a specific design
or color for such cards. DHS agrees with
States that recommended marking
compliant cards and as such, requires
compliant cards to be marked with a
DHS-approved security marking.
Comment: Many commenters opposed
a REAL ID standard design. One
commenter wrote that requiring a single
standard configuration will limit the
ability of jurisdictions to adapt to
changing threats in their particular
environment and could drive up costs

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
unnecessarily. Many States expressed
concern about increasing the threat and
consequences of counterfeiting. Several
States said they should be allowed to
continue to use unique designs for their
driver’s licenses and ID cards (one
noting it held great value for State
identity), while others argued that States
should be allowed to maintain control
of the design of their licenses to the
greatest extent possible. AAMVA noted
that its current Card Design
Specification does not require a similar
color for all States, although it
standardizes security features. AAMVA
recommended that ‘‘branding’’ be
applied to the REAL ID, but it also
recognized that this would lead some
individuals to believe this was a step
toward a national ID card. State
commenters wrote that a benefit of a
standard color would be to ease training
of screeners and help ensure that
screeners could easily identify a
compliant REAL ID-compliant card.
One commenter wrote that REAL ID
should mandate a standardized color or
design. However, other commenters
wrote that DHS should not mandate a
standard design or color, that a standard
design is not authorized by the REAL ID
Act, that a standardized design is
strictly prohibited by the Intelligence
Reform and Terrorism Prevention Act of
2004, Public Law 108–458, and that a
uniform REAL ID design would be an
‘‘enormous’’ security risk.
Response: DHS is not mandating a
single design or color for REAL IDcompliant driver’s licenses or
identification cards, and recognizes a
State’s right to have a unique design.
However, in response to several
commenters, DHS is requiring that cards
issued in compliance with REAL ID be
marked with a DHS-approved security
marking.
V. Regulatory Analyses

rwilkins on PROD1PC63 with RULES_2

A. Paperwork Reduction Act
The Paperwork Reduction Act of 1995
(PRA) (44 U.S.C. 3501 et seq.) requires
that DHS consider the impact of
paperwork and other information
collection burdens imposed on the
public and, under the provisions of PRA
section 3507(d), obtain approval from
the Office of Management and Budget
(OMB) for each collection of
information it conducts, sponsors, or
requires through regulations.
This rule contains the following new
information collection requirements.
Accordingly, DHS submitted a copy of
these sections to OMB for its review.
OMB has not yet approved the
collection of this information.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

This final rule will require States
participating in the REAL ID program to
meet certain standards in the issuance
of driver’s licenses and identification
cards, including security plans and
background checks for certain persons
who are involved in the manufacture or
production of driver’s licenses and
identification cards, or who have the
ability to affect the identity information
that appears on the license (covered
employees). This rule will support the
information needs of: (a) The
Department of Homeland Security, in its
efforts to oversee security measures
implemented by States issuing REAL ID
driver’s licenses and identification
cards; and (b) other Federal and State
authorities conducting or assisting with
necessary background and immigration
checks for covered employees.
The likely respondents to this
proposed information requirement are
States (including the District of
Columbia, Puerto Rico, the Virgin
Islands, Guam, American Samoa, and
the Commonwealth of the Northern
Mariana Islands) and State agencies
(such as Departments of Motor
Vehicles).
DHS estimates that each State will
submit a certification of compliance or
request for extension, together with a
security plan. Subsequently, each State
will be required to re-certify its
compliance with the REAL ID Act every
three years on a rolling basis. As part of
the certification package, States will be
required to submit (1) A copy of their
security plan; (2) their documented
exceptions and waivers procedures; and
(3) a written report on card security and
integrity (which must be updated
whenever a security feature is modified,
added or deleted). DHS estimates that
States will spend approximately 42,000
burden hours in the first year to
complete the certification requirements.
DHS projects that the burden hours will
rise to 56,000 hours annually in
subsequent years. DHS estimates the
cost to the States will be $1.11 million
in the first year and $1.48 million every
year thereafter, for an annualized cost
estimate (over three years) of $1.35
million.
States must subject covered
employees to a background check,
which includes a name-based and
fingerprint-based criminal history
records check (CHRC). DHS estimates
States will incur costs for employee
background checks of $1.44 million in
the first year, $0.61 million in the
second year, and $0.37 million in the
third year, for an annualized cost
estimate of $0.80 million.
Finally, States must maintain
photographs of applicants and records

PO 00000

Frm 00051

Fmt 4701

Sfmt 4700

5321

of certain source documents. DHS
estimates that States will incur
2,275,000 hours for information
technology (IT) in the first year, and
348,000 hours in subsequent years, for
an annualized hour burden estimate
(over three years) of 990,333. DHS
estimates that ten percent of all IT costs
is related to the recordkeeping
requirements. Thus, DHS estimates that
out of a total one time cost of $601.9
million for all State systems, ten
percent, or $60.2 million, will be
incurred in the first year, and $9.3
million in the second and third years as
a result of this collection of information,
for an annualized cost of $26.26 million.
DHS received no comments directed
to the information collection burden.
As protection provided by the
Paperwork Reduction Act, as amended,
an agency may not conduct or sponsor,
and a person is not required to respond
to, a collection of information unless it
displays a currently valid OMB control
number.
B. Economic Impact Analyses
Regulatory Evaluation Summary
Changes to Federal regulations must
undergo several economic analyses.
First, Executive Order 12866, Regulatory
Planning and Review (58 FR 51735,
October 4, 1993), directs each Federal
agency to propose or adopt a regulation
only upon a reasoned determination
that the benefits of the intended
regulation justify its costs. Second, the
Regulatory Flexibility Act of 1980 (5
U.S.C. 601 et seq., as amended by the
Small Business Regulatory Enforcement
Fairness Act (SBREFA) of 1996) requires
agencies to analyze the economic
impact of regulatory changes on small
entities. Third, the Trade Agreements
Act (19 U.S.C. 2531–2533) prohibits
agencies from setting standards that
create unnecessary obstacles to the
foreign commerce of the United States.
Fourth, the Unfunded Mandates Reform
Act of 1995 (UMRA, 2 U.S.C. 1531–
1538) requires agencies to prepare a
written assessment of the costs, benefits,
and other effects of proposed or final
rules that include a Federal mandate
likely to result in the expenditure by
State, local, or tribal governments, in the
aggregate, or by the private sector, of
$100 million or more annually (adjusted
for inflation).
Although Congress recognized that
States will have to expend monies in
order to comply with REAL ID, it
explicitly stated that the REAL ID Act is
binding on the Federal government, and
not the States. Moreover, by its terms,
UMRA does not apply to regulations
‘‘necessary for the national security’’

E:\FR\FM\29JAR2.SGM

29JAR2

5322

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

and those which impose requirements
‘‘specifically set forth in law.’’ Thus, as
a matter of law, the UMRA requirements
do not apply to this final rulemaking
even though States will be expending
resources. However, the analyses that
would otherwise be required are similar
to those required under Executive Order
12866, which have been completed and
may be found in the detailed Regulatory
Evaluation placed in the public docket.

rwilkins on PROD1PC63 with RULES_2

Executive Order 12866 Assessment
DHS has determined that this rule
will have an impact of over $100
million and that it raises novel or
complex policy issues. Accordingly, this
rule is economically significant under
Section 3(f)(1) of Executive Order 12866
and therefore has been reviewed by the
Office of Management and Budget.
DHS has assessed the costs, benefits
and alternatives of the requirements
finalized by this rule. A complete
regulatory impact assessment, as
required under Executive Order 12866
and OMB Circular A–4, will be set forth
in a separate document in the docket for
this regulatory action at http://
www.regulations.gov at Docket Number
DHS–2006–0030. The details of the
estimated costs and benefits, including
potential ancillary benefits realized by
the requirements set forth in this rule,
follow the A–4 Accounting Statement.
The uncertainty analyses are being
recomputed and will be published in
the forthcoming final regulatory impact
assessment.
The Department of Homeland
Security (DHS) is conducting a
Regulatory Evaluation of the benefits
and costs of the final minimum
standards for State-issued driver’s
licenses and non-driver identification
cards pursuant to the REAL ID Act of
2005. These standards will impact the
lives of approximately 240 million
people and the operations of all 56 State
and territorial jurisdictions.
Assumptions
This Regulatory Evaluation covers the
eleven-year costs of REAL ID Program
deployment and operations. This
includes:
• Years One through Four—the three
and one-half year period from January
2008 to May 11, 2011 during which
States will have time to make the
business process changes and
investments to meet the standards of
REAL ID. In addition, States meeting the
interim standards of Material
Compliance with the rule must begin
enrolling their populations in REAL ID
beginning no later than January 1, 2010.
• Years Four through Eleven—the
seven year period during which States

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

will continue and complete enrollment
of their populations in REAL ID. States
will begin issuing fully compliant REAL
ID licenses no later than May 11, 2011.
Moreover, DHS has adopted an agebased approach to REAL ID enrollment.
By December 1, 2014 all individuals
born on or after December 1, 1964 (that
is, 50 years of age or under) will be
required to present a REAL ID if they
use a State-issued document for official
purposes. Thus, individuals born on or
after December 1, 1964 will have a
minimum of four years to obtain a REAL
ID. Individuals born before December 1,
1964 will have an additional three years
to enroll before the final enforcement
deadline of December 1, 2017.
The final rule incorporates significant
changes to the Notice of Proposed
Rulemaking. As a result, we have
revised some of the assumptions upon
which the original Regulatory
Evaluation was based. The revised
assumptions are detailed below:
(1) That All States Will Comply in
Accordance With the Revised Timeline
DHS recognizes that most, if not all
States will be unable to comply by May
2008 and will file requests for
extensions that will result in
compliance implementation schedules
that could mitigate some of the startup
costs examined below. Hence, the costs
allocated to the period prior to May
2008 will be redistributed to subsequent
years.
(2) That 75 Percent of the Nation’s DL/
ID Holders Will Seek a REAL ID
Credential
The original NPRM assumed that
100% of the candidate population
would seek to obtain REAL IDs. This
assumption was combined with two
additional assumptions, namely that:
1. States will not require all
individuals to obtain a REAL ID;
2. Some States will continue to issue
non-compliant licenses along with
REAL IDs.
The Department has reviewed the
100% assumption and concluded that it
is unrealistic in light of the latter two
assumptions. If States do not require all
applicants to obtain REAL IDs, it is
highly improbable that 100% of the
population will apply. It is difficult to
cite any example of a truly voluntary
course of action that results in 100%
compliance. If States offer a choice of
either compliant or non-compliant
licenses to applicants, some portion of
the population will choose to receive a
non-compliant license because:
1. They do not need a REAL ID for
Federal official purposes.

PO 00000

Frm 00052

Fmt 4701

Sfmt 4700

2. They already possess a substitute
document—for example, a U.S.
passport—that will serve the same
purpose as a REAL ID.
Thus, the Department has
reconsidered and eliminated the
assumption that every individual 16 or
older will seek to obtain a REAL ID
within the timeframe of this analysis.
The difficult question, therefore, is
what level of participation in REAL ID
can be realistically expected? What
should be the primary estimate for
participation by the American public in
REAL ID?
The Regulatory Evaluation utilizes a
primary estimate of 75% based upon the
following analysis:
1. A significant number of States will
not require that all residents seeking
driver’s licenses or identification card
obtain a REAL ID. Eight states currently
issue licenses to individuals who cannot
demonstrate lawful states and a
significant number of States are likely to
make REAL IDs an option.
2. 25% of the population already
holds a valid passport and the
Department of State anticipates that this
figure will increase to approximately
33% in the next few years.3 Individuals
with valid passports do not need to
obtain a REAL ID as passports are likely
to also be accepted for the same official
purposes (i.e., boarding commercial
aircraft) as a REAL ID.
3. 20% of the population has never
flown on a commercial airplane and
47% flies ‘‘rarely or never.’’ 4 This
second group is unlikely to need a
REAL ID and members of this group are
highly unlikely to belong to the group
of valid passport holders.
4. These two groups, combining to
constitute a group of at least 40% of the
population, should not need to obtain a
REAL ID as acceptance of identification
for official purposes. Assuming that a
large proportion of this group will seek
to obtain a REAL ID regardless of
imminent need, we believe that 25% of
the candidate population will not seek
to obtain a REAL ID.
(3) States Will Issue Both REAL IDs and
Non-REAL IDs
DHS anticipates that States will offer
an alternative DL/ID (not acceptable for
official purposes) to those who are
3 Testimony of Maura Harty, Assistant Secretary
of State for Consular Affairs, before the Senate
Foreign Relations Committee, International
Operations and Organizations Subcommittee, June
19, 2007, at http://travel.state.gov/law/legal/
testimony/testimony_806.html.
4 Statistics reported in The Airline Handbook,
issued by the Air Transport Association and located
at http://members.airlines.org/about/
d.aspx?nid=7954 and by the Gallup Organization at
http://www.gallup.com/poll/1579/Airlines.aspx.

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
unwilling or unable to obtain a
compliant one. A number of States issue
or plan to issue licenses to individuals
that cannot document lawful status.
Other States are expected to allow
individuals to hold both a driver’s
license and identification card. Finally,
a number of States have evaluated or
expressed interest in offering REAL IDs
as an additional, voluntary license. This
Regulatory Evaluation assumes that
States will deploy a two-tier or multitier licensing system. States instead may
choose to issue only REAL ID-compliant
driver’s licenses and identification
cards, thereby reducing their
operational and system costs.5

Status Quo section.) Also, the final
regulation creates a one-year license for
certain aliens. DHS was able to
determine that some people already
hold such licenses, but not how many
people hold them. DHS was also unable
to determine how many people will
hold them under the REAL ID rule.
While this methodology has limitations,
using the typical validity period of DL/
IDs was the most reliable method
available to estimate future issuances.

