Missouri accepted $17 M in DHS grants last year to serve as the lead developer in a REAL ID verification hub.  That grant included an additional $1.2M to each of four other states (Florida, Indiana, Nevada, and Wisconsin) that, as the DHS announced, would use Missouri:

… as a central router to provide timely, accurate, and cost-effective verification to motor vehicle departments of an applicant’s source documents. States will be able to seamlessly verify the identity, lawful status and social security number of an applicant through this common interface.

What will happen to any unspent funds, and if there will be any penalties from the DHS for contract breach has yet to be determined.  What is know is part of HB 361 does deal with destroying personally identifiable information collected in the verification hub capacity.  Missouri is taking their privacy role seriously:

Any biometric data previously collected, obtained, or retained in connection with motor vehicle registration or operation, the issuance or renewal of driver’s licenses, or the issuance or renewal of any identification cards by any department or agency of the state charged with those activities shall be retrieved and deleted from all databases. 

A few of the less obvious biometric authentication information are specifically called out in the bill.  Facial patterns, voice, iris patterns, retinal scans and fingerprint information are all part of the popular lexicon, showing up in Hollywood blockbusters over the past couple of decades.  Personally, DNA really has no reason to even be thought of as an option for biometrics with a whole host of associated issues that will no doubt be addressed at a future time.  Those that are a curiosity: eye spacing, gait, and keystroke dynamics.  None of these on their own should be an authentication parameter, as eye spacing and gait are casually observable, and keystroke dynamics vary widely.  Someone hopped up on a Starbucks or late for a plane simply won’t press the buttons with the same lethargy for accurate measurements.  Using percentages (2 out of 3) to make a better educated guess with these types of observations does makes sense.  This is probably not as big of a deal with a “driver’s license”, but as we covered, opponents of REAL ID expect the card to become the next Social Security Number in terms of ubiquity and several features of the Act worry privacy professionals.

The bill does give some justification as to the motives behind the change of heart, apparently seeing the REAL ID activities as complicating state’s rights.  As a verification hub, Missouri could be seen as potentially infringing on the rights of other states, or acting as an agent of the US Federal Government.  In all, the MO state legislators decreed:  

No citizen of this state shall have his or her privacy compromised by the state or agents of the state. The state shall within reason protect the sovereignty of the citizens the state is entrusted to protect.

Update:  Follow the current progress of HB 361 through the Missouri Governor’s desk on the MO State House of Representatives site.

The PASS ID Act currently circulating in Washington would give states even more time (4 additional years) than the 2008 DHS extensions until 2017, additional flexibility in the design and implementation and, most importantly, money to meet federal REAL ID requirements.  PASS ID would allow continued use of current driver’s licenses for commercial airline travel and for federal building entrance for the foreseeable future.  Under the REAL ID Act, states not meeting a list of license upgrades would have to bring their US passport after January 2010 to catch a plane or head into a federal building.

The Homeland Security Secretary, Janet Napolitano said last Wednesday, “We’ve been, over the last weeks, meeting with governors of both parties to look at a way to repeal Real ID and substitute something else that…accomplishes some of the same goals. And we hope to announce something on that soon.”  Napolitano was the previous governor of Arizona, and signed a bill prohibiting the state’s compliance with REAL ID.  A total of 18 states since 2005 have passed anti-REAL ID legislation, calling the act an unfunded mandate violating state’s rights.  Of the 18 states that passed non-binding resolutions or prohibiting statues, 12 cited privacy as rationale for the disaccord. 

A former 9/11 Commission counsel and National Security Policy Director at the Center for Immigration Studies produced a scathing analysis of the Pass ID proposal, saying it is “a complete gutting of REAL ID,” and “leaves the 9/11 Commission secure ID recommendations in the dust, setting minimum standards that the 9/11 hijackers could easily have bypassed”.  The Director of Information Policy Studies at the libertarian Cato Institute, thinks PASS ID will not go far enough to eliminate all state concerns.  “The structure of it is obviously Real ID, with some of the sharpest corners taken off.”

Will the new legislation alleviate the most significant privacy violations?  Montana will likely have a say, already passing a refusal to comply law due, among other reasons, to the REAL ID Act’s violating the “right to privacy, as secured by Article II, section 10, of the Montana Constitution, of thousands of residents of Montana”.  Other states, including Michigan and Pennsylvania have followed suit without further concessions or privacy guarantees from DHS.   This is a direct confrontation over state’s rights, with privacy considerations anchored front and center.