Writing in the Washington Post last week, 9/11 Commissioner John Lehman offered an impassioned defense for the REAL ID Act, urging states to drop their objections to the deeply flawed law and move forward with adoption. While we agree with Lehman's position that driver's license reform is necessary, his suggestion that the REAL ID Act is the best, or indeed the only way to address the problem is way off the mark.

A little bit of background is in order. The REAL ID Act was passed in 2005 after its supporters hijacked a bipartisan administrative and legislative process aimed at developing real solutions to the problems of identification security. In place of a thoughtful, balanced approach that respected the unique privacy and security challenges associated with identification, the American people got a rushed, poorly thought out bill that would do little to secure the nations driver's license systems. Equally troubling, the measure contained nary a mention of the word "privacy."

As written, the REAL ID Act has several troubling ramifications. Although it is true -- as supporters like Lehman argue -- that the law does not directly create a centralized national database of driver's license information, the DHS officials charged with implementing the law have openly discussed changes that would do just that.

DHS had an opportunity -- in drafting regulations to implement REAL ID -- to insert meaningful privacy and security provisions, but so far the agency has shown no interest in doing so. The draft regulations issued by DHS earlier this year perpetuate all of the problems with the flawed law, while doing little to mitigate obvious privacy and security concerns. In written comments submitted earlier this month, we urged DHS to substantially revise its draft to include meaningful privacy and security provisions.

Still, the real problem lies with the law itself. Although DHS could make substantial progress by writing regulations that address clear privacy and security concerns, the best outcome would be for Congress to repeal this unwieldy and unpopular law and to restart the process to address this problem in a thoughtful, comprehensive manner. 

The broader issues surrounding how we manage "identity" aren't going anywhere. As information technology improves and governments seek to bolster their capacity to identify individuals, these questions become more and more critical. CDT this month issued our draft of "Privacy Principles for the Digital Age," a document that aims to lay a groundwork for addressing those concerns.