(4) That All IT Systems Will Be
Functional by May 11, 2011
The NPRM assumed that all IT
systems would be functional by May 11,
2008. DHS now recognizes that this
assumption was overly optimistic.
Therefore, DHS has extended the
deadline for compliance with the rule
until May 11, 2011 to give the States,
Federal agencies, and non-governmental
organizations like AAMVA the time to
complete the communications and IT
infrastructure needed to implement
REAL ID. Therefore, DHS has
recalculated the costs assuming that all
required verification data systems be
operational and fully populated by May
11, 2011, the deadline for full
compliance by States. DHS is working to
bring these systems on-line and up to
standards as soon as possible and will
work with the States to develop
alternative procedures.

DHS has computed the costs for the
over age 50 drivers by moving that
segment of renewals towards the 2017
deadline. DHS assumes the distribution
over time for renewals is similar to the
rest of the population. Therefore these
license renewals are not bunched up but
entered as the same distribution as other
drivers but with the last of the pool
completing in 2017.

rwilkins on PROD1PC63 with RULES_2

(5) That State Impact Is Not Uniform
Due to Progress Already Made in Some
States
States that have already invested in
improving the security of their licenses
will have to invest far less per capita
than States with less secure licenses and
issuance processes. Those States that are
more advanced will incur lower
compliance costs than other States.
(6) The Typical Validity Period of
Driver’s Licenses in a Given State is the
Validity Period for All DL/IDs in That
State
DHS is aware that within a State DL/
IDs often have varying validity periods
but was unable to determine how many
people held each of these varying types
of credentials and when they were
issued. (For more details, see the
discussion of Validity Periods in the
5 Eight states currently issue licenses to
undocumented immigrants and will—most likely—
continue to do so. These States are: Michigan,
Maryland, Hawaii, New Mexico, Oregon, Utah,
Washington, and Maine.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

(7) Those Drivers Who Would Be
Required To Comply Later in the
Issuance Cycle Will Take Advantage of
This Delayed Compliance

(8) The Cost of Lost/Stolen DLs/IDs and
Central Issuance Is Included in the Cost
of This Final Rule
The regulatory evaluation for the
proposed rule assigned the cost of
having to replace a lost or stolen legacy
ID with a REAL ID as being a regulatory
compliance cost. This means that if an
individual loses his/her legacy license,
the burden of replacing it with a REAL
ID requiring an in-person visit was
attributed to this rulemaking. The
regulatory evaluation for the final rule
employs the assumption that
individuals who replace their lost or
stolen legacy license will choose to
obtain a REAL ID and pay the additional
opportunity costs of an in-person visit
to the DMV with the required source
documents. After careful consideration,
we believe that this assumption may be
conservative based upon the revised
requirements of the final rule. The
enrollment periods of REAL ID have
been designed to enable DMVs to enroll
individuals with REAL IDs on their
normal renewal cycles to the maximum
extent possible. Individuals simply
replacing a lost or stolen license are
likely to want a replacement license as
quickly as possible and delay the
process of obtaining a REAL ID until
their scheduled renewals. However, we
maintain the original assumption in this
economic analysis because we cannot
estimate the different rate at which lost
or stolen licenses will be replaced with
REAL IDs. Therefore, we assume the
rate to be 75% or the same as that for
renewals.

PO 00000

Frm 00053

Fmt 4701

Sfmt 4700

5323

The regulatory evaluation still
assumes that States will move to central
issuance because of the high cost of
printing equipment for REAL ID cards.
However, the final rule provides added
flexibility and therefore States may not
have to do this. We are not adjusting
this regulatory evaluation to account for
this due to uncertainties in States’
behavior under the revised provisions of
this final rule, and because there are
remaining requirements in this final
rule that may still make central issuance
the most efficient response.
(9) The Cost of Security Markings on
REAL ID Cards
Based on discussions with State
driver’s license card vendors, we have
estimated the cost for a security marking
for compliant cards to be $0.25 per card,
and have included this cost estimate in
the card production analysis later in this
document.
The final rule also requires that if a
State issues a license that is not in
compliance with REAL ID, the State
must by statute and regulation indicate
on the document that it is not valid for
official Federal purposes. According to
U.S. license vendors contacted by
DHS, 6 there is typically an upfront one
time set up fee for the State, which may
include license redesign, system
reconfiguration, and other related costs.
Based on our analysis of information
received from vendors and States, DHS
estimates that the added cost would be
about $10,000 per State, or $.01 per
document. The actual cost will vary
depending on the State, vendor and any
existing contractual agreement they may
have concerning design changes. DHS
believes that the added cost of no more
than $0.01 per document will be
indirectly incurred by those individuals
who will be acquiring REAL IDs.
Summary of Major Differences Between
the Final Rule and NPRM
Based upon the many comments
received, the Final Rule incorporates
major changes from the NPRM. The
major changes impacting the economic
analysis include:
(1) Extension of Deadlines
In the NPRM, DHS proposed that
States that would not be able to comply
by May 11, 2008, should request an
extension of the compliance date no
later than February 10, 2008, and
encouraged States to submit requests for
extension as early as October 1, 2007.
During the public comment period, DHS
6 Based upon conversations between the REAL ID
program office and U.S. license vendors, December,
2007.

E:\FR\FM\29JAR2.SGM

29JAR2

5324

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

received numerous comments from
States and Territories, State
associations, and others, noting that
almost all States would be unable to
meet the May 2008 compliance
deadline. Accordingly, to allow more
time for States to implement the
provisions of the rule in general and
verification systems in particular, DHS
is also providing in the final rule the
opportunity for States to request
extensions of the compliance date
beyond the initial extension of
December 31, 2009. To obtain a second
extension, States must file a Material
Compliance Checklist by October 11,
2009. This checklist will document
State progress in meeting certain
benchmarks toward full compliance
with the requirements of this rule.
States meeting the benchmarks shall be
granted a second extension until no
later than May 10, 2011. This would
give States making significant progress
additional time to meet all of the
requirements of this rule.
(2) Extended Enrollment Periods and
Risk-Based Enrollment
The NPRM proposed that States
determined by DHS to be in full
compliance with the REAL ID Act and
these implementing regulations by May
11, 2008, would have a five-year phasein period—until May 11, 2013—to
replace all licenses intended for use for
official purposes with REAL ID cards.
During the public comment period, a
number of States and State associations
commented that States obtaining an
initial extension of the compliance date
until December 31, 2009, would still be
required to enroll their existing driver
population (estimated to be
approximately 240 million) by May 11,
2013—essentially halving the phase-in
period. Several commenters suggested
that DHS employ a risk-based approach
that would permit States and DMVs to
focus first on perceived higher-risk
individuals while deferring lower-risk
individuals to a date beyond May 11,
2013.
DHS agrees with both these
comments. Accordingly, in this final
rule, DHS is extending the deadline for
enforcing the provisions of the Act for
all driver’s licenses and identification
cards until no later than December 1,
2017, but requiring REAL ID-compliant

driver’s licenses and identification cards
for individuals 50 years of age or under
(that is, individuals born on or after
December 1, 1964) when used for
official purposes beginning on
December 1, 2014. This will effectively
give States an eight-year enrollment
period beginning in January 1, 2010
when Materially Compliant States can
begin the enrollment process, thus
avoiding an unnecessary operational
burden on State DMVs from a crush of
applicants on or before the original May
11, 2013 compliance date.
(3) Physical Card Security
DHS has modified the proposed card
security requirements in response to
comments which stated that the
requirements were too prescriptive and
placed an undue burden on the States.
Instead, DHS has proposed a
performance-based approach that
provides the flexibility for States to
implement solutions using a welldesigned balanced set of security
features for cards that, when effectively
combined, provide maximum resistance
to counterfeiting, alteration,
substitution, and the creation of
fraudulent documents from legitimate
documents.

rwilkins on PROD1PC63 with RULES_2

Estimated costs
(11 years)

17:10 Jan 28, 2008

Jkt 214001

Costs and Benefits

PO 00000

Frm 00054

Fmt 4701

This Regulatory Evaluation attempts
to quantify or monetize the economic
benefits of REAL ID. In spite of the
difficulty, most everyone understands
the benefits of secure and trusted
identification. The final minimum
standards seek to improve the security
and trustworthiness of a key enabler of
public and commercial life—Stateissued driver’s licenses and
identification cards. As detailed below,
these standards will impose additional
burdens on individuals, States, and
even the Federal government. These
costs, however, have been weighed
against the quantifiable and
nonquantifiable but no less real benefits
to both public and commercial activities
achieved by secure and trustworthy
identification.
Economic Costs
Implementing the REAL ID Act will
impact all 56 jurisdictions, more than
240 million applicants for and holders
of State DL/IDs, private sector
organizations, and Federal government
agencies.
Figure 1: summarizes the estimated
marginal economic costs of the final
rule over an eleven year period.
Figure 1: Estimated marginal
economic cost of REAL ID final rule.

$ million

$ million

$ million
(2006 dollars)

Percent total

7%
discounted

3%
discounted

Undiscounted

Undiscounted

Costs to States ........................................................................................
Customer Services ...........................................................................
Card production ................................................................................
Data Systems & IT ...........................................................................

VerDate Aug<31>2005

DHS agreed with comments that the
financial history check would not be
determinative. Therefore, DHS has
eliminated the requirement for a
financial history check from the final
rule.

Based on an analysis of feedback from
several commenters, DHS has
determined that it would be in the best
interest of the nation’s security for
States to place a security marking on
driver’s licenses and identification cards
that are issued in compliance with the
REAL ID Act. Such a marking would
facilitate the verification of the
authenticity of such documents by
Federal agencies requiring identification
for official purposes.

Based on feedback from commenters,
DHS has eased the reporting and
documentation requirements placed
upon States by circumscribing the scope
of security plans and requiring
submission of updated plans and
certification packages on a rolling,
triennial basis.

Based on numerous responses, DHS
has removed the requirement that an
address change must be accomplished
through an in-person visit to the DMV.
Additionally, there is no requirement in
the final rule for States to issue a new
card when notified of an address
change. Moreover, DHS now allows
States fuller discretion over the
acceptance of address documents by
removing specific requirements that
documents used to demonstrate address
of principal residence be issued
‘‘monthly’’ and ‘‘annually.’’
(7) Financial Check

(4) Marking of Compliant REAL ID
Documents

(5) Certification and Security Plan
Documentation

(6) Address Change and Documentation
Requirements

2,879
636
690
1,171

Sfmt 4700

3,413
804
822
1,352

E:\FR\FM\29JAR2.SGM

29JAR2

3,965
970
953
1,529

39.9
9.8
9.6
15.4

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

Estimated costs
(11 years)

5325

$ million

$ million

$ million
(2006 dollars)

Percent total

7%
discounted

3%
discounted

Undiscounted

Undiscounted

Security & Information Awareness ...................................................
Data Verification ...............................................................................
Certification process .........................................................................
Costs to Individuals .................................................................................
Opportunity Costs ....................................................................................
Application Preparation (125.8 million hours) ..................................
Obtain Birth Certificate (20.1 million hours) .....................................
Obtain Social Security Card (1.6 million hours) ...............................
DMV visits (49.8 million hours) ........................................................
Expenditures: Obtain Birth Certificate .....................................................
Cost to Private Sector .............................................................................
Costs to Federal Government .................................................................
Social Security card issuance ..........................................................
Data Verification—SAVE ..................................................................
Data Systems & IT ...........................................................................
Certification & training ......................................................................

365
5
11
3,808
3,429
2,186
348
31
864
379
8
128
36
9
65
17

415
7
13
4,814
4,327
2,759
440
37
1,091
479
9
150
43
11
74
21

490
8
16
5,792
5,215
3,327
530
44
1,315
577
9
171
50
14
82
25

4.9
0.1
0.2
58.3
52.5
33.5
5.3
0.4
13.2
5.8
0.1
1.7
0.5
0.1
0.8
0.3

Total Costs ................................................................................

6,853

8,406

9,939

100.0

Figure 1 shows the primary estimates
calculated in both undiscounted 2006
dollars and discounted dollars at both
the 3% and the 7% discounted rates.
The total, undiscounted eleven-year cost
of the final rule is $9.9 billion. Based on
a total of 477.1 million issuances over
the 11-years of the analysis, the average
marginal cost per issuance for States is
$8.30. Individuals will incur the largest
share of the costs as shown in Figure
ES–2. More than 58 percent of the costs
(discounted or undiscounted) are
associated with preparing applications,
obtaining necessary documents, or
visiting motor vehicle offices.
The costs shown in Figure ES–2 show
a substantial decrease in those reported
in the NPRM. In particular, the costs for
States are 27% of those estimated for the
NPRM. This substantial decrease in
costs can be attributed to a number of
factors, including a revised assumption
that only 75% of DL/ID holders will
apply for a REAL ID as well as a less
prescriptive, performance-based, and
balanced approach to REAL ID
implementation. As many commenters
suggested, providing additional time for
implementation and enrollment of DL/
ID holders will allow States to
accommodate the enrollment process
without disrupting their normal renewal
cycles, resulting in a decrease in total
REAL ID issuances from 813 million to
477 million issuances. In addition, the
undiscounted estimates for card
production costs have decreased
substantially from $5.8 billion in the
NPRM to $953 million in the final rule
based on the performance-based
approach to card security standards
recommended by numerous
commenters.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

DHS recognizes that many States have
made significant progress in improving
the integrity of their licenses. DHS also
recognizes that the prescriptive
technology standards included in the
NPRM, compared to the final rule,
provided relatively few additional
security benefits at great cost to States.
Moreover, the estimated opportunity
costs to individuals have been reduced
from $7.1 to $5.8 billion in
undiscounted dollars primarily as a
result of the changed assumption that
only 75% of DL/ID holders will seek
REAL IDs. Individuals will still have to
obtain source documents and visit their
DMVs under this analysis. Finally, the
undiscounted costs to States for data
systems and IT have actually increased
from $1.4 billion in the NPRM to $1.5
billion in the final rule. This slight
increase reflects the critical role of
information technology and verification
systems in reducing identity theft and
identity fraud in the issuance of DL/IDs.
The four largest cost areas, in
descending order (in undiscounted
dollars) are:
• Opportunity costs to individuals
($5.2 billion),
• Maintaining the necessary data and
interconnectivity systems ($1.5 billion),
• Customer service ($970 million),
and
• Card production and issuance ($953
million)
The largest impact category is the cost
to individuals of obtaining source
documents, preparing applications, and
visiting DMVs. The magnitude of this
category is driven largely by the fact that
all applicants for a REAL ID will need
to complete an application process
similar to those of a first-time driver or
a driver moving from one State to
another.

