Legislature(2017 - 2018)GRUENBERG 120
04/04/2017 05:30 PM House STATE AFFAIRS
Note: the audio ![]()
and video ![]()
recordings are distinct records and are obtained from different sources. As such there may be key differences between the two. The audio recordings are captured by our records offices as the official record of the meeting and will have more accurate timestamps. Use the icons to switch between them.
| Audio | Topic |
|---|---|
| Start | |
| HB165 | |
| HB74 | |
| Adjourn |
* first hearing in first committee of referral
+ teleconferenced
= bill was previously heard/scheduled
+ teleconferenced
= bill was previously heard/scheduled
| += | HB 74 | TELECONFERENCED | |
| + | TELECONFERENCED | ||
| += | HB 165 | TELECONFERENCED | |
HB 74-DRIVER'S LICENSE & ID CARDS & REAL ID ACT
5:53:27 PM
CHAIR KREISS-TOMKINS announced that the final order of business
would be HOUSE BILL NO. 74, "An Act relating to the
implementation of the federal REAL ID Act of 2005; and relating
to issuance of identification cards and driver's licenses; and
providing for an effective date."
CHAIR KREISS-TOMKINS stated that he invited the Alaska
[congressional] delegation - U.S. Senator Lisa Murkowski, U.S.
Senator Dan Sullivan, and U.S. Representative Don Young - to
testify on HB 74 during the 4/6/17 meeting of House State
Affairs Standing Committee. He maintained that a frequently
asked question is, What is Congress doing about this
legislation? He offered that he would share with the committee
any responses from their offices. He mentioned that if HJR 15
passes the House, it would be sent to the delegation.
CHAIR KREISS-TOMKINS relayed that in the past week, his office
has worked with the Department of Administration (DOA), the
Department of Public Safety (DPS), the American Civil Liberties
Union (ACLU), and other organizations to propose a committee
substitute that would maximize privacy protections.
5:56:02 PM
REPRESENTATIVE WOOL moved to adopt the proposed committee
substitute (CS) for HB 74, Version 30-GH1781\J, Martin, 4/4/17,
as the working document.
REPRESENTATIVE TUCK objected for purpose of discussion.
5:57:01 PM
STEPHANIE GILARDI, Staff, Representative Jonathan Kreiss-
Tompkins, Alaska State Legislature, on behalf of Representative
Kreiss-Tomkins, prime sponsor of HB 74, stated that the
challenge in amending HB 74 was addressing concerns regarding
data storage and sharing while finding a way for Alaska to issue
federally compliant identification (ID) cards and licenses. She
asserted that Version J was the result of discussions with DOA,
the Division of Motor Vehicles (DMV), and ACLU; it was drafted
to ensure that Alaska satisfies the requirements of the REAL ID
Act when issuing compliant ID cards and driver's licenses while
protecting Alaskans' privacy. She maintained that Version J
would tighten restrictions on the ways in which data may be
stored and shared, and it would attempt to create a meaningful
distinction between federally compliant ID cards and licenses
and those IDs and licenses that are not compliant.
MS. GILARDI referred to Slide 2 of the PowerPoint presentation,
entitled "Overview," and relayed that Version J makes several
changes to HB 74. It includes language that ensures applicants
are provided with the information they need to make an informed
choice when selecting between compliant and noncompliant ID
cards and licenses; it uses specific language to limit the types
of documents used to apply for federally compliant ID cards and
licenses; and it specifies the length of time the documents may
be retained. Version J would limit the retention of data used
to apply for noncompliant ID cards and licenses. It introduces
a new section [into statute] on data sharing prohibition. She
noted there are other, smaller changes that will be mentioned at
the end of the presentation.
MS. GILARDI referred to Slide 3, entitled "Ensures applicants
make an informed [choice] at the DMV." She relayed that HB 74
offers the option of choosing between a compliant ID card or
license and a noncompliant ID card or license; the individual
applying for a [compliant] ID card or license must clearly make
a choice to do so. She added that under Version J, an applicant
who chooses a compliant card will be required to do so
affirmatively, which may be done by way of a checkbox or
signature, and he/she will be provided information by DOA at the
time of application to help him/her make an informed choice.
She explained that the information provided must include a
description of both noncompliant and compliant cards detailing
the storage and sharing of the applicant's information.
Applicants will be informed of the official purpose and
limitations for using compliant and noncompliant cards. The DOA
will be required to notify the applicant that he/she is not
compelled to use a federally compliant ID card or license when
entering federal property or flying on federally regulated
commercial aircraft; thus, the applicant will be aware when
applying for a compliant card or license that he/she could opt
instead to use a passport or a passport card to access these
places.
6:00:33 PM
MS. GILARDI referred to Slide 4, entitled "Limits documentation
and retention for compliant identification card and license
applications." She said that HB 74 states that the commissioner
[of DOA] shall adopt regulations for the issuance of REAL ID
compliant ID cards and licenses but does not set time limits on
the retention of documents used to apply for compliant cards.
She asserted that Version J would limit to the minimum required
by the REAL ID Act the retention of identity source documents
provided when applying for ID cards or licenses. Version J
specifies that after the length of time required by the REAL ID
Act for retention of documents has elapsed, those documents
would be destroyed as soon as practicable. The documents that
must be destroyed include digital or paper copies, additional
information related to identity source documents, the paper copy
of the application itself, and the image of the applicant's
face. Version J also would prohibit copying, scanning, or
retaining in any form a document that is not an original or
certified copy that has been presented to verify information
included on the application for a compliant card.
