Getting personal: 'Smart' ID cards linked to databases gain favor

E-mail this article Print this article Related stories They've got you under your skin

Navy Petty Officer Wellington Jimenez walked into the room at Fort Hamilton in Brooklyn and provided his name, rank and fingerprint. In return, he got a token of the future: a plastic ID card embedded with a computer chip.

More than 120,000 active-duty military personnel, selected reserves, Defense Department civilians and some contractors have received the cards in recent months. About 4 million are to be issued over the next two years.

When Jimenez sits down at a computer on his next ship, the USS George Washington, he'll slip the card — which includes two photos, two bar codes, a magnetic strip and an etched gold chip — into a device that will electronically scramble his e-mail to prevent outsiders from reading it. The same card will automatically give him access to secure rooms across the world. At a military hospital, its chip will one day summon his medical records.

And more than ever, the cards will enable Defense Department officials to look into their databases and know the doorways he passes through, the computers he accesses and the doctors he sees, all of which is fine with Jimenez.

The high-tech IDs were designed for tracking military personnel across the globe. Now they're models for something that was unthinkable before Sept. 11: national identification cards for all U.S. citizens.

Members of Congress, security experts and high-tech executives have endorsed the idea of a new identification system. They believe the cards would prevent terrorists from operating under assumed names and identities.

Such proposals foundered in the past. Opponents raised the specter of prying bureaucrats accessing databases full of personal information and the kind of unchecked police authority that would erode constitutional protections.

Simon Davies, director of Privacy International, a London-based advocacy group that has studied national IDs, said the computers and networks in a centralized system also would become targets of hackers. In recent years, scores of private and government databases, containing financial, medical and other personal information, have been breached by hackers, some who publicized the data or used it in fraud schemes.

It also could make it easier for a successful forger or hacker to maintain a false identity, since authorities would trust a new, high-tech system. A lost or stolen card under such a system "will paralyze your card or your identity for days or weeks," he said.

A new consciousness

The nation's new consciousness of terrorism, however, has changed the way Americans think about security, surveillance and their civil liberties. For many people, the trade-off of privacy for security now seems reasonable.

Congress in October approved a sweeping anti-terrorism bill that gives authorities much broader powers to monitor e-mail, listen to phone calls and secretly gather records.

About 70 percent of those recently polled by the Pew Research Center said they favor a system that would require people to show an ID card to authorities who request it.

The political hurdles for a national ID card remain huge. President Bush has publicly downplayed its benefits, saying it's unnecessary.

Logistical problems and costs also make it unlikely that a mandatory, national ID system could soon be adopted.

But a range of steps now under way could lead to a de facto national ID system.

The American Association of Motor Vehicle Administrators, a group of state officials, is devising a plan for a national identification system linking all driver databases to driver's licenses with computer chips, bar codes and identifiers such as fingerprints or other unique physical characteristics.

Technology specialists at the Justice Department and General Services Administration have acknowledged they're working with motor-vehicle officials and commercial vendors to develop a standard for some sort of ID system, mandatory or not.

The Air Transport Association, meanwhile, has called for a similar voluntary travel card for passengers that would link to a system of government databases including criminal, intelligence and financial records. Passengers who agreed to use the card would have easier access to airplanes.

A bill introduced in Congress by Rep. Stephen Horn, R-Calif., would establish a Commission on Homeland Security to study the federal government's efforts to protect U.S. security, including the use of national ID systems.

"This commission is not intended to resolve the national identification issue," said Horn. "It is merely to advance the debate in light of the Sept. 11 attacks."

Much of the momentum for a card has been generated by the fact that five of the 19 terrorists involved in the attacks on New York and the Pentagon were able to obtain Social Security numbers by using false identities. The other 14 probably made up or appropriated other numbers and used them for false identification, according to Social Security officials. At least seven also obtained Virginia state ID cards.

Over the years, the government has found myriad ways to get involved in the identity business — passports, for one, and state-issued driver's licenses. A Social Security number is an ubiquitous identifier.