PO 00000

Frm 00055

Fmt 4701

Sfmt 4700

The second largest impact category is
the creation and maintenance of
necessary data and interconnectivity
systems. These systems will require
substantial up-front effort to create but
are likely to require smaller marginal
increases in maintenance costs.
The third largest impact is customer
service. While the extension of the
enrollment period in the final rule will
minimize marginal increases in the
number or flow of transactions, the rule
accounts for costs that increased
transaction and wait times will produce.
REAL ID should not substantially
accelerate the rate of transactions, but
the per transaction costs to States will
increase.
The fourth largest impact is the
production and issuance of the REAL
IDs themselves. The final minimum
standards are intended to make
counterfeit production, tampering and
other fraud more difficult. While some
State cards may already meet the
standards of the final rule, many States
may have to upgrade their cards and
production processes in response to the
rule. These upgrades will also require a
substantial up-front effort followed by
smaller marginal costs for subsequent
years.
Estimated Benefits
The final REAL ID regulation will
strengthen the security of personal
identification. Though difficult to
quantify, nearly all people understand
the benefits of secure and trusted
identification and the economic, social,
and personal costs of stolen or fictitious
identities. The REAL ID final rule seeks
to improve the security and
trustworthiness of a key enabler of
public and commercial life—State-

E:\FR\FM\29JAR2.SGM

29JAR2

5326

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

issued driver’s licenses and
identification cards.
The primary benefit of REAL ID is to
improve the security and lessen the
vulnerability of federal buildings,
nuclear facilities, and aircraft to terrorist
attack. The rule gives States, local
governments, or private sector entities
an option to choose to require the use
of REAL IDs for activities beyond the
official purposes defined in this
regulation. To the extent that States,
local governments, and private sector
entities make this choice, the rule may
facilitate processes which depend on
licenses and cards for identification and
may benefit from the enhanced security
procedures and characteristics put in
place as a result of this final rule.
DHS provides a ‘‘break-even’’ analysis
based on the rule having an impact on
the annual probability of the United
States experiencing a 9/11 type attack in
the 11 years following the issuance of
the rule. It is exceedingly difficult to
predict the probability and
consequences of a hypothetical terrorist
attack. DHS believes that those factors
cannot be determined for purposes of
this benefit analysis. However, for the
purposes of this analysis, it is not
necessary to assume that there is a
probability of being attacked in any
particular year.
By making some generalized but
conservative assumptions about the
costs of attack consequences, DHS
determined the reduction in probability
of attack that REAL ID will need to bring
about so that the expected cost of REAL
ID equals its anticipated security
benefits. DHS posed the following
question: what impact would this rule
have to have on the annual probability
of experiencing a 9/11 type attack in
order for the rule to have positive
quantified net benefits? This analysis
does not assume that the United States
will necessarily experience this type of
attack, but rather is attempting to
provide the best available information to
the public on the impacts of the rule.
DHS also developed an analysis based
on the discounted cost of a single
terrorist attack comparable to the 9/11
attacks on New York City and
Washington, DC taking place sometime
over an eleven-year span. The agency
determined at what point the final rule
would be cost-beneficial given the
likelihood of an attack and the
effectiveness of preventing the attack.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

The final rule on REAL ID is likely to
produce potential ancillary benefits as
well. It will be more difficult to
fraudulently obtain a legitimate license
and more costly to create a false license,
which could reduce identity theft,
unqualified driving, and fraudulent
activities facilitated by less secure
driver’s licenses such as fraudulent
access to government subsidies and
welfare programs, illegal immigration,
unlawful employment, unlawful access
to firearms, voter fraud and possibly
underage drinking and smoking. DHS
assumes that REAL ID will bring about
changes on the margin that will
potentially increase security and reduce
illegal behavior. Because the size of the
economic costs that REAL ID serves to
reduce on the margin are so large,
however, a relatively small impact of
REAL ID may lead to significant
benefits.
Regulatory Flexibility Act Assessment
The Regulatory Flexibility Act of
1980 7 (RFA), as amended, was enacted
by Congress to ensure that small entities
(small businesses, small not-for-profit
organizations, and small governmental
jurisdictions) are not unnecessarily or
disproportionately burdened by Federal
regulations. The RFA requires agencies
to review rules to determine if they have
‘‘a significant economic impact on a
substantial number of small entities.’’
The following analysis suggests that the
rule will not have a significant
economic impact on a substantial
number of small entities.
The Department is implementing the
regulations in order to enact the
requirements outlined in the REAL ID
Act.8 This rule establishes minimum
standards for the issuance of Stateissued driver’s licenses and non-driver
identification cards (DL/IDs). These
minimum standards will:
• Enhance the security features of DL/
IDs, rendering them more difficult to
counterfeit, tamper with, or cannibalize;
• Ensure that holders of unexpired
REAL IDs are lawfully present in the
United States;
• Enhance physical security of
materials and production locations to
reduce the likelihood of theft of
7 Regulatory Flexibility Act, Pub. L. 96–354, 94
Stat. 1164 (codified at 5 U.S.C. § 601).
8 REAL ID Act of 2005. Pub. L. 13, 109th Cong.,
1st Sess. (May 11, 2005), 201, 202.

PO 00000

Frm 00056

Fmt 4701

Sfmt 4700

materials and infiltration of DMVs by
nefarious individuals;
• Enhance identity source document
requirements and verifications to reduce
the number of DL/IDs issued by DMVs
to persons committing identity fraud;
and,
• Ensure that a REAL ID driver’s
license holder is licensed in only one
State.
In short, these standards are designed
to ensure that holders of unexpired
REAL IDs are who they say they are and
that they are lawfully present in the
United States.
DHS did not receive any public
comments on the Initial Regulatory
Flexibility Analysis that was issued in
support of the NPRM during the public
comment period. All public comments
are available for the public to view at
the Federal Docket Management System:
http://www.regulations.gov.
As part of this rulemaking effort, DHS
has summarized and responded to all
public comments relating to the
Regulatory Evaluation issued with the
NPRM. Comment summaries and
responses are located in the preamble to
the final rule, which is also available at
http://www.regulations.gov and in the
Federal Register.
The rule directly regulates States,
which by definition are not small
entities. The rule indirectly regulates
entities that accept State-issued DL/IDs
for official purposes. The rule defines
those purposes as accessing Federal
facilities, entering nuclear power plants
and boarding federally regulated
commercial aircraft. The entities that
accept DL/IDs for those purposes
include the Federal Government,
operators of nuclear power plants and
entities examining personal identity
documents of people boarding federally
regulated commercial aircraft. The rule
does not require action from any of
these three entities. However, these
entities are likely to engage in some
activity to ensure that they comply with
the Act. The remainder of this section
estimates the number of small entities
that are affected in this indirect way.
The Federal Government is not a
small entity. Therefore, no small entities
are affected by the prohibition on
accepting State-issued DL/IDs that are
not REAL IDs to access Federal
facilities.

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
Nuclear power plants, though not
directly regulated, may experience
indirect impacts from this regulation. A
nuclear power plant qualifies as a small
entity if ‘‘including its affiliates, it is
primarily engaged in the generation,
transmission, and/or distribution of
electric energy for sale and its total
electric output for the preceding fiscal
year did not exceed 4 million megawatt
hours.’’ 9 With only three exceptions,
every nuclear power plant in the United
States produced more than 4 million
megawatt hours in fiscal year 2005.10
However, companies producing more
than 12 million megawatt hours own
each of those three plants.11 None of the
nuclear power plants qualifies as small
businesses using the SBA definition.
Therefore, no small entities are affected
by the prohibition on accepting Stateissued DL/IDs that are not REAL IDs to
enter nuclear power plants.
Entities examining identity
documents of people who are boarding
federally regulated commercial aircraft
will not be directly regulated by the
rulemaking. However, they may
experience indirect effects. Different
types of entities examine personal
identity documents of people boarding
federally regulated commercial aircraft.
Currently, this responsibility falls on the
entity with whom passengers check
their luggage, the entity examining
boarding passes and IDs immediately in
front of TSA screening checkpoints,
and, when completed to fulfill federal
requirements, the entities examining IDs
directly before allowing passengers to

rwilkins on PROD1PC63 with RULES_2

9 Small Business Administration. Small Business
Size Standards Matched to North American
Industrial Classification System. Footnote #1.
Available at http://www.sba.gov/size/
sizetable2002.html#fn1. Accessed July 14, 2006.
10 Calculations based on data from the Energy
Information Administration. U.S. Department of
Energy. Monthly Nuclear Utility Generation by
State and Reactor, 2004 and Monthly Nuclear
Utility Generation by State and Reactor, 2005.
Available at http://www.eia.doe.gov/cneaf/nuclear/
page/nuc_generation/gensum.html. Accessed July
14, 2006.
11 Conclusion based on an Internet search
conducted on July 14, 2006 of the three specific
power plants and the companies that own and
operate them.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

board aircraft. The easiest group of
entities to identify in this category is the
airlines that enplane from and/or
deplane into the sterile area of an
airport.12 The Small Business
Administration considers companies
operating either scheduled or nonscheduled chartered passenger air
transportation to be small entities if they
have fewer than 1,500 employees.13
Using these criteria, DHS has identified
24 specific small entities that offer
scheduled or non-scheduled air
passenger transportation and that
enplane from or deplane into an airport
sterile area. Other federally regulated
commercial aircraft include charter
flights, air taxis, scenic air tours and
other similar operations where the
transportation of passengers for
compensation comprises the majority of
their revenues. Many of these entities
would qualify as small entities under
the SBA definition. SBA data show that,
overall, 2,719 of the 2,877 firms engaged
in air transportation (NAICS 481) had
fewer than 500 employees in 2004.14
Nearly all firms in the air transportation
industry fall well below the 1,500employee size standard to qualify as a
small entity. (Note that the federal
requirements may not require all of
these firms to examine passenger
identity documents prior to boarding.)
DHS estimates that each employee
accepting DL/IDs for official purposes
will require two hours of training. This
training will assist personnel in
identifying the differences between
REAL IDs and other State-issued DL/
IDs. The training will also inform
12 ‘‘Sterile area’’ is defined in 49 CFR 1540.5 and
generally means an area with access limited to
persons who have undergone security screening by
TSA. Therefore, only TSA-regulated airports have
sterile areas.
13 U.S. Small Business Administration. Small
Business Size Standards Matched to North
American Industrial Classification System. NAICS
481111 and 481211. Available at http://
www.sba.gov/size/sizetable2002.html. Accessed
July 14, 2006.
14 U.S. Small Business Administration. U.S. Data
Classified by Employment Size of Firm: All
industries, 2003–2004. Available at http://
www.sba.gov/advo/research/data.html. Accessed 4
Oct 2006.

PO 00000

Frm 00057

Fmt 4701

Sfmt 4700

5327

personnel about which States are or are
not compliant during the enrollment
period. In order to assess the cost of this
training, DHS calculated the fully
loaded wage rate of $22.95 per hour for
airline ticket counter agents and $22.50
per hour for airport checkpoint staff.
Multiplying the wage rates by the
estimated two hours to complete the
training yields estimates of $45.90 and
$45.01 per-employee for ticket counter
agents and checkpoint staff,
respectively. The next step to determine
if firms’ action will have a significant
impact is to divide the summed
products of wage rates and trained
employees by firm revenue. Doing so
yields the impact on the firm as a
percent of their total receipts. However,
data on how many employees firms will
train do not exist on an industry level,
much less at the firm level throughout
the industry. Alternatively, a threshold
analysis can determine at what point the
revenue to trained employee ratio
would constitute a one or three percent
impact for a firm.
The Department has determined
threshold levels that will cause an
indirect impact equal to or less than one
percent and equal to or greater than
three percent of an entity’s total
revenue. If a firm’s ratio is higher than
the one percent threshold, the economic
impact for that firm is not significant. If
the ratio is lower than the three percent
threshold, the economic impact will be
larger than three percent of the firm’s
revenue. The threshold values are
measured as the ratio of total revenue to
the number of employees to be trained
regarding REAL ID. If the amount of a
firm’s revenue per trained counter agent
is more than $4,590, then the effect is
less than one percent of total revenue.
If one percent requires revenue per
agent of $4,590, then the three percent
threshold revenue per agent lies at
$1,530. If a firm’s revenue per counter
agent is less than $1,530, then the effect
will be greater than three percent. The
same approach can be applied to airport
checkpoint staff yielding $4,501 at one
percent and $1,500 at three percent.
(See Figure 2)

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

Applying the one percent threshold—
the most stringent—to the 24 scheduled
service firms specifically identified as
small entities suggests that training
employees regarding REAL ID will not
impose a significant economic impact
on a substantial number of small
entities. Dividing a firm’s total 2005
revenue by $4,590 yields an estimate of
how many employees would need to be
trained before the indirect impact
reaches the one percent of total revenue
threshold. Comparing that estimate to
the number of employees at each firm in
2005 reveals that companies would
need to train anywhere from 6 to 56
times their total number of employees,
including those who will not examine
identification documents.15
The aggregated nature of industrywide data does not allow for a firm-by
firm analysis of the more than 2,719
small firms involved in air
transportation. However, analysis of
firms grouped by receipts in 2002
provides insight into the likelihood that
entities will experience a significant
indirect impact. Dividing receipts by the
one percent threshold of $4,590 for each
group estimates the number of
employees that would result in a one
percent impact on each group. The ratio
of actual reported employees to
threshold employees reveals that every
group for which data is available would
need to train multiple times more
employees regarding REAL ID than they
actually employ. The smallest ratio
(largest impact) is for scheduled
passenger air transportation (NAICS
48111) that earned less than $100,000,
implying that they would need to train
more than 11 times the number of
15 Data from BTS (Form 41, Schedule P10); Duns
and Bradstreet; Yahoo! Finance, and; Hoovers.com.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

people than they employed before the
impact would reach one percent of their
receipts.16 The largest ratio (smallest
impact in terms of percent of revenues)
would fall on nonscheduled chartered
passenger firms (NAICS 481211) earning
more than $100 million. These firms
would need to train more than 85 times
the size of their workforce to reach the
one percent impact threshold.
The combination of the firm specific
analysis and the analysis of aggregated
firms within receipt categories suggests
that the indirect impact of training
agents regarding REAL ID for the official
purpose of boarding federally regulated
commercial aircraft will not constitute a
significant economic impact on a
substantial number of small entities.
The above analyses show that it is
unlikely that the prohibition on
accepting State-issued DL/IDs unless
they are REAL IDs will have a
significant economic impact on a
substantial number of small entities.
Further, the only directly regulated
entities are States, which by definition
are not small entities. Therefore, the
Department concludes that this rule will
not have a significant economic impact
on a substantial number of small
entities.
International Trade Impact Assessment
The Trade Agreement Act of 1979
prohibits Federal agencies from
engaging in any standards or related
activities that create unnecessary
obstacles to the foreign commerce of the
United States. Legitimate domestic
objectives, such as safety, are not
16 Data from U.S. Small Business Administration.
U.S. All Industries by Receipt Size: 2002. Available
online at http://www.sba.gov/advo/research/
data.html. Accessed 4 Oct 2006.

