ALASKA STATE LEGISLATURE  HOUSE STATE AFFAIRS STANDING COMMITTEE  April 4, 2017 5:40 p.m. MEMBERS PRESENT Representative Jonathan Kreiss-Tomkins, Chair Representative Gabrielle LeDoux, Vice Chair Representative Chris Tuck Representative Adam Wool Representative Chris Birch Representative DeLena Johnson MEMBERS ABSENT  Representative Gary Knopp Representative Andy Josephson (alternate) Representative Chuck Kopp (alternate) COMMITTEE CALENDAR  HOUSE BILL NO. 165 "An Act relating to hiring for positions in state service based on substitution of military work experience or training for civilian work experience or training requirements." - HEARD & HELD HOUSE BILL NO. 74 "An Act relating to the implementation of the federal REAL ID Act of 2005; and relating to issuance of identification cards and driver's licenses; and providing for an effective date." - HEARD & HELD PREVIOUS COMMITTEE ACTION  BILL: HB 165 SHORT TITLE: STATE PERSONNEL ACT: VETERANS SPONSOR(s): REPRESENTATIVE(s) PARISH 03/08/17 (H) READ THE FIRST TIME - REFERRALS 03/08/17 (H) MLV, STA 03/16/17 (H) MLV AT 1:00 PM GRUENBERG 120 03/16/17 (H) -- MEETING CANCELED -- 03/21/17 (H) MLV AT 1:00 PM GRUENBERG 120 03/21/17 (H) Heard & Held 03/21/17 (H) MINUTE(MLV) 03/23/17 (H) MLV AT 1:00 PM GRUENBERG 120 03/23/17 (H) Moved HB 165 Out of Committee 03/23/17 (H) MINUTE(MLV) 03/24/17 (H) MLV RPT 4DP 03/24/17 (H) DP: SPOHNHOLZ, RAUSCHER, PARISH, TUCK 04/04/17 (H) STA AT 3:00 PM GRUENBERG 120 04/04/17 (H) STA AT 5:30 PM GRUENBERG 120 BILL: HB 74 SHORT TITLE: DRIVER'S LICENSE & ID CARDS & REAL ID AC SPONSOR(s): RULES BY REQUEST OF THE GOVERNOR 01/23/17 (H) READ THE FIRST TIME - REFERRALS 01/23/17 (H) STA, FIN 02/07/17 (H) STA AT 3:00 PM GRUENBERG 120 02/07/17 (H) Heard & Held 02/07/17 (H) MINUTE(STA) 03/14/17 (H) STA AT 3:00 PM GRUENBERG 120 03/14/17 (H) Heard & Held 03/14/17 (H) MINUTE(STA) 03/14/17 (H) STA AT 5:30 PM GRUENBERG 120 03/14/17 (H) -- MEETING CANCELED -- 03/21/17 (H) STA AT 5:30 PM GRUENBERG 120 03/21/17 (H) Heard & Held 03/21/17 (H) MINUTE(STA) 03/28/17 (H) STA AT 3:00 PM GRUENBERG 120 03/28/17 (H) Heard & Held 03/28/17 (H) MINUTE(STA) 04/04/17 (H) STA AT 5:30 PM GRUENBERG 120 WITNESS REGISTER REPRESENTATIVE JUSTIN PARISH Alaska State Legislature Juneau, Alaska POSITION STATEMENT: Introduced HB 165, as prime sponsor. ROBERT EDWARDSON, Staff Representative Justin Parish Alaska State Legislature Juneau, Alaska POSITION STATEMENT: Presented HB 165 on behalf of Representative Parish, prime sponsor. STEPHANIE GILARDI, Staff Representative Jonathan Kreiss-Tomkins Alaska State Legislature Juneau, Alaska POSITION STATEMENT: Presented the proposed committee substitute (CS) for HB 74, labeled Version 30-GH1781\J, Martin, 4/4/17, on behalf of Representative Kreiss-Tomkins, prime sponsor, with the use of a PowerPoint presentation. MARLA THOMPSON, Director Division of Motor Vehicles (DMV) Department of Administration (DOA) Anchorage, Alaska POSITION STATEMENT: Answered questions during the hearing on HB 74. ERIC GLATT, Staff Attorney American Civil Liberties Union (ACLU) of Alaska Anchorage, Alaska POSITION STATEMENT: Answered questions during the hearing on HB 74. LESLIE RIDLE, Deputy Commissioner Department of Administration (DOA) Anchorage, Alaska POSITION STATEMENT: Testified during the hearing on HB 74. ACTION NARRATIVE 5:40:05 PM CHAIR JONATHAN KREISS-TOMKINS called the House State Affairs Standing Committee meeting to order at 5:40 p.m. Representatives Tuck, Birch, Johnson, and Kreiss-Tomkins were present at the call to order. Representatives LeDoux and Wool arrived as the meeting was in progress. HB 165-STATE PERSONNEL ACT: VETERANS    5:41:09 PM CHAIR KREISS-TOMKINS announced that the first order of business would be HOUSE BILL NO. 165, "An Act relating to hiring for positions in state service based on substitution of military work experience or training for civilian work experience or training requirements." 5:41:21 PM REPRESENTATIVE JUSTIN PARISH, Alaska State Legislature, as prime sponsor of HB 165, stated that Alaska has more veterans per capita than any other state; more than 200 military personnel leave service and re-enter civilian life every month. He offered that re-entry can be very difficult. He relayed that veterans consistently report that finding employment is their greatest challenge to re-entry. REPRESENTATIVE PARISH asserted that HB 165 would reduce the likelihood of a veteran being excluded for a job for which he/she is qualified. He maintained that the proposed legislation would require explicitly that Department of Administration (DOA) personnel consider germane military experience when reviewing applicants for employment, which would be a benefit to former service personnel. 