BILL ANALYSIS �
AB 2113
Page 1
Date of Hearing: April 24, 2012
ASSEMBLY COMMITTEE ON JUDICIARY
Mike Feuer, Chair
AB 2113 (Hueso) - As Amended: March 29, 2012
As Proposed to Be Amended
SUBJECT : Enhanced Driver's Licenses
KEY ISSUE : Should California provide enhanced driver's
licenses, which effectively serve as both driver's license and
passport, to person's who request them, so as to better
facilitate travel between California and Mexico?
FISCAL EFFECT : As currently in print this bill is keyed
fiscal.
SYNOPSIS
This bill would authorize the Department of Motor Vehicles (DMV)
to enter into a Memorandum of Understanding with the federal
government to issue "enhanced driver's licenses" which serve as
both driver's license and passport, if the applicant chooses to
have one. Since 2009, pursuant to the federal Western
Hemisphere Travel Initiative (WHTI), persons entering the United
States by land or sea from Canada, Mexico, Bermuda, or the
Caribbean must present a passport, enhanced driver's license, or
some other official card that proves identity or citizenship.
Before 9-11, land travel across borders, especially between the
United States and Canada, tended to be more informal and less
rigorous. However, more rigorous enforcement slowed crossings
and led to longer wait lines. To reduce congestion, WHTI
authorized the use of enhanced driver's licenses and
identification cards, and the United States Customs and Border
Protection created "Ready Lanes" dedicated to travelers with
RFID-enabled travel documents. Under WHTI, and rules
promulgated by the Department of Homeland Security (DHS), states
that border Mexico and Canada may enter into agreements with DHS
that allow them to issue enhanced driver's licenses that meet
certain criteria, including use of radio frequency
identification (RFID) technology. Proponents of this bill,
mostly chambers of commerce from both California and Mexico,
argue that this measure will reduce wait times at border
crossings and facilitate cross-border travel and trade.
AB 2113
Page 2
Opponents contend that RFID chips, which can be read at
distances of up to 30 feet or more, pose a significant threat to
personal privacy and could be surreptitiously copied to permit
unauthorized border crossings. The author and proponents
respond that RFID-enabled licenses will not contain any personal
information and stress the voluntary nature of the program.
However, to address some of these privacy concerns, the author
will take several amendments that are reflected and explained in
the analysis. The bill recently passed of the Assembly
Transportation Committee on a 13-0 vote.
SUMMARY : Authorizes the Department of Motor Vehicles (DMV) to
enter into a Memorandum of Understanding with a federal agency
to allow DMV to offer an enhanced driver's license, as defined,
to applicants who request it. Specifically, this bill :
1)Makes various legislative findings and declarations regarding
traffic congestion and wait times at points of entry between
California and Mexico and the potentially negative impact of
these wait times on international trade, travel, and commerce.
2)Authorizes the Department of Motor Vehicles (DMV) to enter
into a Memorandum of Understanding (MOU) for the purpose of
issuing an enhanced driver's license, instructional permit,
provisional license, or identification card �hereafter EDL] to
a person who is at least 16 years of age, is a resident of
California, and is a citizen of the United States. Requires
the applicant to submit sufficient proof that meets the
requirements of the Western Hemisphere Travel Initiative to
establish his or her identity, residency, and citizenship, and
to certify, under penalty of perjury, that the information
submitted is true and correct to the best of the applicant's
knowledge.
3)Prohibits an employer from requiring that an employee obtain
or use an EDL as a condition of employment, or take an adverse
action against an employee for refusing to do so.
4)Requires an applicant for an EDL to sign a declaration
acknowledging his or her understanding of radio frequency
identification (RFID) technology.
5)Requires the EDL to include reasonable security measures,
including the use of tamper-resistant features, to protect
AB 2113
Page 3
against unauthorized duplication or disclosure of personal
information.
6)Requires the EDL to include both of the following:
a) RFID technology that contains only a randomly assigned
number, which shall be encrypted if agreed to by the
Department of Homeland Security, and which shall not
contain any personal data, biometric information, or any
number other than the randomly assigned number.
b) A machine-readable zone (MRZ) or barcode that can be
electronically read by the border patrol and contains only
as much information as is required by the Western
Hemisphere Travel Initiative to permit a border crossing.