PO 00000

Frm 00058

Fmt 4701

Sfmt 4700

considered unnecessary obstacles. The
statute also requires consideration of
international standards and, where
appropriate, that they be the basis for
U.S. standards. There is no international
standard for State-issued driver licenses
or non-driver identification cards. DHS
has determined that this rule will not
have an impact on trade.
Unfunded Mandates Assessment
Section 202 of the Unfunded
Mandates Reform Act of 1995 (UMRA)
requires Federal agencies to prepare a
written assessment of the costs, benefits,
and other effects of proposed or final
rules that include a Federal mandate
likely to result in the expenditure by
State, local, or tribal governments, in the
aggregate, or by the private sector, of
more than $100 million in any one year
(adjusted for inflation with base year of
1995). Before promulgating a rule for
which a written statement is needed,
section 205 of the UMRA generally
requires agencies to identify and
consider a reasonable number of
regulatory alternatives and adopt the
least costly, most cost-effective, or least
burdensome alternative that achieves
the objective of the rule. Agencies are
also required to seek input from the
States in the preparation of such rules.
The provisions of section 205 do not
apply when they are inconsistent with
applicable law. Moreover, section 205
allows DHS to adopt an alternative other
than the least costly, most cost-effective,
or least burdensome alternative if the
agency publishes with the final rule an
explanation why that alternative was
not adopted.
As set forth in section 202(a)(1) of the
REAL ID Act, the law is binding on
Federal agencies—not on the States.

E:\FR\FM\29JAR2.SGM

29JAR2

ER29JA08.001

rwilkins on PROD1PC63 with RULES_2

5328

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

rwilkins on PROD1PC63 with RULES_2

Indeed, in the Conference Report,
Congress specifically stated that the
‘‘application of the law is indirect, and
hence States need not comply with the
listed standards.’’ Conf. Rep. at 177.
Moreover, as indicated above, UMRA
excludes from its scope, regulations
which are required for national security
reasons. National security was a primary
motivator for the REAL ID Act; indeed,
the Act itself is an effort to implement
recommendations of the 9/11
Commission, and Congress took pains to
explain the connection between REAL
ID and national security, with over a
dozen references to ‘‘terrorists’’ or
‘‘terrorism’’ in the Conference Report.
See 9/11 Commission Public Report,
Chapter 12.4; Conf. Rep., 179—183.
Notwithstanding the voluntary nature
of the REAL ID Act, DHS assumes that
States will willingly comply with the
regulation to maintain the conveniences
enjoyed by their residents when using
their State-issued driver’s licenses and
non-driver identity cards for official
purposes, particularly as it pertains to
domestic air travel. While, for the
reasons set forth above, DHS believes
that the REAL ID Act does not constitute
an unfunded mandate, DHS
nevertheless believes that many States
may find noncompliance an unattractive
option.
Based on that knowledge, DHS has
taken steps to comply with the
requirements of UMRA. Specifically,
DHS has analyzed the estimated cost to
States and considered appropriate
alternatives to, and benefits derived
from, the final regulation. Moreover,
DHS has solicited input from State and
local governments in the preparation of
this final rule.
C. Executive Order 13132, Federalism
Executive Order 13132 requires each
Federal agency to develop a process to
ensure ‘‘meaningful and timely input by
State and local officials in the
development of regulatory policies that
have Federalism implications.’’ The
phrase ‘‘policies that have Federalism
implications’’ is defined in the
Executive Order to include regulations
that have ‘‘substantial direct effects on
the States, on the relationship between
the national government and the States,
or on the distribution of power and
responsibilities among the various
levels of government.’’
Executive Order 13132 lists as a
‘‘Fundamental Federalism Principle’’
that ‘‘[f]ederalism is rooted in the belief
that issues that are not national in scope
or significance are most appropriately
addressed by the level of government
closest to the people.’’ The issue
covered by this final rule is, without

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

question, national in scope and
significance. It is also one in which the
States have significant equities.
While driver’s licenses and
identification cards are issued by States,
they are also the most widely-used
identification documents. Not
surprisingly, they are very frequently
used by individuals to establish their
identities in the course of their
interactions with the Federal
Government (e.g., when entering secure
Federal facilities or passing through
Federally-regulated security procedures
at U.S. airports). The fact that the use of
driver’s licenses as identity documents
is an issue that is ‘‘national in scope’’ is
illustrated by the events of September
11, 2001. A number of the terrorists who
hijacked U.S. aircraft on that day had,
through unlawful means, obtained
genuine driver’s licenses; these
documents were used to facilitate the
terrorists’ operations against the United
States.17
1. DHS has Considered the Federalism
Implications of the REAL ID Rule
Section 3 of the Executive Order sets
forth certain ‘‘Federalism Policymaking
Criteria.’’ In formulating or
implementing policies with ‘‘Federalism
implications,’’ agencies are required, to
the extent permitted by law, to adhere
to certain criteria. DHS has considered
this action in light of the criteria set
forth in Executive Order 13132 § 3(a)–
(d) and submits the following:
(a) Constitutional Principles and
Maximizing the Policymaking
Discretion of the States
The rule is being promulgated in strict
adherence to constitutional principles,
and the limits of DHS’s constitutional
and statutory authority have been
carefully considered. Congress, through
the REAL ID Act, has mandated that
Federal agencies refuse to accept for
official purpose, State-issued driver’s
licenses or identification cards unless
DHS has determined that the issuing
State is in compliance with the
statutorily-mandated minimum
standards for such identification
documents. Notwithstanding the clear
statutory mandate directing this
rulemaking action, DHS has taken steps,
in consultation with the States, to
maximize policymaking discretion at
the State level wherever possible. For
example, States may establish an
exceptions process that would allow
each State participating in REAL ID to
exercise maximum discretion in
responding to exigencies arising in the
17 See

PO 00000

9/11 Commission Report, Chapter 12.4.

Frm 00059

Fmt 4701

Sfmt 4700

5329

course of verifying an individual’s
identity.
DHS also recognizes that each State’s
unique situation mandates that the
maximum possible latitude be allowed
to States in fulfilling the statutory
mandate that certain employees undergo
background investigations. The final
rule provides parameters for use by the
States in determining which employees
are ‘‘covered employees’’ and thus
subject to the statutory background
check requirements, but allows the
individual States to determine which
employees fall into categories deemed to
be covered as defined under this final
rule (e.g. DMV ‘‘employees or
contractors who are involved in the
manufacture or production of REAL ID
driver’s licenses and identification
cards, or who have the ability to affect
the identity information that appears on
the driver’s license or identification
card.’’).
States are also given the discretion to
find the best way to determine an
individual driver’s license or
identification card applicant’s address
of principal residence, and provides
greater latitude in accepting alternatives
or making exceptions based on State
practices.
In other aspects of the regulation DHS
has prescribed baseline requirements
while allowing States the discretion to
impose more stringent standards, the
greatest example of which is in the area
of protecting personally identifiable
information collected for REAL ID
purposes. Most significantly, each State
retains the discretion to opt out of REAL
ID in its entirety.
(b) Action Limiting the Policymaking
Discretion of the States
As indicated above, the final rule
strives to maximize State policymaking
discretion on two levels: First, because
a State’s participation in REAL ID is
optional; and second, because of the
policymaking discretion incorporated
into the regulation for States that do
choose to participate. DHS believes that
it has incorporated the maximum
possible State discretion consistent with
the purposes of the statute into this
action.
(c) Avoiding Intrusive Federal Oversight
Consistent with Congress’ vision for
REAL ID (see § 202(a)(2) of the Act),
States that choose to participate in the
program will be responsible for
monitoring their own compliance.
Under the Act and the final regulations,
the Secretary of Homeland Security will
determine whether a State is meeting
the requirements of the Act based on
certifications made by the State and

E:\FR\FM\29JAR2.SGM

29JAR2

5330

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

DHS has adopted a certification process
similar to that used by DOT in its
regulations governing State
administration of commercial driver’s
licenses. States receiving adverse
determinations will have the
opportunity for an internal appeals
process as well as judicial review.
(d) Formulation of Policies With
Federalism Implications
DHS recognizes both the important
national interest in secure identity
documents and the Federalism
implications of the policies which
underpin this rule. Accordingly, DHS
has welcomed and encouraged State
participation in this process and has
sought, where possible, to draft this
regulation in such a way as to maximize
State discretion.
Where the exigencies of national
security and the need to prevent
identity fraud have militated in favor of
a uniform national standard (e.g.,
baseline security features on identity
cards and background check
requirements), DHS has, as reflected
above, consulted with States in order to
ensure that the uniform standards
prescribed could be attained by the
States and would reflect the
accumulated security experience of
State motor vehicles administrations.

rwilkins on PROD1PC63 with RULES_2

2. The REAL ID Final Rule Complies
With the Regulatory Provisions of
Executive Order 13132
Under § 6 of Executive Order 13132,
an agency may not issue a regulation
that has Federalism implications, that
imposes substantial direct compliance
costs, and that is not required by statute,
unless the Federal Government provides
the funds necessary to pay the direct
compliance costs incurred by State and
local governments, or consults with
State and local officials early in the
process of developing the proposed
regulation. Moreover, an agency may
not issue a regulation that has
Federalism implications and that
preempts State law, unless the Agency
consults with State and local officials
early in the process of developing the
regulation.
(a) The Final Rule Does Not Preempt
State Law
As detailed elsewhere in this
document, the REAL ID Act is binding
on Federal agencies, rather than on
States. The rule would not formally
compel any State to issue driver’s
licenses or identification cards that will
be acceptable for Federal purposes.
Importantly, under this scheme, ‘‘[a]ny
burden caused by a State’s refusal to
regulate will fall on those [citizens who

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

need to acquire and utilize alternative
documents for Federal purposes], rather
than on the State as a sovereign.’’ 18 In
other words, the citizens of a given
State—not Congress—ultimately will
decide whether the State complies with
this regulation and the underlying
statute. DHS has concluded that the rule
is consistent with the Tenth
Amendment to the U.S. Constitution
and does not constitute an
impermissible usurpation of State
sovereignty. Rather, it is a permissible
‘‘program of cooperative Federalism’’ in
which the Federal and State
governments have acted voluntarily in
tandem to achieve a common policy
objective.19
(b) DHS Has Engaged in Extensive
Consultations With the States
The statutory mandate and the lack of
preemption both satisfy the
requirements of Executive Order 13132.
Nevertheless, in the spirit of Federalism,
and consistent with § 205(a) of the
REAL ID Act, DHS has engaged in
extensive consultations with the States
prior to issuing this final rule. As set
forth earlier in this preamble of this
rule, DHS held meetings and solicited
input from various States and such
stakeholders as the National Governors
Association and the National
Conference of State Legislatures.
In particular, during the comment
period, DHS hosted sessions that were
available via webcast across the country
to engage State Governors’ chiefs of
staff, homeland security directors in the
States, and motor vehicles
administrators, as well as a separate
session with State legislators. DHS also
convened the various stakeholder
representatives that were identified as
participants in the negotiated
rulemaking group established under
section 7212 of the Intelligence Reform
and Terrorism Prevention Act. Further,
DHS held a public meeting in
Sacramento, California that was
available nationwide via webcast and
received comments from the public on
a variety of topics, including consumer
and personal impacts, privacy/security,
electronic verification systems, funding/
implementation, and law enforcement.
(c) DHS Recognizes the Burdens
Inherent in Complying With the
Regulations
Notwithstanding both the statutory
mandate and the Federal (rather than
State) focus of the REAL ID Act, DHS
recognizes that, as a practical matter,
States may view noncompliance with
18 New
19 See

PO 00000

York v. U.S., 505 U.S. 144, 173 (1992).
id. at 167.