MS. GILARDI referred to Slide 5, entitled "Limits the retention
of data for noncompliant identification card and license
applicants," and said that HB 74 did not address the retention
of personal data for noncompliant cards. She stated that to
further the goal of creating a meaningful difference between
compliant and noncompliant cards, Version J would limit the
length of time the image of a noncompliant card holder may be
stored to one year after the expiration of his/her noncompliant
card or license. Version J would also prohibit the retention of
the image of an applicant's face, if the applicant applies for
but does not receive a noncompliant ID card, for example due to
failing a driver's test. She stated that DMV currently does not
keep these images, but Version J would enshrine this practice in
statute, thus guarding against the storage of images of people
applying for either noncompliant or compliant cards regardless
of whether the cards were obtained.
MS. GILARDI referred to Slide 6, entitled "Introduces a new
section, AS 28.05.068 Prohibition on Data Sharing." She said
that Version J would introduce a new section into statute that
would explicitly prohibit the conveyance, distribution, or
communication of images of faces, documents, and signatures to
databases, pointer systems, or any other index.
6:03:15 PM
MS. GILARDI referred to Slide 7, also entitled "Introduces a new
section, AS 28.05.068 Prohibition on Data Sharing." She said
that as currently written, Version J would make it possible for
Alaska to contribute to the State to State (S2S) pointer system
administered by the American Association of Motor Vehicle
Administrators (AAMVA). She maintained that Version J would not
include a prohibition on the conveyance, distribution, or
communication of Social Security numbers (SSNs) in whole or in
part. She stated that while the REAL ID Act does not require
SSNs to be stored in a database or pointer system that is
accessible to other states, the REAL ID Act does require a state
to maintain a state motor vehicle database that provides
electronic access to all other states to information contained
in the database. She added that the motor vehicle database must
contain at minimum all the data fields printed on a compliant
driver's license or a compliant ID card issued by the state, as
well as, motor vehicle driver histories, which included motor
vehicle violations, suspensions, and points.
MS. GILARDI relayed that Alaska currently provides electronic
access to its motor vehicle database and accesses other states'
information through the S2S system administered by AAMVA. She
stated that DMV uses this system to check with other states to
determine if an individual possesses more than one driver's
license to detect and deter driver's license and ID card fraud.
She said that DMV currently shares information on licensed
drivers to the S2S database, and under Version J that would
continue for both compliant and noncompliant driver's license
holders. She asserted that the S2S system is unique and is the
only system currently in existence that will allow Alaska to
achieve compliance [with REAL ID]. The S2S system includes the
following information: full legal name; former names; date of
birth; gender; last five digits of SSN; and the driver's license
number. She pointed out that while the inclusion of SSNs in an
interstate system is not required for REAL ID Act compliance,
SSNs are required by the S2S data system. She reiterated that
the S2S data system is the only interstate system that can be
used by Alaska to provide other states electronic access to its
motor vehicle information, and that access is a requirement of
the REAL ID Act.
6:06:11 PM
MS. GILARDI relayed that if DMV does not provide SSNs to satisfy
the requirements of participation in the S2S system, Alaska
cannot participate in the S2S system; if Alaska does not
participate in a S2S system, it will not be [REAL ID] compliant.
MS. GILARDI referred to Slide 8, entitled "Additional changes in
the CS," and reviewed several minor revisions under Version J.
She said that the additional charge for both a federally
compliant ID and a federally compliant license would be $10; the
amount was suggested by DOA. She explained that $5 would be
applied to the cost of the production of licenses, and $5 would
be applied to reimburse the capital investment in approximately
five years. She added that charging the same fee for both cards
helps to alleviate some of the additional administrative work
borne by DOA.
MS. GILARDI stated that a driver's license would expire on the
licensee's birthday in the eighth year following the issuance of
a license. Version J includes the requirement for physical
security features on all licenses in lieu of the current
requirement of a hologram. The federal government currently
requires that all driver's licenses are federally compliant;
Version J would enshrine that requirement in statute.
6:09:08 PM
REPRESENTATIVE WOOL asked for confirmation of his understanding
that SSNs are not required by the REAL ID Act; however,
participation in a S2S system is required. There is only one
S2S system - the one administered by AAMVA - and since S2S
requires SSNs, by default REAL ID does require SSNs.
MS. GILARDI answered that to her knowledge, that is correct.
CHAIR KREISS-TOMKINS responded that he and Ms. Gilardi discussed
this point during a phone call with the U.S. Department of
Homeland Security (DHS) and facilitated by DOA. He said that he
asked why the requirement of the S2S system - for SSNs - goes
beyond what is required by the letter of federal law. He stated
that the answer he received to that question was twofold: the
DHS has promulgated regulations through its interpretation of
federal law that SSNs are required; and because the S2S system
requires SSNs and is "the only game in town, the only game in
the United States," Alaska effectively must comply with the SSN
requirement. He added that there are both DHS regulations that
come to bear, as well as, the fact that the S2S system requires
SSNs; therefore, Alaska has no other option. He clarified that
the S2S system does not require the entire SSN, but only the
last five digits.
REPRESENTATIVE WOOL responded that it was pointed out in the
previous hearing on HB 74 [in the House State Affairs Standing
Committee meeting of 3/31/17, 6:01 p.m.], if the first three
digits indicate the state from which a person originates, and
another five digits are known, then the probability of guessing
the full SSN is one in ten. He questioned the security of one's
SSN. He asked if one's SSN is linked to his/her driver's
license ID number, so that the license number becomes a de facto
federal ID. He mentioned that SSNs are now assigned at birth,
whereas years ago one obtained an SSN for employment.
6:13:08 PM
MARLA THOMPSON, Director, Division of Motor Vehicles (DMV),
Department of Administration (DOA), explained that to obtain a
driver's license, one must either submit his/her SSN or a letter
stating that he/she is not able to obtain an SSN. The DMV does
link driver's license information to SSN; however, the SSN is
not displayed on the driver's license. For DMV, use of the SSN
is to verify a person's identity.