Social Security cards, however, contain no authenticating information, such as pictures, and can be easily forged. Pilot licenses are often printed on paper. Driver's licenses, even those now designed to be tamperproof, can be obtained with fraudulent birth certificates, Social Security cards and other documentation.

Tamperproof smart cards don't necessarily worry privacy advocates, who have made identity theft a banner issue in recent years. What does trouble them is the more complex question of whether a national ID system should go beyond simple authentication of an individual's identity.

Proponents argue that security can be achieved only with a smart card that can cross-check various storehouses of personal data to determine whether someone should be viewed with suspicion. That would mean, for example, that an airline ticket agent swiping a card would be warned, by law-enforcement, intelligence and some private databases, about an individual who overstayed a tourist visa, is on a government watch list or is wanted for a crime.

In the world before Sept. 11, a large majority of Americans expressed concerns in surveys about personal privacy, and those concerns focused on the increasing collection of data — names, addresses, buying habits and movements — by businesses interested in developing sophisticated marketing campaigns.

At the same time, they also demonstrated a willingness to surrender personal information for discounts or conveniences, such as cheaper groceries, faster passage through toll booths and upgrades on airline travel, one reason for an enormous growth in databases in recent years.

"Massive" database growth

"It's massive," said Judith DeCew, a Clark University professor and author of "In Pursuit of Privacy: Law, Ethics and the Rise of Technology." "It's financial information. It's credit information. It's medical records, insurance records, what you buy, calls you make. Almost every action or activity ... generates a huge database about you."

State and federal governments also have expanded their data networks and use of personal information. Nearly every time police make a traffic stop, for example, they tap into National Crime Information Center databases to check whether the driver is a known criminal or suspect.

As part of an aggressive effort to track down parents who owe child support, the federal government created a data-monitoring system that includes all individuals with new jobs and the names, addresses, Social Security numbers and wages of nearly every working adult in the United States. Banks are obligated to search through lists of accounts for deadbeats, or turn the data over to the government.

Government agencies have contracted with private companies for information. The Internal Revenue Service, for example, hired ChoicePoint to give about 20,000 employees instant access to 10 billion public records containing housing, financial and other personal information. ChoicePoint provides data to the FBI and other agencies as well.

Acxiom is lobbying Congress to change a relatively new law that limits their use of driver's-license numbers. Acxiom wants to use those numbers to create a new authentication system at airports, improving the ability of clerks to ask travelers personal questions that would help verify who they are.

Deirdre Mulligan, director of the Samuelson Law, Technology and Public Policy Clinic at the University of California, Berkeley, said any decision to adopt such a system should be made by elected officials, not motor-vehicle bureaucrats or private companies.

Pluses and minuses

A centralized ID database would speed verification and make life more convenient for travelers, airlines and others. The disadvantage, according to civil-liberties activists, is that agencies would gain access to unprecedented amounts of aggregated data. Questions about who would maintain the database and gain access to it would be thorny. Accuracy and currency also pose challenges.

An alternative would be to configure databases to allow certain pieces of information, or fields of data, to be accessed by the smart card.

If a new ID-card system is developed in the United States, the initial users are likely to be immigrants and foreign visitors. Last month, Sen. Dianne Feinstein, D-Calif., and Sen. Jon Kyl, R-Ariz., introduced legislation that would require foreign nationals to use high-tech visa cards containing a fingerprint, retinal scan or other unique identifier. It also would create a centralized "lookout database" containing information about known terrorists and other U.S. visitors deemed threatening.

The driver's-license proposal stands as an alternative to a single national card. A technical standard would define the security features of the card, but states would have the freedom of creative design and bear the burden of administering it. Proponents acknowledge it could easily assume all the features of a national ID card once other government agencies and private companies begin tailoring their computers to capture information from the card.

Even if it were approved today, proponents say, the card would take years to take hold, as motor-vehicle administrators arranged funding and drivers reapplied for licenses.

A national identification system would raise privacy questions, said Tate Preston, vice president at Datacard Group, which creates high-tech IDs. But the need for a better identification system is beyond question.

"In the 19th century, it was sufficient to ask who you are," he said. "In the 20th century, it was sufficient to show who you are. In the 21st century, you will have to prove who you are."