Frm 00060

Fmt 4701

Sfmt 4700

the requirements of REAL ID as an
unattractive alternative. DHS also
recognizes that compliance with the
rule carries with it significant costs and
logistical burdens, for which Federal
funds are generally not available. The
costs (to the States, the public and the
Federal Government) of implementing
this rule are by no means inconsiderable
and have been detailed in the regulatory
evaluation accompanying this rule.
As indicated above, Executive Order
13132 prohibits any agency from
implementing a regulation with
Federalism implications which imposes
substantial direct compliance costs on
State and local governments unless the
regulation is required by statute, the
Federal Government will provide funds
to pay for the direct costs, or the agency
has consulted with State and local
officials. In such a case, the agency must
also incorporate a Federalism statement
into the preamble of the regulation and
make available to the Office of
Management and Budget any written
communications from State and local
officials. See Executive Order 13132,
section 6(b).
This rule is required by the REAL ID
Act. DHS has (as detailed above)
consulted extensively with State and
local officials in the course of preparing
this regulation. Finally, DHS has
incorporated this Federalism Statement
into the preamble to assess the
Federalism impact of its REAL ID
regulation.
3. REAL ID and Federalism
The issuance of driver’s licenses has
traditionally been the province of State
governments; DHS believes that, to the
extent practicable, it should continue as
such. However, given the threat to both
national security and the economy
presented by identity fraud, DHS
believes that certain uniform standards
should be adopted for the most basic
identity document in use in this
country. DHS has, in this final rule,
attempted to balance State prerogatives
with the national interests at stake.
D. Environmental Impact Analysis
At the time of the proposed rule, DHS
sought and received comment on the
potential environmental impact of the
physical standards and other proposed
requirements under this rule. DHS
carefully considered those comments in
its evaluation of the potential
environmental impacts of the rule. DHS
concludes that the rule’s potential
impacts are minimal and this rule is a
part of a category of actions that do not
individually or cumulatively have a
significant impact on the human
environment and do not require a more

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

PART 37—REAL ID DRIVER’S
LICENSES AND IDENTIFICATION
CARDS

E. Energy Impact Analysis

Subpart A—General

The energy impact of this rule has
been assessed in accordance with the
Energy Policy and Conservation Act
(EPCA), Public Law 94–163, as amended
(42 U.S.C. 6362). We have determined
that this rulemaking is not a major
regulatory action under the provisions
of the EPCA.

Sec.
37.1
37.3
37.5

F. Executive Order 13175 (Tribal
Consultation)

rwilkins on PROD1PC63 with RULES_2

List of Subjects in 6 CFR Part 37
Document security, driver’s licenses,
identification cards, incorporation by
reference, motor vehicle
administrations, physical security.

extensive evaluation under the
requirements of the National
Environmental Policy Act of 1969
(NEPA), 42 U.S.C. 4321 et seq. and
Council on Environmental Quality
(CEQ) regulations, 40 CFR parts 1501–
1508. DHS Categorical Exclusion A3
(Table 1 Management Directive 5100.1).
Categorical Exclusion A3 applies to the
promulgation of this rule, since it is of
an administrative and procedural nature
that does not force an immediate action
but only lays the foundation for
subsequent action. The categorical
exclusion applies only to the
promulgation of the REAL ID rule.
Environmental impacts that may be
associated with any follow-on DHS
activity, such as approval of grant
funding, must be reviewed if and when
the subsequent program actions create
the potential for environmental impact.

DHS has analyzed this final rule
under Executive Order 13175 (entitled
‘‘Consultation and Coordination with
Indian Tribal Governments’’, issued
November 6, 2000). Executive Order
13175 states that no agency shall
promulgate regulations that have tribal
implications, that impose substantial
direct compliance costs on Indian tribal
governments, or that are not required by
statute unless the agency first consults
with tribal officials and prepares a tribal
summary impact statement.
DHS has determined that this final
rule will not have a substantial direct
effect on one or more Indian tribes and
will not impose substantial direct
compliance costs on Indian tribal
governments. This rule also does not
seek to preempt any tribal laws. This
final rule does not satisfy the tribal
implications requirement in that it is a
rule of general applicability that
establishes minimum standards for
State-issued driver’s licenses and
identification cards that Federal
agencies will accept for official
purposes on or after May 11, 2008, a
statutory mandate under the REAL ID
Act of 2005. Therefore, tribal
consultation and a tribal summary
impact statement are not required.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

The Amendments
For the reasons set forth above, the
Department of Homeland Security
amends 6 CFR Chapter I by adding a
new Part 37 as follows:

■

TITLE 6—HOMELAND SECURITY
CHAPTER I—DEPARTMENT OF
HOMELAND SECURITY, OFFICE OF THE
SECRETARY

Applicability.
Definitions.
Validity periods and deadlines for
REAL ID driver’s licenses and
identification cards.

Subpart B—Minimum Documentation,
Verification, and Card Issuance
Requirements
37.11 Application and documents the
applicant must provide.
37.13 Document verification requirements.
37.15 Physical security features for the
driver’s license or identification card.
37.17 Requirements for the surface of the
driver’s license or identification card.
37.19 Machine readable technology on the
driver’s license or identification card.
37.21 Temporary or limited-term driver’s
licenses and identification cards.
37.23 Reissued REAL ID driver’s licenses
and identification cards.
37.25 Renewal of REAL ID driver’s licenses
and identification cards.
37.27 Driver’s licenses and identification
cards issued during the age-based
enrollment period.
37.29 Prohibition against holding more than
one REAL ID card or more than one
driver’s license.
Subpart C—Other Requirements
37.31 Source document retention.
37.33 DMV databases.
Subpart D—Security at DMVs and Driver’s
License and Identification Card Production
Facilities
37.41 Security plan.
37.43 Physical security of DMV production
facilities.
37.45 Background checks for covered
employees.
Subpart E—Procedures for Determining
State Compliance
37.51 Compliance—general requirements.
37.55 State certification documentation.

PO 00000

Frm 00061

Fmt 4701

Sfmt 4700

5331

37.59 DHS reviews of State compliance.
37.61 Results of compliance determination.
37.63 Extension of deadline.
37.65 Effect of failure to comply with this
Part.
Subpart F—Driver’s Licenses and
Identification Cards Issued Under Section
202(d)(11) of the REAL ID Act
37.71 Driver’s licenses and identification
cards issued under section 202(d)(11) of
the REAL ID Act.
Authority: 49 U.S.C. 30301 note; 6 U.S.C.
111, 112.

PART 37—REAL ID DRIVER’S
LICENSES AND IDENTIFICATION
CARDS
Subpart A—General
§ 37.1

Applicability.

(a) Subparts A through E of this part
apply to States and U.S. territories that
choose to issue driver’s licenses and
identification cards that can be accepted
by Federal agencies for official
purposes.
(b) Subpart F establishes certain
standards for State-issued driver’s
licenses and identification cards issued
by States that participate in REAL ID,
but that are not intended to be accepted
by Federal agencies for official purpose
under section 202(d)(11) of the REAL ID
Act.
§ 37.3

Definitions.

For purposes of this part:
Birth certificate means the record
related to a birth that is permanently
stored either electronically or physically
at the State Office of Vital Statistics or
equivalent agency in a registrant’s State
of birth.
Card means either a driver’s license or
identification card issued by the State
Department of Motor Vehicles (DMV) or
equivalent State office.
Certification means an assertion by
the State to the Department of
Homeland Security that the State has
met the requirements of this Part.
Certified copy of a birth certificate
means a copy of the whole or part of a
birth certificate registered with the State
that the State considers to be the same
as the original birth certificate on file
with the State Office of Vital Statistics
or equivalent agency in a registrant’s
State of birth.
Covered employees means
Department of Motor Vehicles
employees or contractors who are
involved in the manufacture or
production of REAL ID driver’s licenses
and identification cards, or who have
the ability to affect the identity
information that appears on the driver’s
license or identification card.

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5332

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

Data verification means checking the
validity of data contained in source
documents presented under this
regulation.
DHS means the U.S. Department of
Homeland Security.
DMV means the Department of Motor
Vehicles or any State Government entity
that issues driver’s licenses and
identification cards, or an office with
equivalent function for issuing driver’s
licenses and identification cards.
Determination means a decision by
the Department of Homeland Security
that a State has or has not met the
requirements of this Part and that
Federal agencies may or may not accept
the driver’s licenses and identification
cards issued by the State for official
purposes.
Digital photograph means a digital
image of the face of the holder of the
driver’s license or identification card.
Document authentication means
determining that the source document
presented under these regulations is
genuine and has not been altered.
Domestic violence and dating
violence have the meanings given the
terms in section 3, Universal definitions
and grant provisions, of the Violence
Against Women and Department of
Justice Reauthorization Act of 2005
(Pub. L. 109–162, 119 Stat. 2960, 2964,
Jan. 5, 2006); codified at section 40002,
Definitions and grant provisions, 42
U.S.C. 13925, or State laws addressing
domestic and dating violence.
Driver’s license means a motor vehicle
operator’s license, as defined in 49
U.S.C. 30301.
Duplicate means a driver’s license or
identification card issued subsequent to
the original document that bears the
same information and expiration date as
the original document and that is
reissued at the request of the holder
when the original is lost, stolen, or
damaged and there has been no material
change in information since prior
issuance.
Federal agency means all executive
agencies including Executive
departments, a Government corporation,
and an independent establishment as
defined in 5 U.S.C. 105.
Federally-regulated commercial
aircraft means a commercial aircraft
regulated by the Transportation Security
Administration (TSA).
Full compliance means that the
Secretary or his designate(s) has
determined that a State has met all the
requirements of Subparts A through E.
Full legal name means an individual’s
first name, middle name(s), and last
name or surname, without use of initials
or nicknames.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

IAFIS means the Integrated
Automated Fingerprint Identification
System, a national fingerprint and
criminal history system maintained by
the Federal Bureau of Investigation (FBI)
that provides automated fingerprint
search capabilities.
Identification card means a document
made or issued by or under the
authority of a State Department of Motor
Vehicles or State office with equivalent
function which, when completed with
information concerning a particular
individual, is of a type intended or
commonly accepted for the purpose of
identification of individuals.
INS means the former-Immigration
and Naturalization Service of the U.S.
Department of Justice.
Lawful status: A person in lawful
status is a citizen or national of the
United States; or an alien: lawfully
admitted for permanent or temporary
residence in the United States; with
conditional permanent resident status in
the United States; who has an approved
application for asylum in the United
States or has entered into the United
States in refugee status; who has a valid
nonimmigrant status in the United
States; who has a pending application
for asylum in the United States; who has
a pending or approved application for
temporary protected status (TPS) in the
United States; who has approved
deferred action status; or who has a
pending application for lawful
permanent residence (LPR) or
conditional permanent resident status.
This definition does not affect other
definitions or requirements that may be
contained in the Immigration and
Nationality Act or other laws.
Material change means any change to
the personally identifiable information
of an individual as defined under this
part. Notwithstanding the definition of
personally identifiable information
below, a change of address of principal
residence does not constitute a material
change.
Material compliance means a
determination by DHS that a State has
met the benchmarks contained in the
Material Compliance Checklist.
NCIC means the National Crime
Information Center, a computerized
index of criminal justice information
maintained by the Federal Bureau of
Investigation (FBI) that is available to
Federal, State, and local law
enforcement and other criminal justice
agencies.
Official purpose means accessing
Federal facilities, boarding Federallyregulated commercial aircraft, and
entering nuclear power plants.
Passport means a passport booklet or
card issued by the U.S. Department of

PO 00000

Frm 00062

Fmt 4701

Sfmt 4700

State that can be used as a travel
document to gain entry into the United
States and that denotes identity and
citizenship as determined by the U.S.
Department of State.
Personally identifiable information
means any information which can be
used to distinguish or trace an
individual’s identity, such as their
name; driver’s license or identification
card number; social security number;
biometric record, including a digital
photograph or signature; alone, or when
combined with other personal or
identifying information, which is linked
or linkable to a specific individual, such
as a date and place of birth or address,
whether it is stored in a database, on a
driver’s license or identification card, or
in the machine readable technology on
a license or identification card.
Principal residence means the
location where a person currently
resides (i.e., presently resides even if at
a temporary address) in conformance
with the residency requirements of the
State issuing the driver’s license or
identification card, if such requirements
exist.
REAL ID Driver’s License or
Identification Card means a driver’s
license or identification card that has
been issued by a State that has been
certified by DHS to be in compliance
with the requirements of the REAL ID
Act and which meets the standards of
subparts A through D of this part,
including temporary or limited-term
driver’s licenses or identification cards
issued under § 37.21.
Reissued card means a card that a
State DMV issues to replace a card that
has been lost, stolen or damaged, or to
replace a card that includes outdated
information. A card may not be reissued
remotely when there is a material
change to the personally identifiable
information as defined by the Rule.
Renewed card means a driver’s
license or identification card that a State
DMV issues to replace a renewable
driver’s license or identification card.
SAVE means the DHS Systematic
Alien Verification for Entitlements
system, or such successor or alternate
verification system at the Secretary’s
discretion.
Secretary means the Secretary of
Homeland Security.
Sexual assault and stalking have the
meanings given the terms in section 3,
universal definitions and grant
provisions, of the Violence Against
Women and Department of Justice
Reauthorization Act of 2005 (Pub. L.
109–162, 119 Stat. 2960, 2964, Jan. 5,
2006); codified at section 40002,
Definitions and grant provisions, 42

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
U.S.C. 13925, or State laws addressing
sexual assault and stalking.
Source document(s) means original or
certified copies (where applicable) of
documents presented by an applicant as
required under these regulations to the
Department of Motor Vehicles to apply
for a driver’s license or identification
card.
State means a State of the United
States, the District of Columbia, Puerto
Rico, the Virgin Islands, Guam,
American Samoa, and the
Commonwealth of the Northern Mariana
Islands.
State address confidentiality program
means any State-authorized or Stateadministered program that—
(1) Allows victims of domestic
violence, dating violence, sexual
assault, stalking, or a severe form of
trafficking to keep, obtain, and use
alternative addresses; or
(2) Provides confidential recordkeeping regarding the addresses of such
victims or other categories of persons.
Temporary lawful status: A person in
temporary lawful status is a person who:
has a valid nonimmigrant status in the
United States; has a pending application
for asylum in the United States; has a
pending or approved application for
temporary protected status (TPS) in the
United States; has approved deferred
action status; or has a pending
application for LPR or conditional
permanent resident status.
Verify means procedures to ensure
that:
(1) The source document is genuine
and has not been altered (i.e.,
‘‘document authentication’’); and
(2) The identity data contained on the
document is valid (‘‘data verification’’).

rwilkins on PROD1PC63 with RULES_2

§ 37.5 Validity periods and deadlines for
REAL ID driver’s licenses and identification
cards.