REPRESENTATIVE WOOL asked what DMV does with the SSNs and if
they are kept in the DMV's database.
MS. THOMPSON responded that DMV does keep the SSNs and uses them
to verify identities for online or in-person transactions with
DMV.
6:14:41 PM
REPRESENTATIVE LEDOUX referred to the testimony of Tara Rich
[Legal and Policy Director, ACLU of Alaska, during the 3/21/17
House State Affairs Standing Committee meeting], who made
suggestions for making [compliance with REAL ID] less onerous
for Alaska. Representative LeDoux asked if all the suggestions
have been [included in Version J] and if not, why not.
6:15:40 PM
ERIC GLATT, Staff Attorney, American Civil Liberties Union
(ACLU) of Alaska, expressed his belief that Version J does not
incorporate all the suggestions of the ACLU. He said that the
ACLU has been opposed to the REAL ID Act at the federal level
since it was first introduced by Congress. He stated that the
ACLU's concern is that the Act inherently compromises privacy.
He contended that if Alaska's intent is to comply with the REAL
ID Act, it would be remiss of ACLU staff not to weigh in on
achieving compliance while minimizing compromise to the greatest
extent possible.
MR. GLATT relayed that AAMVA's S2S system index uses the last
five digits of the SSN, and Version J would continue to allow
that practice. He maintained that ACLU regards use of the five
SSN digits as a significant privacy threat: the resulting
national database not only would contain information about all
compliant driver's licenses and IDs in Alaska, it would contain
information about all Americans in states that are participating
in the S2S system; a national database containing such a
valuable piece of identifying information is a major concern.
MR. GLATT offered that the intent of introducing Version J was
not to make compliance impossible; however, the staff at ACLU of
Alaska urges Alaska to continue to pursue the question of why
the [S2S] index requires information that the REAL ID Act does
not. He concluded that because of the progress [toward REAL ID
Act compliance] already accomplished by AAMVA through the S2S
system and the fact that DHS will only recognize participation
in that system as compliance, staff at ACLU of Alaska currently
can see no way for Alaska to withhold SSN information and
achieve compliance.
6:18:32 PM
REPRESENTATIVE LEDOUX asked if Mr. Glatt has any recommendations
for what Alaska should do.
MR. GLATT responded that there are several approaches that
Alaska could take. He relayed that AAMVA has indicated that any
participating state may make a request to not share that [SSN]
information in the [S2S] index; such a request would go to the
steering committee within AAMVA to determine if AAMVA can
facilitate the request. He suggested that Alaska make that
request. He confirmed for Representative LeDoux that regarding
SSNs, making that request is the optimal course of action.
REPRESENTATIVE LEDOUX asked if there are any other suggestions
for Alaska from the ACLU that have not been incorporated into
Version J, and if so, why not.
MR. GLATT responded that there is another area of grave concern
to ACLU: the scanning and retention of digital images of
documents. He explained that the REAL ID Act requires any
applicant for a compliant card to have his/her identity source
documents scanned and saved in a digital database for ten years.
He expounded that currently when applying for a driver's
license, one may present his/her passport, which would be
examined for validity and returned. He asserted that under REAL
ID, the passport would be scanned. Under Version J, that would
not be the case for anyone applying for a noncompliant card. He
relayed that there is a dispute between DHS and AAMVA regarding
the interpretation of "identity source documents."
MR. GLATT said that among the documents that may be presented
for a compliant driver's license is a utility bill for
verification of address, and a pay stub, a 1099 form, or a W-2
form for verification of SSN. He stated that ACLU's
interpretation of the Act and the regulations implementing the
Act is that those documents should not be considered identity
source documents and should not be subject to scanning and held
in a database for ten years. He maintained that anyone
concerned about his/her privacy would not appreciate his/her tax
forms being held in a second database; once the information has
been examined and verified, keeping it in a database serves no
statutory purpose or security interest.
MR. GLATT offered that because there is a dispute among the
ACLU, DHS, and AAMVA about documents being scanned and kept in a
database, Version J endeavors to incorporate the same disputed
language from the REAL ID Act. In that way, interpretation of
that language can be addressed another day while at the same
time there is no doubt about Alaska's compliance with the REAL
ID Act, because the language in Version J matches the language
in the REAL ID Act and the regulations.
6:23:36 PM
REPRESENTATIVE LEDOUX asked if the way Version J is written is
"OK or not OK."
MR. GLATT explained that the ACLU continues to believe that REAL
ID represents a significant compromise of people's privacy. He
expressed his belief that if Alaska's intent is to comply with
the REAL ID Act, Version J endeavors to put Alaska within the
scope of compliance and leave the contested issue alive to be
resolved at another time.
CHAIR KREISS-TOMKINS offered that Version J addresses many of
the suggested revisions of the ACLU but not all of them - most
notably the two mentioned by Mr. Glatt. He suggested that
committee members wishing to address the two issues [not
addressed] offer amendments. He summarized that there are two
outstanding ACLU concerns; however, Version J does include other
privacy improvements to HB 74.
MR. GLATT agreed that Version J does incorporate most of the
recommendations made by Ms. Rich, and his testimony focused on
the aspects of Version J that the ACLU of Alaska still finds
troubling.
REPRESENTATIVE LEDOUX asked if ACLU of Alaska staff could assist
in writing an amendment to address these two issues in a manner
to comply with the REAL ID Act in the most minimal way possible.
MR. GLATT answered absolutely; however, the language of the
amendment would have to include recognition that the
requirements of the S2S system - the only system recognized by
DHS - goes beyond the requirements of the Act.