5:42:54 PM ROBERT EDWARDSON, Staff, Representative Justin Parish, Alaska State Legislature, on behalf of Representative Parish, prime sponsor of HB 165, offered that much of what is being proposed under HB 165 is already being accomplished through [DOA] policies and procedures but is not incorporated into statute. He explained that the proposed legislation would put these policies and procedures into statute; therefore, they could not be changed by future changes in policies and procedures. MR. EDWARDSON relayed that HB 165 would add a 26th paragraph to the Alaska Personnel Act, and it would permit DOA to create policies and procedures allowing veterans to use experience in lieu of minimum qualifications. This would be applicable in situations in which there is no good comparison between a person's military duties and those of civilian work, yet the military experience clearly meets the requirements in the position description or classification. 5:45:15 PM REPRESENTATIVE BIRCH stated that he has worked with many veterans; he has respect for veterans; and he is appreciative that the consideration of military experience in hiring is already represented in policy. He relayed his hiring experience in which he considered military experience as qualified experience. REPRESENTATIVE BIRCH referred to the paragraph in the sponsor statement which mentions that HB 165 would be applicable to a "former prisoner of war." He asked if under the proposed legislation, time spent in a prisoner of war camp would count as qualifying experience for employment. REPRESENTATIVE PARISH responded that there is nothing in HB 165 that would count "time" as a qualification; it refers only to experience gained. He stated that Legislative Legal and Research Services offered the language that includes "prisoner of war." He explained that in the unlikely event that a prisoner of war was compelled to perform an activity and through that activity, gained experience, the experience would be equivalently recognized under the proposed legislation. He admitted that the scenario is a bit far-fetched; however, he said that he did not wish to exclude a prisoner of war under the proposed legislation. MR. EDWARDSON stated that in Title 39, Chapter 25, of the Alaska Statutes there are eleven references to eligibility for certain veteran benefits, and "prisoner of war" is a qualifying category for those benefits; therefore, the language in HB 165 matches what is already in statute. He stated that there are two types of applicants that are required to be interviewed: a disabled veteran and a former prisoner of war. REPRESENTATIVE BIRCH reiterated that he is heartened to hear that the proposed legislation is unnecessary, because it has been adopted through policy. 5:48:28 PM CHAIR KREISS-TOMKINS expressed that he supports HB 165. REPRESENTATIVE TUCK relayed his appreciation for Representative Parish's testimony stating that veterans often have difficulty finding employment in civilian life. He offered that in the military, everyone starts from "ground zero" regardless of nationality, culture, background, or social class; they learn to work together in teams; they learn quickly; and they become leaders. He opined that veterans make great employees. He asserted that if the proposed legislation assists veterans in being able to apply their military training to civilian employment, then it is a good thing. CHAIR KREISS-TOMKINS announced that HB 165 would be held over. 5:50:11 PM The committee took an at-ease from 5:50 p.m. to 5:53 p.m. HB 74-DRIVER'S LICENSE & ID CARDS & REAL ID ACT    5:53:27 PM CHAIR KREISS-TOMKINS announced that the final order of business would be HOUSE BILL NO. 74, "An Act relating to the implementation of the federal REAL ID Act of 2005; and relating to issuance of identification cards and driver's licenses; and providing for an effective date." CHAIR KREISS-TOMKINS stated that he invited the Alaska [congressional] delegation - U.S. Senator Lisa Murkowski, U.S. Senator Dan Sullivan, and U.S. Representative Don Young - to testify on HB 74 during the 4/6/17 meeting of House State Affairs Standing Committee. He maintained that a frequently asked question is, What is Congress doing about this legislation? He offered that he would share with the committee any responses from their offices. He mentioned that if HJR 15 passes the House, it would be sent to the delegation. CHAIR KREISS-TOMKINS relayed that in the past week, his office has worked with the Department of Administration (DOA), the Department of Public Safety (DPS), the American Civil Liberties Union (ACLU), and other organizations to propose a committee substitute that would maximize privacy protections. 5:56:02 PM REPRESENTATIVE WOOL moved to adopt the proposed committee substitute (CS) for HB 74, Version 30-GH1781\J, Martin, 4/4/17, as the working document. REPRESENTATIVE TUCK objected for purpose of discussion. 