(a) Driver’s licenses and identification
cards issued under this part, that are not
temporary or limited-term driver’s
licenses and identification cards, are
valid for a period not to exceed eight
years. A card may be valid for a shorter
period based on other State or Federal
requirements.
(b) On or after December 1, 2014,
Federal agencies shall not accept a
driver’s license or identification card for
official purposes from individuals born
after December 1, 1964, unless such
license or card is a REAL ID-compliant
driver’s license or identification card
issued by a State that has been
determined by DHS to be in full
compliance as defined under this
subpart.
(c) On or after December 1, 2017,
Federal agencies shall not accept a

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

driver’s license or identification card for
official purposes from any individual
unless such license or card is a REAL
ID-compliant driver’s license or
identification card issued by a State that
has been determined by DHS to be in
full compliance as defined under this
subpart.
(d) Federal agencies cannot accept for
official purpose driver’s licenses and
identification cards issued under § 37.71
of this rule.
Subpart B—Minimum Documentation,
Verification, and Card Issuance
Requirements
§ 37.11 Application and documents the
applicant must provide.

(a) The State must subject each person
applying for a REAL ID driver’s license
or identification card to a mandatory
facial image capture, and shall maintain
photographs of individuals even if no
card is issued. The photographs must be
stored in a format in accordance with
§ 37.31 as follows:
(1) If no card is issued, for a minimum
period of five years.
(2) If a card is issued, for a period of
at least two years beyond the expiration
date of the card.
(b) Declaration. Each applicant must
sign a declaration under penalty of
perjury that the information presented
on the application is true and correct,
and the State must retain this
declaration. An applicant must sign a
new declaration when presenting new
source documents to the DMV on
subsequent visits.
(c) Identity. (1) To establish identity,
the applicant must present at least one
of the following source documents:
(i) Valid, unexpired U.S. passport.
(ii) Certified copy of a birth certificate
filed with a State Office of Vital
Statistics or equivalent agency in the
individual’s State of birth.
(iii) Consular Report of Birth Abroad
(CRBA) issued by the U.S. Department
of State, Form FS–240, DS–1350 or FS–
545.
(iv) Valid, unexpired Permanent
Resident Card (Form I–551) issued by
DHS or INS.
(v) Unexpired employment
authorization document (EAD) issued
by DHS, Form I–766 or Form I–688B.
(vi) Unexpired foreign passport with a
valid, unexpired U.S. visa affixed
accompanied by the approved I–94 form
documenting the applicant’s most
recent admittance into the United
States.
(vii) Certificate of Naturalization
issued by DHS, Form N–550 or Form N–
570.
(viii) Certificate of Citizenship, Form
N–560 or Form N–561, issued by DHS.

PO 00000

Frm 00063

Fmt 4701

Sfmt 4700

5333

(ix) REAL ID driver’s license or
identification card issued in compliance
with the standards established by this
part.
(x) Such other documents as DHS may
designate by notice published in the
Federal Register.
(2) Where a State permits an applicant
to establish a name other than the name
that appears on a source document (for
example, through marriage, adoption,
court order, or other mechanism
permitted by State law or regulation),
the State shall require evidence of the
name change through the presentation
of documents issued by a court,
governmental body or other entity as
determined by the State. The State shall
maintain copies of the documentation
presented pursuant to § 37.31, and
maintain a record of both the recorded
name and the name on the source
documents in a manner to be
determined by the State and in
conformity with § 37.31.
(d) Date of birth. To establish date of
birth, an individual must present at
least one document included in
paragraph (c) of this section.
(e) Social security number (SSN). (1)
Except as provided in paragraph (e)(3)
of this section, individuals presenting
the identity documents listed in
§ 37.11(c)(1) and (2) must present his or
her Social Security Administration
account number card; or, if a Social
Security Administration account card is
not available, the person may present
any of the following documents bearing
the applicant’s SSN:
(i) A W–2 form,
(ii) A SSA–1099 form,
(iii) A non-SSA–1099 form, or
(iv) A pay stub with the applicant’s
name and SSN on it.
(2) The State DMV must verify the
SSN pursuant to § 37.13(b)(2) of this
subpart.
(3) Individuals presenting the identity
document listed in § 37.11(c)(1)(vi) must
present an SSN or demonstrate nonwork authorized status.
(f) Documents demonstrating address
of principal residence. To document the
address of principal residence, a person
must present at least two documents of
the State’s choice that include the
individual’s name and principal
residence. A street address is required
except as provided in § 37.17(f) of this
part.
(g) Evidence of lawful status in the
United States. A DMV may issue a
REAL ID driver’s license or
identification card only to a person who
has presented satisfactory evidence of
lawful status.
(1) If the applicant presents one of the
documents listed under paragraphs

E:\FR\FM\29JAR2.SGM

29JAR2

rwilkins on PROD1PC63 with RULES_2

5334

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

(c)(1)(i), (c)(1)(ii), (c)(1)(iii), (c)(1)(iv),
(c)(1)(vii) or (c)(1)(viii) of this section,
the issuing State’s verification of the
applicant’s identity in the manner
prescribed in § 37.13 will also provide
satisfactory evidence of lawful status.
(2) If the applicant presents one of the
identity documents listed under
paragraphs (c)(1)(v) or (c)(1)(vi), or
(c)(1)(ix) of this section, the issuing
State’s verification of the identity
document(s) does not provide
satisfactory evidence of lawful status.
The applicant must also present a
second document from § 37.11(g)(1) or
documentation issued by DHS or other
Federal agencies demonstrating lawful
status as determined by USCIS. All
documents shall be verified in the
manner prescribed in § 37.13.
(h) Exceptions Process. A State DMV
may choose to establish a written,
defined exceptions process for persons
who, for reasons beyond their control,
are unable to present all necessary
documents and must rely on alternate
documents to establish identity or date
of birth. Alternative documents to
demonstrate lawful status will only be
allowed to demonstrate U.S. citizenship.
(1) Each State establishing an
exceptions process must make
reasonable efforts to establish the
authenticity of alternate documents
each time they are presented and
indicate that an exceptions process was
used in the applicant’s record.
(2) The State shall retain copies or
images of the alternate documents
accepted pursuant to § 37.31 of this part.
(3) The State shall conduct a review
of the use of the exceptions process, and
pursuant to subpart E of this part,
prepare and submit a report with a copy
of the exceptions process as part of the
certification documentation detailed in
§ 37.55.
(i) States are not required to comply
with these requirements when issuing
REAL ID driver’s licenses or
identification cards in support of
Federal, State, or local criminal justice
agencies or other programs that require
special licensing or identification to
safeguard persons or in support of their
other official duties. As directed by
appropriate officials of these Federal,
State, or local agencies, States should
take sufficient steps to safeguard the
identities of such persons. Driver’s
licenses and identification cards issued
in support of Federal, State, or local
criminal justice agencies or programs
that require special licensing or
identification to safeguard persons or in
support of their other official duties
shall not be distinguishable from other
REAL ID licenses or identification cards
issued by the State.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

§ 37.13 Document verification
requirements.

(a) States shall make reasonable
efforts to ensure that the applicant does
not have more than one driver’s license
or identification card already issued by
that State under a different identity. In
States where an individual is permitted
to hold both a driver’s license and
identification card, the State shall
ensure that the individual has not been
issued identification documents in
multiple or different names. States shall
also comply with the provisions of
§ 37.29 before issuing a driver’s license
or identification card.
(b) States must verify the documents
and information required under § 37.11
with the issuer of the document. States
shall use systems for electronic
validation of document and identity
data as they become available or use
alternative methods approved by DHS.
(1) States shall verify any document
described in § 37.11(c) or (g) and issued
by DHS (including, but not limited to,
the I–94 form described in § 37.11(c)(vi))
through the Systematic Alien
Verification for Entitlements (SAVE)
system or alternate methods approved
by DHS, except that if two DHS-issued
documents are presented, a SAVE
verification of one document that
confirms lawful status does not need to
be repeated for the second document. In
the event of a non-match, the DMV must
not issue a REAL ID driver’s license or
identification card to an applicant, and
must refer the individual to U.S.
Citizenship and Immigration Services
for resolution.
(2) States must verify SSNs with the
Social Security Administration (SSA) or
through another method approved by
DHS. In the event of a non-match with
SSA, a State may use existing
procedures to resolve non-matches. If
the State is unable to resolve the nonmatch, and the use of an exceptions
process is not warranted in the
situation, the DMV must not issue a
REAL ID driver’s license or
identification card to an applicant until
the information verifies with SSA.
(3) States must verify birth certificates
presented by applicants. States should
use the Electronic Verification of Vital
Events (EVVE) system or other
electronic systems whenever the records
are available. If the document does not
appear authentic upon inspection or the
data does not match and the use of an
exceptions process is not warranted in
the situation, the State must not issue a
REAL ID driver’s license or
identification card to the applicant until
the information verifies, and should
refer the individual to the issuing office
for resolution.

PO 00000

Frm 00064

Fmt 4701

Sfmt 4700

(4) States shall verify documents
issued by the Department of State with
the Department of State or through
methods approved by DHS.
(5) States must verify REAL ID
driver’s licenses and identification cards
with the State of issuance.
(6) Nothing in this section precludes
a State from issuing an interim license
or a license issued under § 37.71 that
will not be accepted for official
purposes to allow the individual to
resolve any non-match.
§ 37.15 Physical security features for the
driver’s license or identification card.

(a) General. States must include
document security features on REAL ID
driver’s licenses and identification cards
designed to deter forgery and
counterfeiting, promote an adequate
level of confidence in the authenticity of
cards, and facilitate detection of
fraudulent cards in accordance with this
section.
(1) These features must not be capable
of being reproduced using technologies
that are commonly used and made
available to the general public.
(2) The proposed card solution must
contain a well-designed, balanced set of
features that are effectively combined
and provide multiple layers of security.
States must describe these document
security features in their security plans
pursuant to § 37.41.
(b) Integrated security features. REAL
ID driver’s licenses and identification
cards must contain at least three levels
of integrated security features that
provide the maximum resistance to
persons’ efforts to—
(1) Counterfeit, alter, simulate, or
reproduce a genuine document;
(2) Alter, delete, modify, mask, or
tamper with data concerning the
original or lawful card holder;
(3) Substitute or alter the original or
lawful card holder’s photograph and/or
signature by any means; and
(4) Create a fraudulent document
using components from legitimate
driver’s licenses or identification cards.
(c) Security features to detect false
cards. States must employ security
features to detect false cards for each of
the following three levels:
(1) Level 1. Cursory examination,
without tools or aids involving easily
identifiable visual or tactile features, for
rapid inspection at point of usage.
(2) Level 2. Examination by trained
inspectors with simple equipment.
(3) Level 3. Inspection by forensic
specialists.
(d) Document security and integrity.
States must conduct a review of their
card design and submit a report to DHS
with their certification that indicates the

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
ability of the design to resist
compromise and document fraud
attempts. The report required by this
paragraph is SSI and must be handled
and protected in accordance with 49
CFR part 1520. Reports must be updated
and submitted to DHS whenever a
security feature is modified, added, or
deleted. After reviewing the report, DHS
may require a State to provide DHS with
examination results from a recognized
independent laboratory experienced
with adversarial analysis of
identification documents concerning
one or more areas relating to the card’s
security.

rwilkins on PROD1PC63 with RULES_2

§ 37.17 Requirements for the surface of
the driver’s license or identification card.

To be accepted by a Federal agency
for official purposes, REAL ID driver’s
licenses and identification cards must
include on the front of the card (unless
otherwise specified below) the
following information:
(a) Full legal name. Except as
permitted in § 37.11(c)(2), the name on
the face of the license or card must be
the same as the name on the source
document presented by the applicant to
establish identity. Where the individual
has only one name, that name should be
entered in the last name or family name
field, and the first and middle name
fields should be left blank. Place holders
such as NFN, NMN, and NA should not
be used.
(b) Date of birth.
(c) Gender, as determined by the
State.
(d) Unique Driver’s license or
identification card number. This cannot
be the individual’s SSN, and must be
unique across driver’s license or
identification cards within the State.
(e) Full facial digital photograph. A
full facial photograph must be taken
pursuant to the standards set forth
below:
(1) States shall follow specifically
ISO/IEC 19794–5:2005(E) Information
technology—Biometric Data Interchange
Formats—Part 5: Face Image Data. The
Director of the Federal Register
approves this incorporation by reference
in accordance with 5 U.S.C. 552(a) and
1 CFR part 51. You may obtain a copy
of these incorporated standards from
http://www.ansi.org, or by contacting
ANSI at ANSI, 25 West 43rd Street, 4th
Floor, New York, New York 10036. You
may inspect a copy of the incorporated
standard at the Department of
Homeland Security, 1621 Kent Street,
9th Floor, Rosslyn, VA (please call 703–
235–0709 to make an appointment) or at
the National Archives and Records
Administration (NARA). For
information on the availability of

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

material at NARA, call 202–741–6030,
or go to www.archives.gov/
federal_register/
code_of_federal_regulations/
ibr_locations.html.
These standards include:
(i) Lighting shall be equally
distributed on the face.
(ii) The face from crown to the base
of the chin, and from ear-to-ear, shall be
clearly visible and free of shadows.
(iii) Veils, scarves or headdresses
must not obscure any facial features and
not generate shadow. The person may
not wear eyewear that obstructs the iris
or pupil of the eyes and must not take
any action to obstruct a photograph of
their facial features.
(iv) Where possible, there must be no
dark shadows in the eye-sockets due to
the brow. The iris and pupil of the eyes
shall be clearly visible.
(v) Care shall be taken to avoid ‘‘hot
spots’’ (bright areas of light shining on
the face).
(2) Photographs may be in black and
white or color.
(f) Address of principal residence,
except an alternative address may be
displayed for:
(1) Individuals for whom a State law,
regulation, or DMV procedure permits
display of an alternative address, or
(2) Individuals who satisfy any of the
following:
(i) If the individual is enrolled in a
State address confidentiality program
which allows victims of domestic
violence, dating violence, sexual
assault, stalking, or a severe form of
trafficking, to keep, obtain, and use
alternative addresses; and provides that
the addresses of such persons must be
kept confidential, or other similar
program;
(ii) If the individual’s address is
entitled to be suppressed under State or
Federal law or suppressed by a court
order including an administrative order
issued by a State or Federal court; or
(iii) If the individual is protected from
disclosure of information pursuant to
section 384 of the Illegal Immigration
Reform and Immigrant Responsibility
Act of 1996.
(3) In areas where a number and street
name has not been assigned for U.S.
mail delivery, an address convention
used by the U.S. Postal Service is
acceptable.
(g) Signature. (1) The card must
include the signature of the card holder.
The signature must meet the
requirements of the March 2005
American Association of Motor Vehicle
Administrators (AAMVA) standards for
the 2005 AAMVA Driver’s License/
Identification Card Design
Specifications, Annex A, section