7)Requires an applicant for an EDL to have his or her facial
image and signature captured or reproduced by DMV at the time
of application or renewal. Prohibits DMV from disclosing the
facial image or signature, of a copy of a digital image of any
required document, except that DMV may make the facial image
and signature available to the United States Customs and
Border Protection data base or as required by the Department
of Homeland Security for purposes of facilitating the purpose
of the Western Hemisphere Travel Initiative.
8)Makes the facial image, signature, and copies or digital
images of any documents required for application exempt from
public records request.
9)Permits DMV to deny an application for an EDL if it not
satisfied with the genuineness of the applicant's supporting
materials, subject to the applicant's right to appeal the
denial, as specified.
10)Requires an applicant for an EDL to pay a fee of $75 and
provides that fees shall be deposited in an account and to be
used by DMV to implement the provisions of this bill.
11)Requires DMV to make an annual report to relevant legislative
committees and requires the report to include information on
the number of enhanced driver's licenses and identification
cards issued, the effect of EDL use on wait times and traffic
congestion at points of entry, and whether or not there have
been any security or privacy breaches related to the use of
the EDL.
AB 2113
Page 4
EXISTING LAW :
1)Requires DMV, upon proper application, to issue driver's
licenses and identification cards.
2)Authorizes, under the federal Western Hemisphere Travel
Initiative, the use of EDLs to prove identity and citizenship
for purposes of traveling between the United States, Canada,
Mexico, Bermuda, and the Caribbean, so long as the EDL meets
specified requirements, including radio frequency
identification (RFID) that signals a secure government data
base maintained by the United States Customs and Border
Protection. (Public Law 110-53.)
COMMENTS : The Western Hemisphere Travel Initiative (WHTI)
represents a joint effort by the Department of Homeland Security
(DHS) and United States Customs and Border Protection (CBP) to
implement provisions of the Intelligence Reform and Terrorism
Prevention Act (IRTPA) of 2004. As of January 1, 2009, WHTI
began requiring U.S. citizens traveling between the U.S. and
Canada, Mexico, Bermuda, and the Caribbean by land or sea to
present a valid U.S. Passport or other WHTI-compliant document.
Among the accepted documents are passports, a U.S. passport
card, Trusted Traveler Program cards (NEXUS, FAST, or SENTRI),
or an enhanced driver's license (EDL). Before 9-11, land travel
across borders, especially between the United States and Canada,
tended to be more informal and less rigorous, with border agents
often accepting a birth certificate or even a person's verbal
affirmation of citizenship. However, more rigorous enforcement
and new requirements under IRTPA slowed crossings and led to
longer wait lines. To reduce this congestion WHTI authorized
the use of EDLs (including state-issued identification cards),
and the CBP created "Ready Lanes" dedicated to travelers with
RFID-enabled travel documents. The goal of the EDL program is
to strengthen border security and facilitate ease of entry into
the United States for U.S. Citizens, especially those driving
across the border on a regular basis.
Federal law requires that any border state wishing to adopt EDLs
must first sign a Memorandum of Understanding (MOU) with DHS.
So far four states - Vermont, New York, Michigan, and Washington
- have enacted authorizing legislation and already have EDLs in
place. New York was the first state to sign an MOU in 2007, and
thus has participated in the WHTI since the beginning.
AB 2113
Page 5
Minnesota has also enacted authorizing legislation, but
apparently its MOU is not expected to go into effect until
either June of 2012 or January of 2013.
For the most part the programs have met with success; for
example, the New York State DMV reports on its website that over
100,000 persons have availed themselves of the new licenses,
especially in upstate New York near the Canadian border. In
addition to decreasing overall wait times for all travelers, EDL
holders often use RFID-enabled "Ready Lanes" created by CBP.
According to these official websites, at least, the RFID chip
allow border patrol agents to pull up a person's information and
photograph immediately without having to collect paper
documents, inspect them, and then key in any required
information. All of this is done for them when the traveler
holds the EDL up as he or she passes the RFID reader. The
system does not, of course, allow the EDL holder to simply pass
through; the border patrol agents must still make a visual
identification with the accessed photograph and may also ask
questions or inspect the EDL.