5:57:01 PM STEPHANIE GILARDI, Staff, Representative Jonathan Kreiss- Tompkins, Alaska State Legislature, on behalf of Representative Kreiss-Tomkins, prime sponsor of HB 74, stated that the challenge in amending HB 74 was addressing concerns regarding data storage and sharing while finding a way for Alaska to issue federally compliant identification (ID) cards and licenses. She asserted that Version J was the result of discussions with DOA, the Division of Motor Vehicles (DMV), and ACLU; it was drafted to ensure that Alaska satisfies the requirements of the REAL ID Act when issuing compliant ID cards and driver's licenses while protecting Alaskans' privacy. She maintained that Version J would tighten restrictions on the ways in which data may be stored and shared, and it would attempt to create a meaningful distinction between federally compliant ID cards and licenses and those IDs and licenses that are not compliant. MS. GILARDI referred to Slide 2 of the PowerPoint presentation, entitled "Overview," and relayed that Version J makes several changes to HB 74. It includes language that ensures applicants are provided with the information they need to make an informed choice when selecting between compliant and noncompliant ID cards and licenses; it uses specific language to limit the types of documents used to apply for federally compliant ID cards and licenses; and it specifies the length of time the documents may be retained. Version J would limit the retention of data used to apply for noncompliant ID cards and licenses. It introduces a new section [into statute] on data sharing prohibition. She noted there are other, smaller changes that will be mentioned at the end of the presentation. MS. GILARDI referred to Slide 3, entitled "Ensures applicants make an informed [choice] at the DMV." She relayed that HB 74 offers the option of choosing between a compliant ID card or license and a noncompliant ID card or license; the individual applying for a [compliant] ID card or license must clearly make a choice to do so. She added that under Version J, an applicant who chooses a compliant card will be required to do so affirmatively, which may be done by way of a checkbox or signature, and he/she will be provided information by DOA at the time of application to help him/her make an informed choice. She explained that the information provided must include a description of both noncompliant and compliant cards detailing the storage and sharing of the applicant's information. Applicants will be informed of the official purpose and limitations for using compliant and noncompliant cards. The DOA will be required to notify the applicant that he/she is not compelled to use a federally compliant ID card or license when entering federal property or flying on federally regulated commercial aircraft; thus, the applicant will be aware when applying for a compliant card or license that he/she could opt instead to use a passport or a passport card to access these places. 6:00:33 PM MS. GILARDI referred to Slide 4, entitled "Limits documentation and retention for compliant identification card and license applications." She said that HB 74 states that the commissioner [of DOA] shall adopt regulations for the issuance of REAL ID compliant ID cards and licenses but does not set time limits on the retention of documents used to apply for compliant cards. She asserted that Version J would limit to the minimum required by the REAL ID Act the retention of identity source documents provided when applying for ID cards or licenses. Version J specifies that after the length of time required by the REAL ID Act for retention of documents has elapsed, those documents would be destroyed as soon as practicable. The documents that must be destroyed include digital or paper copies, additional information related to identity source documents, the paper copy of the application itself, and the image of the applicant's face. Version J also would prohibit copying, scanning, or retaining in any form a document that is not an original or certified copy that has been presented to verify information included on the application for a compliant card. MS. GILARDI referred to Slide 5, entitled "Limits the retention of data for noncompliant identification card and license applicants," and said that HB 74 did not address the retention of personal data for noncompliant cards. She stated that to further the goal of creating a meaningful difference between compliant and noncompliant cards, Version J would limit the length of time the image of a noncompliant card holder may be stored to one year after the expiration of his/her noncompliant card or license. Version J would also prohibit the retention of the image of an applicant's face, if the applicant applies for but does not receive a noncompliant ID card, for example due to failing a driver's test. She stated that DMV currently does not keep these images, but Version J would enshrine this practice in statute, thus guarding against the storage of images of people applying for either noncompliant or compliant cards regardless of whether the cards were obtained. MS. GILARDI referred to Slide 6, entitled "Introduces a new section, AS 28.05.068 Prohibition on Data Sharing." She said that Version J would introduce a new section into statute that would explicitly prohibit the conveyance, distribution, or communication of images of faces, documents, and signatures to databases, pointer systems, or any other index. 