CHAIR KREISS-TOMKINS stated that the State of Alaska is in an
awkward position - one in which an amendment to Version J would
meet federal law but not work with the S2S system. He suggested
that through his discussion with DHS staff this morning, he
learned that even if Alaska is compliant with federal law, if it
cannot work with the S2S system, it would be ruled as
noncompliant and, therefore, penalties would apply. He added
that if that is the will of the legislature, then litigation
might ensue; however, that would be for the committee and the
legislature to decide.
6:27:34 PM
REPRESENTATIVE TUCK reiterated that any change in the S2S
system, which is managed by the State Pointer Exchange Services
(SPEXS) and [operated] by AAMVA, would be decided by a general
committee or general counsel [of AAMVA]. He asked how those
committee members are selected or appointed.
MS. THOMPSON responded that there is a governance board for the
S2S specifically and she serves on that board.
REPRESENTATIVE TUCK asked how long Ms. Thompson has been on the
governance board.
MS. THOMPSON answered that she has been on the board since March
1, 2017.
REPRESENTATIVE TUCK reiterated that neither the federal
government nor the [REAL ID] Act requires SSNs as an identifier
for compliance with REAL ID; however, AAMVA does require SSNs.
He asked what identity documents are used under the REAL ID Act
for compliance when the SSN is not used for proof of identity,
since the SSN is not required under the REAL ID Act.
MS. THOMPSON answered that based on discussions with DHS, the
S2S is what is required for Alaska to be compliant and required
for S2S is the last five digits of the SSN, along with the
applicant's name and date of birth.
REPRESENTATIVE TUCK suggested that the requirement for SSNs for
the S2S is the decision of the [AAMVA governance] board; he
asked what DHS requires as a compliant ID for identification.
MS. THOMPSON replied that the source documents include the
following: a birth certificate, which is verified with the
birth certificate database; an SSN, which is verified with the
Social Security Online Verification System (SSOLV) under the
U.S. Social Security Administration (SSA); a certificate of
citizenship or naturalization; and a foreign passport with
approved visas attached.
6:32:21 PM
REPRESENTATIVE TUCK stated that in late January when DOA joined
AAMVA, full SSNs were uploaded to the S2S system. He asked if
there is any way Alaska could retrieve those SSNs.
CHAIR KREISS-TOMKINS expressed his understanding that Alaska has
been a member of AAMVA for some time, but since January,
Alaska's representative to AAMVA was elevated to membership on
the governing board.
MS. THOMPSON responded that Alaska has been a member of AAMVA
for years. She said that AAMVA is an association that bridges
states together so that drivers are properly licensed:
commercial driver's license (CDL) drivers are properly licensed;
the Problem Driver Pointer System (PDPS) is consulted to
identify people with driving under the influence (DUI) offenses;
and people with suspended driver's licenses are identified. She
maintained that there is a great deal of data that states share
to ensure valid and proper driver's licenses.
REPRESENTATIVE TUCK asked if there has been an attempt to
retrieve Alaska's SSNs after they were uploaded [to the S2S
system}.
MS. THOMPSON answered that AAMVA only receives the five digits
of the SSN, the date of birth, and first and last name. She
maintained that this information is used to index to ensure that
there is not a duplicate driver's license and to determine what
state has issued a driver's license.
REPRESENTATIVE TUCK asked if that is already occurring.
MS. THOMPSON responded yes.
6:35:48 PM
REPRESENTATIVE BIRCH asked if government or a business has a
duty or responsibility to determine a person's identity.
MR. GLATT relayed instances in which the government has a right
to determine a person's identity: it controls access to
military bases; it has assumed control over federally regulated
air space, which explains the presence of the Transportation
Security Administration (TSA) personnel in airports performing
identity checks; and the Identity Project, which proports that
if someone does not wish to present documents verifying
identity, than he/she can submit to a more thorough
individualized screening to establish that he/she is not a
danger. He maintained that for someone "walking down the
street," if the police do not suspect him/her of a crime, they
are not allowed to demand identification and find him/her in
violation if he/she fails to do so. He said that absent a
reasonable suspicion of a violation of the law, a request for
identification is not an inquiry the government can make.
REPRESENTATIVE BIRCH asked Mr. Glatt if he concedes that at some
level and at some point, it is a duty and responsibility of a
business and government to affirm that a person is who he/she
claims to be.
MR. GLATT answered that he has not considered the question of
whether a private operator may refuse service to someone who
fails to meet that private operator's independent assessment
that the person is who he/she claims to be. He maintained that
if someone is holding oneself out as a provider of public
accommodations, such as a restaurant, there are discrimination
laws protecting certain classes of people from being treated
differently; however, he stated that he has never examined the
situation in which a business would only serve people who
identified themselves first and convinced the business operator
that they are who they say they are.
REPRESENTATIVE BIRCH offered that in the case of someone getting
on an airplane, it is important that a person's identity is
verified because of security reasons. He asked for the best way
to achieve that; he mentioned biometrics, iris scans, finger
prints, and deoxyribonucleic acid (DNA), as well as the
documentation alternatives such as birth certificate. He stated
that he has attended meetings this week regarding credit scores,
in which access to Facebook pages was mentioned. He asked if it
is truly possible anymore for someone to be anonymous. He
offered that one can find a "mountain" of information on a
person by searching the internet. He said, "I'm trying to
figure out if we're making a mountain out of a mole hill here."
He maintained that the issue is valid and important but offered
that there are "tons" of information out there on everyone. He
offered that one's digital footprints may include that he/she
bought Wheaties for breakfast, and he referred to "all that's
out there." He asked Mr. Glatt for his sense of [access to
personal information] and privacy matters, gained through his
research and work with ACLU.
6:41:50 PM
MR. GLATT replied that he considers [privacy] a very important
issue. He maintained that today many Americans have the sense
that the loss of privacy is already a foregone conclusion, so
there is no point in caring. He offered that the committee has
heard testimony in support of HB 74 by people who have
prioritized expediency in getting the proposed legislation
passed above paying attention to the details. He mentioned that
the ACLU appreciates that the committee members are paying
attention to the details because the details matter, and they
matter to privacy in general.