This bill would permit California citizens traveling across the
California-Mexico to take advantage of this more convenient and
time-saving process by authorizing DMV to enter into an MOU with
DHS. According to the author, the idea for this bill grew out
of his experience as Chair of the Select Committee on
California-Mexico-Bi-National Affairs, where he became aware of
the significant impact of border wait times on our state's
economy. Indeed, the author provided the Committee with a 2007
report suggesting that long wait times slow commerce and
discourage personal trips across the California-Mexico border.
The report claims that delays at the border at the San Ysidro,
Otay Mesa, and Tecate points-of-entry result in the loss of
millions of dollars (and even billions) in lost revenue and tens
of thousands of jobs in the San Diego-Baja region. (San Diego
Association of Governments and the California Department of
Transportation, 2007 Update to Economic Impacts of Wait Times at
the San Diego-Baja California Border: Final Report.) Not
surprisingly, many of the supporters of this bill represent
chambers of commerce, tourism boards, and the like who believe
that shorter wait times and more travel across the border will
translate into more trade and tourism. In addition to these
economic benefits, the author also believes that this bill will
allow persons who regularly cross the border to make use of the
RFID-enabled "Ready Lanes."
AB 2113
Page 6
Under the MOU authorized by this bill, the DMV could only issue
an EDL to a person who requests it and is willing to pay a $75
fee. No one would be forced to obtain a license. Although many
of the details of the program would presumably be worked out as
part of the MOU, the bill as proposed to be amended nonetheless
sets forth a number of specific requirements. For example, the
bill as amended will specify that the RFID technology used could
only contain a random number; that the EDL would employ
reasonable security measures, including temper-resistant
features; and that persons obtaining an EDL acknowledge their
understanding of RFID technology.
The bill also sets forth requirements for applying for an EDL.
In addition to paying the $75 fee and submitting documents
proving identity and citizenship, applicants must also agree to
have their facial image and signature captured by DMV at the
time of application or renewal. As amended, the bill limits
DMV's ability to disclose the facial image or signature, or any
other digital images of documents submitted, for purposes
authorized by WHTI, and it exempts the facial image, signature,
or other required documents from required disclosure under the
Public Records Act. Finally, the bill seeks to make the program
self-funding. Proceeds from the $75 application fee will be
deposited into the Enhanced Driver's License and Identification
Subaccount, which DMV will use to implement the program.
Concerns about EDLs and Real ID: Although the EDL initiatives
adopted in other states appear to work smoothly according to
official reports, they have not been without criticism or
controversy. In some instances, the debate over the EDLs has
become confused with the debate over Real ID, the controversial
and still languishing 2005 federal law that requires state
driver's licenses to meet certain standards if they are to be
accepted for "official government purposes," as defined by DHS.
However, EDL is not a Real ID. Indeed, the MOU framework
developed by DHS expressly states that the EDLs must be clearly
marked to show that they are "not acceptable for official U.S.
Government purposes, as that term is defined under Real ID."
(See "Memorandum of Agreement Between the New York State
Department of Motor Vehicles and the United States Department of
Homeland Security," October 26, 2007.) Real ID is supposed to
be for some still undefined federal "government purposes," while
EDLs are for the more limited and concrete purpose of
AB 2113
Page 7
cross-border travel.
Privacy Concerns Surrounding the use of RFID: Much of the
concern relating to EDLs, and especially the DHS rule that they
include RFID technology, has focused on potential threats to
privacy. Despite some technical-sounding terminology, the basic
outline of how RFID and related technologies work is fairly easy
to understand. RFID "tags" or "chips" can be embedded into
objects, including documents, clothing, pets, and even people.
The RFID technology used in EDLs typically consists of a
microchip (that stores a randomly assigned number) and one or
more antennae. Remote "readers" can read this tag, via radio
waves. The reader constantly emits radio signals. As a person
or object with an RFID tag moves near the reader - the distance
varies depending upon the device - the antennae pick up the
signal and transmit the number stored on the RFID tag to the
reader. Most RFID tags, and apparently all of the ones used
thus far for EDLs are "passive," which means that they can only
be activated by the radio signal; others are "active," which
means that they can actively search out readers in the area. In
either case, an authorized reader with access to a secure
database can then transmit this number to the database where it
can be matched to information about the holder. The distinction
between "passive" and "active" tags is important because,
despite some claims to the contrary, EDLs do not "broadcast" any
information, personal or otherwise.
