Missouri state lawmakers overwhelmingly voted Wednesday to pass House Bill 361, effectively rejecting the provisions for compliance with the 2005 REAL ID Act. Missouri now becomes the 13th state to actively ban the national ID card provisions. This move comes amid discussions of the PASS ID legislation, which may significantly alter or repeal entirely the pilot work already performed. If the Governor does sign the legislation, the Show Me State will have a bit of cleanup to do.
Missouri accepted $17 M in DHS grants last year to serve as the lead developer in a REAL ID verification hub. That grant included an additional $1.2M to each of four other states (Florida, Indiana, Nevada, and Wisconsin) that, as the DHS announced, would use Missouri:
… as a central router to provide timely, accurate, and cost-effective verification to motor vehicle departments of an applicant’s source documents. States will be able to seamlessly verify the identity, lawful status and social security number of an applicant through this common interface.
What will happen to any unspent funds, and if there will be any penalties from the DHS for contract breach has yet to be determined. What is know is part of HB 361 does deal with destroying personally identifiable information collected in the verification hub capacity. Missouri is taking their privacy role seriously:
Any biometric data previously collected, obtained, or retained in connection with motor vehicle registration or operation, the issuance or renewal of driver’s licenses, or the issuance or renewal of any identification cards by any department or agency of the state charged with those activities shall be retrieved and deleted from all databases.
A few of the less obvious biometric authentication information are specifically called out in the bill. Facial patterns, voice, iris patterns, retinal scans and fingerprint information are all part of the popular lexicon, showing up in Hollywood blockbusters over the past couple of decades. Personally, DNA really has no reason to even be thought of as an option for biometrics with a whole host of associated issues that will no doubt be addressed at a future time. Those that are a curiosity: eye spacing, gait, and keystroke dynamics. None of these on their own should be an authentication parameter, as eye spacing and gait are casually observable, and keystroke dynamics vary widely. Someone hopped up on a Starbucks or late for a plane simply won’t press the buttons with the same lethargy for accurate measurements. Using percentages (2 out of 3) to make a better educated guess with these types of observations does makes sense. This is probably not as big of a deal with a “driver’s license”, but as we covered, opponents of REAL ID expect the card to become the next Social Security Number in terms of ubiquity and several features of the Act worry privacy professionals.
The bill does give some justification as to the motives behind the change of heart, apparently seeing the REAL ID activities as complicating state’s rights. As a verification hub, Missouri could be seen as potentially infringing on the rights of other states, or acting as an agent of the US Federal Government. In all, the MO state legislators decreed:
No citizen of this state shall have his or her privacy compromised by the state or agents of the state. The state shall within reason protect the sovereignty of the citizens the state is entrusted to protect.
Update: Follow the current progress of HB 361 through the Missouri Governor’s desk on the MO State House of Representatives site.