MR. GLATT referred to Representative Birch's question regarding
a person's commercial "lives" in relation to Facebook, Google,
internet service providers (ISPs), and information brokers who
compile information about people from publicly available and
accessible databases. He said that he realizes many people
believe it is too late to remedy the situation described by
Representative Birch, but he maintained that the ACLU and other
privacy advocate organizations do not believe it is too late.
He compared it to taking a snapshot of the working conditions
before the labor movement and concluding that it is too late to
do anything about them: workers today would not have a two-day
weekend, a 40-hour workweek, and minimum wage, and there would
still be child labor. He asserted that when enough people come
together to "express their will," they can change what might
otherwise appear to be foregone conclusions. He suggested that
people look to Europe, which has much more stringent privacy
protections in the commercial sphere than America. He added
that if the discussions regarding privacy prevail, there still
would be hope for America that commercial privacy will assert
itself more than it does today. He stated that this issue is
certainly one that the ACLU will continue to pursue.
REPRESENTATIVE BIRCH mentioned Ancestry.com, credit scores, and
the digital presence, and added that he appreciated Mr. Glatt's
testimony.
6:44:03 PM
REPRESENTATIVE JOHNSON asked about the use of SSNs in Alaska to
index facial recognition properties. She offered that doing so
constitutes a stronger connection and makes the database more
accessible. She asked if Mr. Glatt had any information on
whether this kind of indexed connection has been a requirement
in Alaska or anywhere else.
MR. GLATT answered that if the question is why SSNs are linked
to driver's licenses and identity cards and if there are other
instances of similar linkage with SSNs, he does not know of any
other instances in which SSNs are used in a state specific
context, other than for licensing drivers. He maintained that
the SSN linkage with driver's licenses and identity cards exists
partly as a function of federal and state laws to cooperate in
child support services provisions in the federal law if, for
example, someone endeavors to evade child support payments by
moving out of state and obtaining a new driver's license. He
offered his belief that it was for this reason that SSN entered
the driver's licenses realm. He maintained that the use of SSNs
serves as one of the tools for enforcing child support laws and
represents the specific nexus for tying SSNs to driver's
licenses.
CHAIR KREISS-TOMKINS offered that Representative Johnson's
question referred to the linkage between facial and photographic
data and SSNs.
REPRESENTATIVE JOHNSON stated that she is unaware of any state
database that has her SSN linked with her metric data and that
is being shared in any way.
MR. GLATT responded that it is true that even for noncompliant
ID licenses in Alaska, the databases maintained by DMV even now
include both the digital image of one's face and the SSN, which
has been the policy for less than ten years. He conceded that
he is unaware of how those combinations of biometrics, facial
images, and SSNs are used, even within DMV.
6:47:59 PM
REPRESENTATIVE WOOL relayed his understanding as follows: All
the states share data to determine if an applicant for a
driver's license has a license in another state, a revoked
license in another state, a CDL, and to verify identity. If
the applicant gives DMV his/her name and date of birth and there
is another person with the same name and date of birth, then DMV
uses the last five digits of the SSN to distinguish that
applicant from the other person. He asked if there is an
alternative to using the last five digits of the SSN, such as a
digital image, that would satisfy the verification process in
this case. He asked, "What would AAMVA do?"
MR. GLATT opined that the question is an excellent one to pose
to AAMVA. He said that if AAMVA were to give up using SSNs as a
tool to reduce the number of false positives, one alternative
simply would be to manually check the person's image to
determine if the person is who he/she claims to be. He
reiterated that the possibility of using an alternative to the
last five digits of the SSN should be presented to AAMVA so that
states would have an alternative.
6:50:24 PM
REPRESENTATIVE WOOL expressed his understanding that Alaska,
although not currently REAL ID compliant, presently shares data
containing the last five digits of the SSN with AAMVA in a
system. He stated that he did not know if the data is exchanged
or just viewed; in any case, it is currently being used and the
only way to prevent its use would be to retrieve the data. He
asked if the data resides in an Alaska location and is accessed
by other states through a central port or if the data is
uploaded to some other server in a non-Alaska location.
MR. GLATT answered that he is unable to speak authoritatively
about exactly what the S2S system operated by AAMVA
accomplishes. He said his understanding is that a central index
for the S2S system is managed in Virginia and operated by AAMVA,
and in that index, are several identifying factors for all
compliant state licensees. He added that the identifiers are
first name, last name, all prior names, date of birth, the type
of license, the state of issue, and the last five digits of the
SSN. This comprises the part of the record used to identify the
full record that a state or territory maintains for its
licensees. It is in the full record that the driver history can
be found, including the existence of points, suspension, and
other information about the driver.
MR. GLATT said that the central index, managed by AAMVA and
located in Virginia, is meant to locate records. He stated that
the inclusion of SSNs in the index causes ACLU of Alaska great
concern, and he asked, "If all it's meant to do is locate a
record, why should it have something so valuable included in it
on the front end?"
MR. Glatt relayed that he did not know if Alaska or the other
S2S participating states are using the pilot program as it will
be used once compliance for all states is operational or if they
simply are testing it. He offered his understanding that until
Alaska and the other states participated in S2S, they utilized a
more cumbersome process of relying on faxes and "sifting" data
to verify that an applicant does not already have a license in
another state or is trying to hide his/her record. He stated,
"To that question of - How do you know? - it was a very
cumbersome process."
6:54:03 PM
REPRESENTATIVE WOOL referred to a passport and a passport card
as alternatives to a REAL ID card and offered that because they
were in a separate database, they were more secure. He
speculated that the government agency that issues passports has
his name, date of birth, SSN, and all the other data being
discussed. He asked how the database used to implement REAL ID
is different from the passport database and why it is more
concerning. He asked if the reason is that the data is not
shared with other states or that it is less accessible.