In some ways, RFID technology is a higher-tech version of bar
code and magnetic strip scanning. However, bar code and strip
scanning requires direct contact between the scanner and the
stored information (or at least the magnetic strip or barcode
must be in the direct line of sight of a laser). RFID readers,
on the other hand, can read the information stored on the RFID
tag remotely. Many of these, like the security badges used in
the Legislature, must be held within a few inches of the reader.
Some RFID readers, however, may read tags from distances of 30
feet or more, according to some studies. Experts disagree on
the potential range of RFID readers in the future, but as
technology advances it seems quite reasonable to assume that
those ranges will become longer. However, the fact that RFID
tags can be read at any distance creates the possibility that
information stored on an identification document can be read
without the holder's knowledge or consent.
AB 2113
Page 8
Given that RFID tags can be read at a distance, and potentially
without the holder's knowledge, a key privacy concern relates to
the kind of information stored on the RFID tag and the
usefulness of that information to any unauthorized reader.
According to CBP and agency websites in the four states that
have adopted EDLs, the RFID chip only contains a randomly
assigned number that has no meaning until an authorized reader
transmits it to a secure government data base, where the random
number is then matched to other information. However, according
to some privacy rights groups, RFID tags can apparently contain
other kinds of information, such as a name, address, a credit
card number, or even a visual image. Some of the opposition to
this bill on this point, however, appears to misread the
language of the bill. For example, one opponent writes that
this bill requires the licenses to "contain, through RFID
technology, a person's 'biographic and biometric' data." In
fact, the bill in print does not say this: it says that the
license will contain RFID technology that signals a secure
system that contains such information. In order to make it
clear that the RFID chip will not contain such information, the
bill as proposed to be amended will specify that the RFID shall
only contain a randomly assigned number and no other forms of
personal information. This is consistent with existing
practices and other state statutes authorizing participation in
the EDL program. (See e.g. Michigan Compiled Laws Section
28.304.)
Even if the RFID tag contains only a random number, however,
privacy concerns do not necessarily stop there. For example,
privacy advocates point out that security measures must address
more than the ability of the reader to access intelligible
information from the tag; they must also address potential
security breaches along the entire transmission process from
tag, to reader, to computer database. Opponents also contend
that the random number can itself become a piece of personally
identifiable information, like a social security number, which
is also more or less a random number that is assigned to a
person but becomes permanently associated with that person.
Proponents of RFID, on the other hand, claim that RFID
applications are confined to a closed system of authorized tags,
readers, and databases within that system. So that even if
outsiders with remote readers obtained information from an RFID
tag, that information is only intelligible to persons within the
system or who can access that system. If an unauthorized person
has accessed a secure government system, then clearly there has
AB 2113
Page 9
been a larger breach than the unauthorized reading of an RFID
chip. As to the RFID number becoming akin to a social security
numbers, proponents would point out that the danger of
disclosing a social security number stems from the fact that it
can be used for identification purposes in a host of other
contexts, such as obtaining credit, applying for a job - or even
to applying for an EDL. However, the random number on an RFID
chip, by itself, cannot be used to do anything. It can only be
used by a person or entity that also has access to the secure
data base to which it relates.
The author recognizes these concerns. Therefore, as proposed to
be amended, this bill would require encryption, if agreed to by
DHS, and other "reasonable security measures to protect against
unauthorized disclosure of personal information regarding the
person who is the subject of license, permit, or card."
Although the bill in print does not expressly say what these
"reasonable security measures" include, as proposed to be
amended the bill specifies that this would include, at a
minimum, tamper-resistance features to prevent unauthorized
duplication or cloning. This language is consistent with the
authorizing legislation enacted in other states. Moreover,
according to agency websites of the states that have entered
into MOUs with DHS, the licenses appear to adopt standard
security measures, such as a sleeve or "Faraday shield" that
prevents unauthorized reading of the RFID chip - so long as the
sleeve is in place. Some privacy groups claim that these
shields are not always adequate - in part because they are
apparently not always impenetrable, and in part because there is
no guarantee that people will use them. However, this bill,
like the authorizing legislation in other states, requires an
applicant to sign a declaration acknowledging his or her
understanding of RFID technology.
