Ron Paul on HR 418 (From RISKS Digest)

[Flyboy]

For those who don't know, the RISKS Digest is a moderated digest of the newsgroup comp.risks, which deals with security and other risks in technology. Peter G. Neumann, the moderator, is the chairman of the ACM's Committee on Computers and Public Policy, and is generally considered to be an expert on the subject. Anyhow, on to the story:

RISKS 23.71

Date: Thu, 10 Feb 2005 18:42:33 -0500
From: Larry Sudduth <[email protected]>
Subject: Congressman Ron Paul R-TX Understands Risks and Countermeasures

As early as RISKS-6.73, consequences of automated sharing of driver license information have been discussed. While the appropriateness of countermeasures levied against risks has been a fundamental element of RISKS since its inception, the mention in RISKS-2.20 of Mann's article (http://www.theatlantic.com/doc/prem/200209/mann) marked the beginning of a
(still nascent) popular tendency to review countermeasures for appropriateness, all the more so since the Patriot Act and successors.

I'm happy to learn that at least one congressman, Dr. Ron Paul, (R) TX, gets it. I'm unhappy that it is not one of my congressmen--I'm from Virginia--but maybe mine will learn from their Texas colleague!

H.R. 418, the "Immigrants ID bill" or "REAL ID Act of 2005," is advertised in part as establishing and rapidly implementing "regulations for State driver's license and identification document security standards, to prevent terrorists from abusing the asylum laws of the United States, to unify terrorism-related grounds for inadmissibility and removal." (See
http://thomas.loc.gov/cgi-bin/bdquery/z?d109:h.r.00418:)

The Honorable Dr. Paul characterizes HR 418 as a National ID Card bill masquerading as immigration reform. The clarity and brevity of his comments merit reading, both from an infosec perspective as well as a countermeasures perspective (http://www.house.gov/paul/congrec/congrec2005/cr020905.htm), excerpted and LMS-ed below:

" ...this bill will do very little to make us more secure. It will not address our real vulnerabilities. It will, however, make us much less free. In reality, this bill is a Trojan horse. It pretends to offer desperately needed border control in order to stampede Americans into sacrificing what is uniquely American: our constitutionally protected liberty."

"This bill establishes a massive, centrally-coordinated database of highly personal information about American citizens: at a minimum their name, date of birth, place of residence, Social Security number, and physical and possibly other characteristics ... that will be shared with Canada and Mexico!"

"This legislation gives authority to the Secretary of Homeland Security to expand required information on drivers' licenses, potentially including such biometric information as retina scans, finger prints, DNA information, and even Radio Frequency Identification (RFID) radio tracking technology."

"There are no limits on what happens to the database of sensitive information on Americans once it leaves the United States for Canada and Mexico - or perhaps other countries. Who is to stop a corrupt foreign government official from selling or giving this information to human traffickers or even terrorists? Will this uncertainty make us feel safer?"

Security practitioners know better than most the aptness of the saying, "err in haste, repent at leisure." I hope Representative Paul's common-sense proves to be contagious before HR 418 comes to a floor-vote.

Larry Sudduth 703.845-5-eight-33

 

[flatrock]

"This bill establishes a massive, centrally-coordinated database of highly personal information about American citizens: at a minimum their name, date of birth, place of residence, Social Security number, and physical and possibly other characteristics ... that will be shared with Canada and Mexico!"

"This legislation gives authority to the Secretary of Homeland Security to expand required information on drivers' licenses, potentially including such biometric information as retina scans, finger prints, DNA information, and even Radio Frequency Identification (RFID) radio tracking technology."

These two issues are the real scarry parts of the law in my opinion. There needs to be strong restrictions on what can be included in the information on the ID, as well as how that information can be shared.

It ought to explicitly prohibit any form or remote readability of the ID.