MR. GLATT replied that the context of Representative Wool's
questions is, What's one more database? He offered an analogy
as explanation: Someone gives a neighbor a copy of his/her
house key in case he/she gets locked out of the house. In this
case, the neighbor is a trusted person who can be relied upon
not to misuse the key. If the key is given to ten neighbors,
anyone of whom may intend some mischief or is careless with the
key, then one breach resulting in someone making multiple copies
of the key would cause a serious problem. He conceded that
national databases do exist - such as at the U.S. Department of
State (DOS) for passports, the Internal Revenue Service (IRS)
for taxes, and SSA for issuing retirement benefits - and the
state has its own databases; however, he maintained that the
presence of these databases does not justify having one more
database. He asserted that having one more database that could
be attractive to a [security] "hacker" or identity thief, is one
more unnecessary risk.
CHAIR KREISS-TOMKINS asked Mr. Glatt to comment on the
difference between SSA, DOS, IRS, and AAMVA as custodians of
data and the relative cyber security maintained by each agency.
MR. GLATT responded that the federal government is governed by
the federal Privacy Act [of 1974] whenever it manages personally
identifiable information (PII) in a system of records. He
stated that a federal agency that maintains PII must comply with
many standards and must conduct a privacy impact assessment,
which becomes publicly available. The public has a right to
information about what a government agency is doing to protect
people's privacy. He maintained that any time a federal agency
implements a program that will impact people's privacy, it must
perform a privacy impact assessment. He asserted that for
states creating a database maintained by a private non-profit
organization, the Privacy Act does not apply. He offered that
Alaska's Freedom of Information Act provisions [Alaska Open
Records Law, AS 40.25.110] allow Alaskans to request information
about records that Alaska shares with S2S, or AAMVA; however,
AAMVA does not have a legal obligation to do the same type of
assessment to make itself transparent, as would a federal
agency.
6:58:55 PM
REPRESENTATIVE TUCK stated that the question is, Is it hopeless
to fight for privacy because no one cares or because it is truly
hopeless? He relayed that SSA advises against the use of SSNs
for [issuing driver's licenses]. He said that Alaska driver's
licenses no long display SSNs. He expressed his appreciation
for the recommendation by the ACLU of Alaska that "we should not
give up."
REPRESENTATIVE TUCK relayed his experience when traveling by
plane from Juneau to Anchorage on March 1, 1917: He forgot to
take his wallet, therefore, flew without any ID. The TSA gave
him a "red bin" and screened him using pat-down procedures.
Coming back to Juneau by plane, he was able to use his expired
Costco card [at the TSA checkpoint]. He asked if Mr. Glatt knew
what may be required in the future as ID for plane travel.
MR. GLATT answered that the experience described by
Representative Tuck is a perfect example of the fact that one
does not need an ID to gain access to federally regulated
airspace; by subjecting oneself to further screening, there is a
way to get past the security checkpoint. He stated that he is
not aware of a federal law or rule pending that would prohibit
that access.
REPRESENTATIVE TUCK pointed out that based on Mr. Glatt's
testimony, privacy is not dead. He noted that in the November
issue of Consumer Reports, there is an article about how to
protect one's privacy. The author of the article writes, "I've
called the bluff on those who believe privacy is dead; in fact,
there is a lot you can still do." Representative Tuck asked,
"Why in the world would we want to be giving up all these
documentations to something that is not federally secure?" He
stated that the article also points out that "data is the new
currency," and private entities clamor for it. He mentioned the
new surveillance industrial complex that is continuing to
expand; it is a multi-billion-dollar trade in personal data. He
reiterated his appreciation for the efforts of ACLU of Alaska to
ensure the privacy rights of Alaskans are secure.
7:03:31 PM
LESLIE RIDLE, Deputy Commissioner, Department of Administration
(DOA), explained that although she has immediate comments on
Version J, she reserves the right to more formally respond after
a more thorough study of the proposed CS and discussion with
staff and the attorney general. She referred to page 2, lines
13-19, to point out a requirement that she believes would make
Alaska noncompliant [with the REAL ID Act] - the requirement
prohibiting DOA from keeping source documents for compliant
cards. She reminded the committee that Mr. Glatt indicated that
the Alaska Department of Law (DOL) and DHS disagree with ACLU on
what documents are required.
MS. RIDLE referred to page 2, lines 26-27, which states that the
state or municipal government may not require a person to
possess or use an ID card that is federally compliant. She
asserted that within the Department of Military & Veterans'
Affairs (DMVA), the state currently does require people to
access base to work. She said the state is considering whether
it must change all its personnel descriptions to include as a
condition of employment the requirement of a federally compliant
license allowing plane travel or for accessing a military base.
She added that this would not apply to all state jobs, but some.
She expressed her concern that the sentence [in Version J] that
she cited would keep the State of Alaska from saying that an
employee must be able to travel by plane or access a base, if
that is needed for the job.
REPRESENTATIVE LEDOUX asked why not simply require an employee
to be able to access a base or to travel by plane. She posed
the question, If a state employee decides to have a passport in
lieu of a REAL ID card, why require him/her to have a REAL ID
card?
MS. RIDLE responded that since page 2, lines 26-27, of Version J
states that the state government can't require an employee to
use a federally compliant ID card, and a passport is federally
compliant, her belief is that Version J would prevent the state
from requiring even a passport. She added that she will clarify
this point with the attorney general.