RFID and Possible Security Concerns: Opponents also contend
that using RFID technology could pose security as well as a
privacy risks. That is, even if an RFID reader cannot access
the secure data base it could potentially copy the random number
and use it to create counterfeit licenses. According to the
ACLU of Washington State, studies suggest that such duplication
is possible. In an effort to address this concern, the bill as
proposed to be amended would specify that the "reasonable
security measures" required by the bill must include
"tamper-resistance features" that prevent duplication. In
addition, it should be noted that even if a counterfeit EDL were
AB 2113
Page 10
made with the help of a surreptitious reader, the border patrol
must still visually determine that the person presenting the EDL
matches the photograph that is pulled up from the secure
database. Obviously there is no foolproof means of preventing a
very determined person from making counterfeit EDLs, just as
there is no foolproof way of preventing that person from
obtaining counterfeit copies of regular driver's licenses or
passports.
Proposed Author Amendments Appear to Address Some Opposition
Concerns : As noted above, the author has agreed to take
amendments to address some of the opposition concerns, and he
has indicated his willingness to continue working with the
opposition if the bill moves forward. Below is a list of
specific amendments and the rationale for each:
Amendment One : Other states that have adopted EDLs specify that
the RFID chip shall only contain a random, encrypted number and
expressly prohibit the chip from containing any biographic or
biometric information. As noted in the analysis, RFID typically
only contains a random number and not personal information, but
adopting the language used in other states will make this clear
and perhaps assuage some of the concern that surreptitious RFID
readers will obtain sensitive personal information. Therefore,
the author wishes to make the following amendments relating to
privacy and security:
On page 5 line 16 delete "signal" and delete lines 17
and 18 and insert: contain only a randomly assigned number,
which shall be encrypted if agreed to by the department of
homeland security, and shall not contain any personal data,
biometric information, or any number other than the
randomly assigned number.
On page 5 lines 20 after "patrol" insert: and contains
only as much information as is required by the Western
Hemisphere Travel Initiative to permit a border crossing.
On page 5 line 10 after "measures" insert: including
tamper-resistant features to prevent unauthorized
duplication or cloning and
Amendment Two : Because persons who cross borders on a regular
basis are sometimes employees acting in the course of
employment, it is critical that they not be coerced into
obtaining or using an EDL if the program is to be truly
voluntary. Therefore, the author will take the following
AB 2113
Page 11
amendment, which is modeled after authorizing legislation
enacted in Minnesota:
On page 5 after line 22 insert a new subdivision (f)
that reads as follows: (f) No employer may require an
employee to apply for or use an enhanced driver's license
as a condition of employment, nor may any employer
discharge an employee or otherwise discriminate or
retaliate against an employee who refuses to apply for or
use an enhanced driver's license or identification card.
Amendment Three : The bill in print permits the DMV to make an
applicant's facial image and signature available to several
federal, state, and local entities, and the parameters under
which these may be disclosed appear extraordinarily broad. The
author therefore will narrow the disclosure to purposes of the
WHTI. Specifically the amendment will state:
On page 5 delete "be available to the" and delete lines
30 through 36 and insert: only be available to the United
States Customs and Border Protection data base or as
required by the Department of Homeland Security for
purposes of facilitating the purpose of the Western
Hemisphere Travel Initiative.
Amendment Four : At least one state, Vermont, requires the
department responsible for the EDL program to provide regular
reports to the legislature in order determine the extent to
which EDLs are used and report on any implementation problems.
The author, therefore, wishes to take the following amendment:
On page 7 after line 5 insert a new subdivision (c) that
reads as follows: The department shall make an annual
report to the Assembly and Senate Committees on Judiciary,
the Senate Committee on Transportation and Housing, and the
Assembly Committee on Transportation. The report shall
include, but is not limited to, information on the number
of enhanced driver's licenses and identification cards
issued, the effect on wait times and traffic congestion at
points of entry, and whether or not there have been any
security or privacy breaches related to the use of the
enhanced driver's licenses and identification cards.