PO 00000

Frm 00065

Fmt 4701

Sfmt 4700

5335

A.7.7.2. This standard includes
requirements for size, scaling, cropping,
color, borders, and resolution. The
Director of the Federal Register
approves this incorporation by reference
in accordance with 5 U.S.C. 552(a) and
1 CFR part 51. You may obtain a copy
of these standards from AAMVA on-line
at http://www.aamva.org, or by
contacting AAMVA at 4301 Wilson
Boulevard, Suite 400, Arlington, VA
22203. You may inspect a copy of these
incorporated standards at the
Department of Homeland Security, 1621
Kent Street, 9th Floor, Rosslyn, VA
(please call 703–235–0709 to make an
appointment) or at the National
Archives and Records Administration
(NARA). For information on the
availability of material at NARA, call
202–741–6030, or go to http://
www.archives.gov/federal_register/
code_of_federal_regulations/
ibr_locations.html.
(2) The State shall establish
alternative procedures for individuals
unable to sign their name.
(h) Physical security features,
pursuant to § 37.15 of this subpart.
(i) Machine-readable technology on
the back of the card, pursuant to § 37.19
of this subpart.
(j) Date of transaction.
(k) Expiration date.
(l) State or territory of issuance.
(m) Printed information. The name,
date of birth, gender, card number, issue
date, expiration date, and address on the
face of the card must be in Latin alphanumeric characters. The name must
contain a field of no less than a total of
39 characters, and longer names shall be
truncated following the standard
established by International Civil
Aviation Organization (ICAO) 9303,
‘‘Machine Readable Travel Documents,’’
Volume 1, Part 1, Sixth Edition, 2006.
The Director of the Federal Register
approves this incorporation by reference
in accordance with 5 U.S.C. 552(a) and
1 CFR part 51. You may obtain a copy
of ICAO 9303 from the ICAO, Document
Sales Unit, 999 University Street,
Montreal, Quebec, Canada H3C 5H7, email: [email protected]. You may inspect a
copy of the incorporated standard at the
Department of Homeland Security, 1621
Kent Street, 9th Floor, Rosslyn, VA
(please call 703–235–0709 to make an
appointment) or at the National
Archives and Records Administration
(NARA). For information on the
availability of material at NARA, call
202–741–6030, or go to http://
www.archives.gov/federal_register/
code_of_federal_regulations/
ibr_locations.html.
(n) The card shall bear a DHSapproved security marking on each

E:\FR\FM\29JAR2.SGM

29JAR2

5336

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

driver’s license or identification card
that is issued reflecting the card’s level
of compliance as set forth in § 37.51 of
this Rule.
§ 37.19 Machine readable technology on
the driver’s license or identification card.

For the machine readable portion of
the REAL ID driver’s license or
identification card, States must use the
ISO/IEC 15438:2006(E) Information
Technology—Automatic identification
and data capture techniques—PDF417
symbology specification. The Director of
the Federal Register approves this
incorporation by reference in
accordance with 5 U.S.C. 552(a) and 1
CFR part 51. You may obtain a copy of
these incorporated standards at http://
www.ansi.org, or by contacting ANSI at
ANSI, 25 West 43rd Street, 4th Floor,
New York, New York 10036. You may
inspect a copy of the incorporated
standard at the Department of
Homeland Security, 1621 Kent Street,
9th Floor, Rosslyn, VA (please call 703–
235–0709 to make an appointment) or at
the National Archives and Records
Administration (NARA). For
information on the availability of
material at NARA, call 202–741–6030,
or go to http://www.archives.gov/
federal_register/
code_of_federal_regulations/
ibr_locations.html. The PDF417 bar
code standard must have the following
defined minimum data elements:
(a) Expiration date.
(b) Full legal name, unless the State
permits an applicant to establish a name
other than the name that appears on a
source document, pursuant to
§ 37.11(c)(2).
(c) Date of transaction.
(d) Date of birth.
(e) Gender.
(f) Address as listed on the card
pursuant to § 37.17(f).
(g) Unique driver’s license or
identification card number.
(h) Card design revision date,
indicating the most recent change or
modification to the visible format of the
driver’s license or identification card.
(i) Inventory control number of the
physical document.
(j) State or territory of issuance.

rwilkins on PROD1PC63 with RULES_2

§ 37.21 Temporary or limited-term driver’s
licenses and identification cards.

States may only issue a temporary or
limited-term REAL ID driver’s license or
identification card to an individual who
has temporary lawful status in the
United States.
(a) States must require, before issuing
a temporary or limited-term driver’s
license or identification card to a
person, valid documentary evidence,

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

verifiable through SAVE or other DHSapproved means, that the person has
lawful status in the United States.
(b) States shall not issue a temporary
or limited-term driver’s license or
identification card pursuant to this
section:
(1) For a time period longer than the
expiration of the applicant’s authorized
stay in the United States, or, if there is
no expiration date, for a period longer
than one year; and
(2) For longer than the State’s
maximum driver’s license or
identification card term.
(c) States shall renew a temporary or
limited-term driver’s license or
identification card pursuant to this
section and § 37.25(b)(2), only if:
(1) the individual presents valid
documentary evidence that the status by
which the applicant qualified for the
temporary or limited-term driver’s
license or identification card is still in
effect, or
(2) the individual presents valid
documentary evidence that he or she
continues to qualify for lawful status
under paragraph (a) of this section.
(d) States must verify the information
presented to establish lawful status
through SAVE, or another method
approved by DHS.
(e) Temporary or limited-term driver’s
licenses and identification cards must
clearly indicate on the face of the
license and in the machine readable
zone that the license or card is a
temporary or limited-term driver’s
license or identification card.
§ 37.23 Reissued REAL ID driver’s
licenses and identification cards.

(a) State procedure. States must
establish an effective procedure to
confirm or verify an applicant’s identity
each time a REAL ID driver’s license or
identification card is reissued, to ensure
that the individual receiving the
reissued REAL ID driver’s license or
identification card is the same
individual to whom the driver’s license
or identification card was originally
issued.
(b) Remote/Non-in-person reissuance.
Except as provided in paragraph (c) of
this section a State may conduct a nonin-person (remote) reissuance if State
procedures permit the reissuance to be
conducted remotely. Except for the
reissuance of duplicate driver’s licenses
and identification cards as defined in
this rule, the State must reverify
pursuant to § 37.13, the applicant’s SSN
and lawful status prior to reissuing the
driver’s license or identification card.
(c) In-person reissuance. The State
may not remotely reissue a driver’s
license or identification card where

PO 00000

Frm 00066

Fmt 4701

Sfmt 4700

there has been a material change in any
personally identifiable information
since prior issuance. All material
changes must be established through an
applicant’s presentation of an original
source document as provided in this
subpart, and must be verified as
specified in § 37.13.
§ 37.25 Renewal of REAL ID driver’s
licenses and identification cards.

(a) In-person renewals. States must
require holders of REAL ID driver’s
licenses and identification cards to
renew their driver’s licenses and
identification cards with the State DMV
in person, no less frequently than every
sixteen years.
(1) The State DMV shall take an
updated photograph of the applicant, no
less frequently than every sixteen years.
(2) The State must reverify the
renewal applicant’s SSN and lawful
status through SSOLV and SAVE,
respectively (or other DHS-approved
means) as applicable prior to renewing
the driver’s license or identification
card. The State must also verify
electronically information that it was
not able to verify at a previous issuance
or renewal if the systems or processes
exist to do so.
(3) Holders of temporary or limitedterm REAL ID driver’s licenses and
identification cards must present
evidence of continued lawful status via
SAVE or other method approved by
DHS when renewing their driver’s
license or identification card.
(b) Remote/Non-in-person renewal.
Except as provided in (b)(2) a State may
conduct a non-in-person (remote)
renewal if State procedures permit the
renewal to be conducted remotely.
(1) The State must reverify the
applicant’s SSN and lawful status
pursuant to § 37.13 prior to renewing
the driver’s license or identification
card.
(2) The State may not remotely renew
a REAL ID driver’s license or
identification card where there has been
a material change in any personally
identifiable information since prior
issuance. All material changes must be
established through the applicant’s
presentation of an original source
document as provided in Subpart B, and
must be verified as specified in § 37.13.
§ 37.27 Driver’s licenses and identification
cards issued during the age-based
enrollment period.

Driver’s licenses and identification
cards issued to individuals prior to a
DHS determination that the State is
materially compliant may be renewed or
reissued pursuant to current State
practices, and will be accepted for

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
official purposes until the validity dates
described in § 37.5. Effective December
1, 2014, Federal agencies will only
accept REAL ID cards for official
purpose from individuals under 50 as of
December 1, 2014. Individuals age 50 or
older on December 1, 2014, must obtain
and present REAL ID cards for official
purposes by December 1, 2017.
§ 37.29 Prohibition against holding more
than one REAL ID card or more than one
driver’s license.

(a) An individual may hold only one
REAL ID card. An individual cannot
hold a REAL ID driver’s license and a
REAL ID identification card
simultaneously. Nothing shall preclude
an individual from holding a REAL ID
card and a non-REAL ID card unless
prohibited by his or her State.
(b) Prior to issuing a REAL ID driver’s
license,
(1) A State must check with all other
States to determine if the applicant
currently holds a driver’s license or
REAL ID identification card in another
State.
(2) If the State receives confirmation
that the individual holds a driver’s
license in another State, or possesses a
REAL ID identification card in another
State, the receiving State must take
measures to confirm that the person has
terminated or is terminating the driver’s
license or REAL ID identification card
issued by the prior State pursuant to
State law, regulation or procedure.
(c) Prior to issuing a REAL ID
identification card,
(1) A State must check with all other
States to determine if the applicant
currently holds a REAL ID driver’s
license or identification card in another
State.
(2) If the State receives confirmation
that the individual holds a REAL ID
card in another State the receiving State
must take measures to confirm that the
person has terminated or is terminating
the REAL ID driver’s license or
identification card issued by the prior
State pursuant to State law, regulation
or procedure.
Subpart C—Other Requirements

rwilkins on PROD1PC63 with RULES_2

§ 37.31

Source document retention.

(a) States must retain copies of the
application, declaration and source
documents presented under § 37.11 of
this Part, including documents used to
establish all names recorded by the
DMV under § 37.11(c)(2). States shall
take measures to protect any personally
identifiable information collected
pursuant to the REAL ID Act as
described in their security plan under
§ 37.41(b)(2).

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

(1) States that choose to keep paper
copies of source documents must retain
the copies for a minimum of seven
years.
(2) States that choose to transfer
information from paper copies to
microfiche must retain the microfiche
for a minimum of ten years.
(3) States that choose to keep digital
images of source documents must retain
the images for a minimum of ten years.
(4) States are not required to retain the
declaration with application and source
documents, but must retain the
declaration consistent with applicable
State document retention requirements
and retention periods.
(b) States using digital imaging to
retain source documents must store the
images as follows:
(1) Photo images must be stored in the
Joint Photographic Experts Group (JPEG)
2000 standard for image compression, or
a standard that is interoperable with the
JPEG standard. Images must be stored in
an open (consensus) format, without
proprietary wrappers, to ensure States
can effectively use the image captures of
other States as needed.
(2) Document and signature images
must be stored in a compressed Tagged
Image Format (TIF), or a standard that
is interoperable with the TIF standard.
(3) All images must be retrievable by
the DMV if properly requested by law
enforcement.
(c) Upon request by an applicant, a
State shall record and retain the
applicant’s name, date of birth,
certificate numbers, date filed, and
issuing agency in lieu of an image or
copy of the applicant’s birth certificate,
where such procedures are required by
State law.
§ 37.33

DMV databases.

(a) States must maintain a State motor
vehicle database that contains, at a
minimum—
(1) All data fields printed on driver’s
licenses and identification cards issued
by the State, individual serial numbers
of the card, and SSN;
(2) A record of the full legal name and
recorded name established under
§ 37.11(c)(2) as applicable, without
truncation;
(3) All additional data fields included
in the MRZ but not printed on the
driver’s license or identification card;
and
(4) Motor vehicle driver’s histories,
including motor vehicle violations,
suspensions, and points on driver’s
licenses.
(b) States must protect the security of
personally identifiable information,
collected pursuant to the REAL ID Act,
in accordance with § 37.41(b)(2) of this
part.

PO 00000

Frm 00067

Fmt 4701

Sfmt 4700

5337

Subpart D—Security at DMVs and
Driver’s License and Identification
Card Production Facilities
§ 37.41

Security plan.

(a) In General. States must have a
security plan that addresses the
provisions in paragraph (b) of this
section and must submit the security
plan as part of its REAL ID certification
under § 37.55.
(b) Security plan contents. At a
minimum, the security plan must
address—
(1) Physical security for the following:
(i) Facilities used to produce driver’s
licenses and identification cards.
(ii) Storage areas for card stock and
other materials used in card production.
(2) Security of personally identifiable
information maintained at DMV
locations involved in the enrollment,
issuance, manufacture and/or
production of cards issued under the
REAL ID Act, including, but not limited
to, providing the following protections:
(i) Reasonable administrative,
technical, and physical safeguards to
protect the security, confidentiality, and
integrity of the personally identifiable
information collected, stored, and
maintained in DMV records and
information systems for purposes of
complying with the REAL ID Act. These
safeguards must include procedures to
prevent unauthorized access, use, or
dissemination of applicant information
and images of source documents
retained pursuant to the Act and
standards and procedures for document
retention and destruction.
(ii) A privacy policy regarding the
personally identifiable information
collected and maintained by the DMV
pursuant to the REAL ID Act.
(iii) Any release or use of personal
information collected and maintained
by the DMV pursuant to the REAL ID
Act must comply with the requirements
of the Driver’s Privacy Protection Act,
18 U.S.C. 2721 et seq. State plans may
go beyond these minimum privacy
requirements to provide greater
protection, and such protections are not
subject to review by DHS for purposes
of determining compliance with this
Part.
(3) Document and physical security
features for the card, consistent with the
requirements of § 37.15, including a
description of the State’s use of
biometrics, and the technical standard
utilized, if any;
(4) Access control, including the
following:
(i) Employee identification and
credentialing, including access badges.
(ii) Employee background checks, in
accordance with § 37.45 of this part.