7:07:12 PM
MS. RIDLE referred to page 3, line 7, [which prohibits copying,
scanning, or retaining the SSN] and pointed out that there are
other agencies that use the SSN, such as Child Support Services
Division (CSSD) for the enforcement of child support, for a PFD
application, and the Unemployment Insurance (UI) program for
application for benefits. She reminded the committee that DOA
databases are shared with the Department of Public Safety (DPS),
which is used to investigate PFD fraud and unemployment
insurance benefit fraud.
MS. RIDLE referred to Section 4 on page 4, lines 11-15, which
states that DOA may not share data with an entity or individual
that is not a state agency or employee or permit the conveyance
or distribution of the data with any entity [or individual] that
is not a state agency or employee. She expressed her concern
that this would prevent police departments and the Federal
Bureau of Investigation (FBI) from accessing DOA data, which may
create too much of a limitation on data sharing. She said she
would consult with the attorney general and DPS regarding this
issue.
MS. RIDLE referred to page 5, line 9, which she asserted was
confusing and may need clarification. It states that DOA may
not keep an image of the applicant's face, regardless of whether
the applicant has renewed his/her ID card, but if he/she renews
the ID card, DOA must keep the applicant's photo.
MS. RIDLE referred to page 5, lines 11-17, which also prohibits
the retention of source documents for REAL ID, and she
maintained that DHS has indicated that these documents must be
retained; therefore, it is her belief that adopting this
requirement would make Alaska noncompliant.
MS. RIDLE referred to page 5, lines 24-25, which also prohibits
the state from requiring a person to possess a federally
compliant license.
7:10:29 PM
MS. RIDLE referred to page 7, Section 9, which restricts the
sharing of photos. She maintained that DOA has worked with ACLU
and met with them four or five times, both with Representative
Kreiss-Tomkins, with DMV, and alone. She referred to the
question posed by Representative Johnson regarding the sharing
of photos in conjunction with SSNs and stated that DOA does not
share photos outside the state unless presented with a subpoena
or court order. She stated that DOA fully supports that
restriction.
MS. RIDLE continued by saying that DOA offered amendments,
requested by ACLU, addressing the retention of records. In
response to Representative LeDoux's question on which
recommendations were not incorporated into Version J, Ms. Ridle
declared that DOA did not include the amendments requiring DOA
to store all records and paper in lieu of scanning them. She
asserted that the sheer volume of paper to be retained in DOA
archives would be overwhelming. She maintained that DOA is
attempting to balance efficiency - having documents readily
accessible in multiple locations - with privacy - the total
private storage of data. She reiterated that she is sympathetic
to the public's desire keep its information private; however,
the public expects efficiency as well.
7:13:12 PM
REPRESENTATIVE BIRCH asked what concerns exist regarding facial
recognition.
MS. RIDLE answered that DOA does not share data outside of
Alaska, and one's photo should not show up anywhere else unless
he/she has used it, or the police have "put it up"; the DMV does
not give it out. She gave as an example the case of the person
from Alaska who committed a crime in the Florida airport; the
DMV got many requests for his photo but did not comply. She
maintained that subsequently his photo was released, but it
wasn't his driver's license photo.
MS. RIDLE relayed that after someone comes into DMV and gets a
driver's license, DMV will check its own database at night for
other pictures of the applicant, photos of anyone else applying
for a driver's license under the same name, or photos that the
computer finds that look somewhat like the photo of the
applicant. She said that "human" review usually clearly reveals
there is no fraud; however, DMV does find about five cases of
possible fraud per month, which are turned over to the police to
be investigated. She maintained that DMV does not compare
Alaska photos to photos outside of its database.
REPRESENTATIVE BIRCH asked if DMV then would use the other data
points such date of birth or location of birth to review the
matches.
MS. RIDLE said that she understood why people might want photos
destroyed after one year but maintained that DPS used historical
photos for investigating crime and for identity questions.
7:16:41 PM
REPRESENTATIVE LEDOUX referred to the original presentation of
HB 74 [during the 2/7/17 House State Affairs Standing Committee
meeting] and said that her understanding is that it would take
five years for the state to recoup the money invested in
implementing the program. She said that her hope is that the
cost would be recouped in one or two years [through higher
fees]. She asked what fees would be required to accomplish
that.
MS. RIDLE answered that the $5 [per person] fee would cover the
cost to produce the REAL ID driver's licenses and cards; a $10
fee would pay back the $1.5 million cost in five years; and a
$20 fee would cut that time in half [for recouping the cost].
She added that these estimates are based on about half the
number of people getting driver's licenses getting REAL ID
licenses: if more got REAL ID licenses, it would be recouped
faster; if less got them, it would take longer. She maintained
that the estimate [of half] is based on numbers from other
states provided by DHS.
REPRESENTATIVE LEDOUX asked for clarification that under the
current version of the proposed legislation, someone wanting a
REAL ID would have to pay an extra $10.
MS. RIDLE replied yes.
REPRESENTATIVE LEDOUX asked if someone getting a new driver's
license would have to pay $5 plus the extra $10 for it.
MS. RIDLE explained that under Version J, the cost of a REAL ID
driver's license would be the cost of a noncompliant driver's
license - $25 - plus an extra $10 for a total of $35.
REPRESENTATIVE LEDOUX suggested that a person may not need a
driver's license except for the REAL ID requirement. She asked
what someone would pay under Version J of HB 74 if he/she
applied for a driver's license.
MS. RIDLE responded that for someone obtaining a brand-new
license, it would cost $35.
REPRESENTATIVE LEDOUX asked how long it would take to recoup the
cost of the program if charging $10 extra per license - five
years or ten years.
MS. RIDLE answered that at the extra $10 cost, it would take
five years [to recoup the money spent for the program].
REPRESENTATIVE LEDOUX asked what the fee would have to be for
the state to pay for the program in two years.
MS. RIDLE responded that with a $45 fee, the money could be
recouped in about two years.