ARGUMENTS IN SUPPORT : According to the California Chamber of
Commerce, the "ports of entry along the California-Mexico border
AB 2113
Page 12
are among the busiest ports in the world." The Chamber claims
that each year forty-five million vehicle passengers cross the
border at one of six points of entry, and that "the average wait
for travelers at these ports is over an hour." The Chamber
further claims that these delays "result in a loss of eight
million trips each year," and that in San Diego County alone
this translates into an estimated loss of $1.2 billion in
revenues. The Chamber believes that this bill will relieve
border congestion by allowing travelers to use "ready lanes,"
and that it will allow CBP officers to quickly assess
information "and focus on the traveler's vehicle as opposed to
scanning documents - reducing wait time by up to 60%."
The Imperial County Transportation Commission supports this bill
for substantially the same reasons, claiming that border wait
times cause "a devastating loss of nearly $1.5 billion in
revenues, 3.4 million potential working hours, 39, 500 jobs, and
$59 million in wages annually in the San Diego and Imperial
region alone." Several other business groups and local tourism
agencies, both from Southern California and from Baja
California, support this bill and cite similar statistics for
the economic impact on their respective locales.
ARGUMENTS IN OPPOSITION : Consumer and privacy groups oppose
this bill primarily because of the privacy or security risks
associated with the use of RFID and the collection of facial
images by the DMV. The ACLU claims that while this bill
currently only proposes a voluntary program for those who are
interested, "it sets up a framework that could be expanded to
all Californians who carry a driver's license or ID." ACLU also
believes that this bill will permit the DMV to collect facial
images without clearly spelling out who will have access to
those images. In particular, ACLU points to the provision in
the bill in print that would allow access to various federal,
state, and local entities. (It is not clear whether this
concern is addressed by the amendment that limits disclosure of
these images only to CBP or as required for purposes of
fulfilling the purposes of the WHTI.) The ACLU's concern on
this point is closely related to how disclosure of this
information might facilitate forms of surveillance that use
facial recognition technology. For example, ACLU cites the 2001
incident in which Tampa police allegedly scanned the faces of
tens of thousands of people attending the Super Bowl.
Similarly, ACLU reasons, law enforcement could scan the faces of
persons attending rallies, strikes, or protests and compare the
AB 2113
Page 13
scanned images to images stored in the DMV or CBP database, or
any other government database to which DMV would be authorized
to submit them.
Privacy Rights Clearinghouse argues that long-range RFID
technology would expose "information to electronic theft, or
'skimming', from a distance, and it cites a report by RSA
Security - a company that produces various kinds of electronic
security devices - that the Washington state EDL program lacked
adequate security. Like ACLU, Privacy Rights Clearinghouse
cites concerns about the collection of facial images, and cites
a 2009 letter written by the Legislative Analyst Office opposing
a plan to permit DMV to use biometric software to verify the
identity of applicants. The LAO feared the collection of such
data raised privacy concerns, especially if DMV were to
integrate "biometric technology into driver licenses and cards."
The Electronic Frontier Foundation and the Consumer Federation
of California oppose this bill for substantially the same
reasons.
REGISTERED SUPPORT / OPPOSITION :
Support
California Chamber of Commerce
Chula Vista City Councilwoman, Pamela Bensoussan
Consejo Coordinador Empresarial De Ensenada
Gobernador Del Estado De Baja California, Jose Gaudalupe Osuna
Millan
Imperial County Transportation Commission
Otay Mesa Chamber of Commerce
San Diego City Councilman, David Alvarez
San Ysidro Smart Border Coalition
San Ysidro Chamber of Commerce
El Secretario De Turismo Del Estado De Baja California
Smart Border Coalition (San Diego and Tijuana)
Opposition
ACLU
Consumer Federation of California
Electronic Frontier Foundation
Privacy Rights Clearinghouse
AB 2113
Page 14
Analysis Prepared by : Thomas Clark / JUD. / (916) 319-2334