E:\FR\FM\29JAR2.SGM

29JAR2

5338

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

(iii) Controlled access systems.
(5) Periodic training requirements
in—
(i) Fraudulent document recognition
training for all covered employees
handling source documents or engaged
in the issuance of driver’s licenses and
identification cards. The fraudulent
document training program approved by
AAMVA or other DHS approved method
satisfies the requirement of this
subsection.
(ii) Security awareness training,
including threat identification and
handling of SSI as necessary.
(6) Emergency/incident response
plan;
(7) Internal audit controls;
(8) An affirmation that the State
possesses both the authority and the
means to produce, revise, expunge, and
protect the confidentiality of REAL ID
driver’s licenses or identification cards
issued in support of Federal, State, or
local criminal justice agencies or similar
programs that require special licensing
or identification to safeguard persons or
support their official duties. These
procedures must be designed in
coordination with the key requesting
authorities to ensure that the procedures
are effective and to prevent conflicting
or inconsistent requests. In order to
safeguard the identities of individuals,
these procedures should not be
discussed in the plan and States should
make every effort to prevent disclosure
to those without a need to know about
either this confidential procedure or any
substantive information that may
compromise the confidentiality of these
operations. The appropriate law
enforcement official and United States
Attorney should be notified of any
action seeking information that could
compromise Federal law enforcement
interests.
(c) Handling of Security Plan. The
Security Plan required by this section
contains Sensitive Security Information
(SSI) and must be handled and
protected in accordance with 49 CFR
Part 1520.

rwilkins on PROD1PC63 with RULES_2

§ 37.43 Physical security of DMV
production facilities.

(a) States must ensure the physical
security of facilities where driver’s
licenses and identification cards are
produced, and the security of document
materials and papers from which
driver’s licenses and identification cards
are produced or manufactured.
(b) States must describe the security
of DMV facilities as part of their security
plan, in accordance with § 37.41.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

§ 37.45 Background checks for covered
employees.

(a) Scope. States are required to
subject persons who are involved in the
manufacture or production of REAL ID
driver’s licenses and identification
cards, or who have the ability to affect
the identity information that appears on
the driver’s license or identification
card, or current employees who will be
assigned to such positions (‘‘covered
employees’’ or ‘‘covered positions’’), to
a background check. The background
check must include, at a minimum, the
validation of references from prior
employment, a name-based and
fingerprint-based criminal history
records check, and employment
eligibility verification otherwise
required by law. States shall describe
their background check process as part
of their security plan, in accordance
with § 37.41(b)(4)(ii). This section also
applies to contractors utilized in
covered positions.
(b) Background checks. States must
ensure that any covered employee under
paragraph (a) of this section is provided
notice that he or she must undergo a
background check and the contents of
that check.
(1) Criminal history records check.
States must conduct a name-based and
fingerprint-based criminal history
records check (CHRC) using, at a
minimum, the FBI’s National Crime
Information Center (NCIC) and the
Integrated Automated Fingerprint
Identification (IAFIS) database and State
repository records on each covered
employee identified in paragraph (a) of
this section, and determine if the
covered employee has been convicted of
any of the following disqualifying
crimes:
(i) Permanent disqualifying criminal
offenses. A covered employee has a
permanent disqualifying offense if
convicted, or found not guilty by reason
of insanity, in a civilian or military
jurisdiction, of any of the felonies set
forth in 49 CFR 1572.103(a).
(ii) Interim disqualifying criminal
offenses. The criminal offenses
referenced in 49 CFR 1572.103(b) are
disqualifying if the covered employee
was either convicted of those offenses in
a civilian or military jurisdiction, or
admits having committed acts which
constitute the essential elements of any
of those criminal offenses within the
seven years preceding the date of
employment in the covered position; or
the covered employee was released from
incarceration for the crime within the
five years preceding the date of
employment in the covered position.
(iii) Under want or warrant. A covered
employee who is wanted or under

PO 00000

Frm 00068

Fmt 4701

Sfmt 4700

indictment in any civilian or military
jurisdiction for a felony referenced in
this section is disqualified until the
want or warrant is released.
(iv) Determination of arrest status.
When a fingerprint-based check
discloses an arrest for a disqualifying
crime referenced in this section without
indicating a disposition, the State must
determine the disposition of the arrest.
(v) Waiver. The State may establish
procedures to allow for a waiver of the
requirements of paragraphs (b)(1)(ii) or
(b)(1)(iv) of this section under
circumstances determined by the State.
These procedures can cover
circumstances where the covered
employee has been arrested, but no final
disposition of the matter has been
reached.
(2) Employment eligibility status
verification. The State shall ensure it is
fully in compliance with the
requirements of section 274A of the
Immigration and Nationality Act (8
U.S.C. 1324a) and its implementing
regulations (8 CFR part 274A) with
respect to each covered employee. The
State is encouraged to participate in the
USCIS E-Verify program (or any
successor program) for employment
eligibility verification.
(3) Reference check. Reference checks
from prior employers are not required if
the individual has been employed by
the DMV for at least two consecutive
years since May 11, 2006.
(4) Disqualification. If results of the
State’s CHRC reveal a permanent
disqualifying criminal offense under
paragraph (b)(1)(i) or an interim
disqualifying criminal offense under
paragraph (b)(1)(ii), the covered
employee may not be employed in a
position described in paragraph (a) of
this section. An employee whose
employment eligibility has not been
verified as required by section 274A of
the Immigration and Nationality Act (8
U.S.C. 1324a) and its implementing
regulations (8 CFR part 274A) may not
be employed in any position.
(c) Appeal. If a State determines that
the results from the CHRC do not meet
the standards of such check the State
must so inform the employee of the
determination to allow the individual
an opportunity to appeal to the State or
Federal government, as applicable.
(d) Background checks substantially
similar to the requirements of this
section that were conducted on existing
employees on or after May 11, 2006
need not be re-conducted.

E:\FR\FM\29JAR2.SGM

29JAR2

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations
§ 37.59

Subpart E—Procedures for
Determining State Compliance
§ 37.51 Compliance—general
requirements.

(a) Full compliance. To be in full
compliance with the REAL ID Act of
2005, 49 U.S.C. 30301 note, States must
meet the standards of subparts A
through D or have a REAL ID program
that DHS has determined to be
comparable to the standards of subparts
A through D. States certifying
compliance with the REAL ID Act must
follow the certification requirements
described in § 37.55. States must be
fully compliant with Subparts A
through D on or before May 11, 2011.
States must file the documentation
required under § 37.55 at least 90 days
prior to the effective date of full
compliance.
(b) Material compliance. States must
be in material compliance by January 1,
2010 to receive an additional extension
until no later than May 10, 2011 as
described in § 37.63. Benchmarks for
material compliance are detailed in the
Material Compliance Checklist found in
DHS’ Web site at http://www.dhs.gov.
§ 37.55

State certification documentation.

(a) States seeking DHS’s
determination that its program for
issuing REAL ID driver’s licenses and
identification cards is meeting the
requirements of this part (full
compliance), must provide DHS with
the following documents:
(1) A certification by the highest level
Executive official in the State overseeing
the DMV reading as follows:

rwilkins on PROD1PC63 with RULES_2

‘‘I, [name and title (name of certifying
official), (position title) of the State
(Commonwealth))] of llll, do hereby
certify that the State (Commonwealth) has
implemented a program for issuing driver’s
licenses and identification cards in
compliance with the requirements of the
REAL ID Act of 2005, as further defined in
6 CFR part 37, and intends to remain in
compliance with these regulations.’’

(2) A letter from the Attorney General
of the State confirming that the State has
the legal authority to impose
requirements necessary to meet the
standards established by this part.
(3) A description of the State’s
exceptions process under § 37.11(h),
and the State’s waiver processes under
§ 37.45(b)(1)(v).
(4) The State’s Security Plan under
§ 37.41.
(b) After DHS’s final compliance
determination, States shall recertify
compliance with this Part every three
years on a rolling basis as determined by
DHS.

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

DHS reviews of State compliance.

State REAL ID programs will be
subject to DHS review to determine
whether the State meets the
requirements for compliance with this
part.
(a) General inspection authority.
States must cooperate with DHS’s
review of the State’s compliance at any
time. In addition, the State must:
(1) Provide any reasonable
information pertinent to determining
compliance with this part as requested
by DHS;
(2) Permit DHS to conduct inspections
of any and all sites associated with the
enrollment of applicants and the
production, manufacture,
personalization and issuance of driver’s
licenses or identification cards; and
(3) Allow DHS to conduct interviews
of the State’s employees and contractors
who are involved in the application and
verification process, or the manufacture
and production of driver’s licenses or
identification cards. DHS shall provide
written notice to the State in advance of
an inspection visit.
(b) Preliminary DHS determination.
DHS shall review forms, conduct audits
of States as necessary, and make a
preliminary determination on whether
the State has satisfied the requirements
of this part within 45 days of receipt of
the Material Compliance Checklist or
State certification documentation of full
compliance pursuant to § 37.55.
(1) If DHS determines that the State
meets the benchmarks of the Material
Compliance Checklist, DHS may grant
the State an additional extension until
no later than May 10, 2011.
(2) If DHS determines that the State
meets the full requirements of subparts
A through E, the Secretary shall make a
final determination that the State is in
compliance with the REAL ID Act.
(c) State reply. The State will have up
to 30 calendar days to respond to the
preliminary determination. The State’s
reply must explain what corrective
action it either has implemented, or
intends to implement, to correct any
deficiencies cited in the preliminary
determination or, alternatively, detail
why the DHS preliminary determination
is incorrect. Upon request by the State,
an informal conference will be
scheduled during this time.
(d) Final DHS determination. DHS
will notify States of its final
determination of State compliance with
this Part, within 45 days of receipt of a
State reply.
(e) State’s right to judicial review. Any
State aggrieved by an adverse decision
under this section may seek judicial
review under 5 U.S.C. Chapter 7.

PO 00000

Frm 00069

Fmt 4701

Sfmt 4700

5339

§ 37.61 Results of compliance
determination.

(a) A State shall be deemed in
compliance with this part when DHS
issues a determination that the State
meets the requirements of this part.
(b) The Secretary will determine that
a State is not in compliance with this
part when it—
(1) Fails to submit a timely
certification or request an extension as
prescribed in this subpart; or
(2) Does not meet one or more of the
standards of this part, as established in
a determination by DHS under § 37.59.
§ 37.63

Extension of deadline.

(a) A State may request an initial
extension by filing a request with the
Secretary no later than March 31, 2008.
In the absence of extraordinary
circumstances, such an extension
request will be deemed justified for a
period lasting until, but not beyond,
December 31, 2009. DHS shall notify a
State of its acceptance of the State’s
request for initial extension within 45
days of receipt.
(b) States granted an initial extension
may file a request for an additional
extension until no later than May 10,
2011, by submitting a Material
Compliance Checklist demonstrating
material compliance, per § 37.51(b) with
certain elements of subparts A through
E as defined by DHS. Such additional
extension request must be filed by
October 11, 2009. DHS shall notify a
State whether an additional extension
has been granted within 45 days of
receipt of the request and documents
described above.
(c) Subsequent extensions, if any, will
be at the discretion of the Secretary.
§ 37.65
Part.

Effect of failure to comply with this

(a) Any driver’s license or
identification card issued by a State that
DHS determines is not in compliance
with this part is not acceptable as
identification by Federal agencies for
official purposes.
(b) Driver’s licenses and identification
cards issued by a State that has obtained
an extension of the compliance date
from DHS per § 37.51 are acceptable for
official purposes until the end of the
applicable enrollment period under
§ 37.5; or the State subsequently is
found by DHS under this Subpart to not
be in compliance.
(c) Driver’s licenses and identification
cards issued by a State that has been
determined by DHS to be in material
compliance and that are marked to
identify that the licenses and cards are
materially compliant will continue to be
accepted by Federal agencies after the

E:\FR\FM\29JAR2.SGM

29JAR2

5340

Federal Register / Vol. 73, No. 19 / Tuesday, January 29, 2008 / Rules and Regulations

expiration of the enrollment period
under § 37.5, until the expiration date
on the face of the document.
Subpart F—Driver’s Licenses and
Identification Cards Issued Under
Section 202(d)(11) of the REAL ID Act
§ 37.71 Driver’s licenses and identification
cards issued under section 202(d)(11) of the
REAL ID Act.

rwilkins on PROD1PC63 with RULES_2

(a) Except as authorized in § 37.27,
States that DHS determines are
compliant with the REAL ID Act that

VerDate Aug<31>2005

17:10 Jan 28, 2008

Jkt 214001

choose to also issue driver’s licenses
and identification cards that are not
acceptable by Federal agencies for
official purposes must ensure that such
driver’s licenses and identification
cards—
(1) Clearly state on their face and in
the machine readable zone that the card
is not acceptable for official purposes;
and
(2) Have a unique design or color
indicator that clearly distinguishes them
from driver’s licenses and identification

PO 00000

Frm 00070

Fmt 4701

Sfmt 4700

cards that meet the standards of this
part.
(b) DHS reserves the right to approve
such designations, as necessary, during
certification of compliance.
*
*
*
*
*
Issued in Washington, DC, on January 10,
2008.
Michael Chertoff,
Secretary.
[FR Doc. 08–140 Filed 1–28–08; 8:45 am]
BILLING CODE 4410–10–P

E:\FR\FM\29JAR2.SGM

29JAR2