CHAIR KREISS-TOMKINS clarified that the $45 represents an extra
$20 over the $25 cost of a noncompliant driver's license.
7:20:15 PM
REPRESENTATIVE WOOL offered that because AAMVA is not a
recognized federal agency, it is the least trusted for data
security; it is a non-profit made up of 51 entities that can do
as it pleases - "a bit of a loose cannon."
MS. RIDLE responded that AAMVA "is us"; it consists of all the
DMVs and has been in existence since 1933. The AAMVA is an
organization of all state DMVs that came together to: ensure
uniform procedures for Americans to get licenses; ensure that
licenses across the country have the same "strength"; and ensure
that CDLs were valid across states. She pointed out that AAMVA
partners with SSA to provide a "pointer system" for the SSA
database and with [SPEXS] to facilitate the S2S database. Other
partnerships include data sharing with the Commercial Driver's
License Information System (CDLIS), the DHS Systematic Alien
Verification for Entitlements (SAVE) Program, and the DHS
passport database. She asserted that many agencies consider
AAMVA a stable group of states; it is the DMVs that come
together and make the rules by which AAMVA operates.
7:23:13 PM
CHAIR KREISS-TOMKINS pointed out that AAMVA is to Alaska's DMV
as the National Conference of State Legislatures (NCSL) is to
the Alaska legislature, except that AAMVA has more functional
responsibilities for coordinating policy than does NCSL.
MS. RIDLE replied, "That's a perfect analogy." She added that
the National Governors Association (NGA) is another good
example.
REPRESENTATIVE WOOL commented that his assumption is that Alaska
has been a member of AAMVA since it had a DMV. He asked if
there have been any data breaches or any major incidences
related to data. He also asked if there is a central database
in Virginia, maintained by a group of AAMVA personnel, with
which all 51 DMVs interface.
MS. RIDLE answered that she does not know if the database has
been breached. She asserted that when the REAL ID Act became
law and the regulations were created, the 51 DMVs began to
consider how best to comply. The question was, What is the best
way to verify a person's identity when he/she comes into the
DMV? She maintained that AAMVA consulted privacy experts and
researched best practices of encryption to create a system in
which a state could verify someone's identity and determine that
he/she is not a problem driver and doesn't have a license in
another state. She stated that in the past, DMV used faxes and
phone calls to obtain this information, which most likely did
not meet privacy standards and was not efficient. She relayed
that when Alaska began utilizing the [S2S system], Alaska DMV
found 3,200 people with duplicate licenses; Alaska's best
efforts could not avoid missing duplicate licenses. She pointed
out that not all 3,200 people were being fraudulent; some did
not want to admit they had another license or couldn't locate it
to submit it.
MS. RIDLE, in response to Representative Wool's second question,
said that her understanding is that queries are transmitted to
AAMVA by computer and answers are transmitted back to DMV by
computer. The question of whether someone has another driver's
license is answered with a "yes" or "no"; DMV personnel do not
see any background information except the name of the other
state that issued the person a driver's license. She suggested
that there are a couple other keystrokes used - one example is
the keystroke to cancel the other license. She emphasized that
only DMV personnel can access the data through the "bridge";
employees of DPS or the Federal Bureau of Investigation (FBI) do
not have access.
7:27:39 PM
REPRESENTATIVE WOOL asked how many people within DMV have access
to the bridge. He suggested that a disgruntled clerk, angry at
someone, could access the data.
MS. RIDLE responded that DMV employees are subject to a
background check, their access to the database is monitored, and
misuse of the data is punishable by termination of employment or
criminal proceedings. She added that the same standards exist
for the bridge through DPS. She maintained that as people
started realizing the importance of data, it became criminal to
misuse data. She concluded that the possibility for misuse of
data exists; the DMV attempts to hire honest employees; and when
an employee uses an electronic database, the supervisor can see
who signed in and what is being viewed; with paper files, that
is not possible.
7:32:04 PM
REPRESENTATIVE TUCK removed his objection to the motion to adopt
the proposed CS for HB 74, Version 30-GH1781\J, Martin, 4/4/17,
as the working document. There being no further objection,
Version J was before the committee as a work draft.
[HB 74 was held over.]
| Document Name | Date/Time | Subjects |
|---|---|---|
| HB 74 H STA Rep. Tuck Follow Up 4.3.17 FINAL.PDF |
HSTA 4/4/2017 5:30:00 PM |
HB 74 |
| HB074 2017.01.30 ACLU Testimony re House Bill 7.pdf |
HSTA 4/4/2017 5:30:00 PM |
HB 74 |
| HB074 2017.03.27 ACLU to House State Affairs Committee re Follow Up to Questions.pdf |
HSTA 4/4/2017 5:30:00 PM |
HB 74 |
| REAL ID Commissioner Questions corrected 3.23.pdf |
HSTA 4/4/2017 5:30:00 PM |
|
| HB 74 REAL ID verification systems.pdf |
HSTA 4/4/2017 5:30:00 PM |
HB 74 |
| HB 74 Letter to Commissioner Fisher.pdf |
HSTA 4/4/2017 5:30:00 PM |
HB 74 |
| HB-74-EFF-Oppose.pdf |
HSTA 4/4/2017 5:30:00 PM |
HB 74 |
| HB 74 Passport Process.pdf |
HSTA 4/4/2017 5:30:00 PM |
HB 74 |
| HB 74 DHS Waiver Letter and Enclosure 10.7.2016.pdf |
HSTA 4/4/2017 5:30:00 PM |
HB 74 |
| HB074 Draft Proposed CS ver J 4.5.17.pdf |
HSTA 4/4/2017 5:30:00 PM |
HB 74 |
| HB074 Alaska Right to Travel Identity Project Letter 4.5.17.pdf |
HSTA 4/4/2017 5:30:00 PM |
HB 74 |