6:03:15 PM MS. GILARDI referred to Slide 7, also entitled "Introduces a new section, AS 28.05.068 Prohibition on Data Sharing." She said that as currently written, Version J would make it possible for Alaska to contribute to the State to State (S2S) pointer system administered by the American Association of Motor Vehicle Administrators (AAMVA). She maintained that Version J would not include a prohibition on the conveyance, distribution, or communication of Social Security numbers (SSNs) in whole or in part. She stated that while the REAL ID Act does not require SSNs to be stored in a database or pointer system that is accessible to other states, the REAL ID Act does require a state to maintain a state motor vehicle database that provides electronic access to all other states to information contained in the database. She added that the motor vehicle database must contain at minimum all the data fields printed on a compliant driver's license or a compliant ID card issued by the state, as well as, motor vehicle driver histories, which included motor vehicle violations, suspensions, and points. MS. GILARDI relayed that Alaska currently provides electronic access to its motor vehicle database and accesses other states' information through the S2S system administered by AAMVA. She stated that DMV uses this system to check with other states to determine if an individual possesses more than one driver's license to detect and deter driver's license and ID card fraud. She said that DMV currently shares information on licensed drivers to the S2S database, and under Version J that would continue for both compliant and noncompliant driver's license holders. She asserted that the S2S system is unique and is the only system currently in existence that will allow Alaska to achieve compliance [with REAL ID]. The S2S system includes the following information: full legal name; former names; date of birth; gender; last five digits of SSN; and the driver's license number. She pointed out that while the inclusion of SSNs in an interstate system is not required for REAL ID Act compliance, SSNs are required by the S2S data system. She reiterated that the S2S data system is the only interstate system that can be used by Alaska to provide other states electronic access to its motor vehicle information, and that access is a requirement of the REAL ID Act. 6:06:11 PM MS. GILARDI relayed that if DMV does not provide SSNs to satisfy the requirements of participation in the S2S system, Alaska cannot participate in the S2S system; if Alaska does not participate in a S2S system, it will not be [REAL ID] compliant. MS. GILARDI referred to Slide 8, entitled "Additional changes in the CS," and reviewed several minor revisions under Version J. She said that the additional charge for both a federally compliant ID and a federally compliant license would be $10; the amount was suggested by DOA. She explained that $5 would be applied to the cost of the production of licenses, and $5 would be applied to reimburse the capital investment in approximately five years. She added that charging the same fee for both cards helps to alleviate some of the additional administrative work borne by DOA. MS. GILARDI stated that a driver's license would expire on the licensee's birthday in the eighth year following the issuance of a license. Version J includes the requirement for physical security features on all licenses in lieu of the current requirement of a hologram. The federal government currently requires that all driver's licenses are federally compliant; Version J would enshrine that requirement in statute. 6:09:08 PM REPRESENTATIVE WOOL asked for confirmation of his understanding that SSNs are not required by the REAL ID Act; however, participation in a S2S system is required. There is only one S2S system - the one administered by AAMVA - and since S2S requires SSNs, by default REAL ID does require SSNs. MS. GILARDI answered that to her knowledge, that is correct. CHAIR KREISS-TOMKINS responded that he and Ms. Gilardi discussed this point during a phone call with the U.S. Department of Homeland Security (DHS) and facilitated by DOA. He said that he asked why the requirement of the S2S system - for SSNs - goes beyond what is required by the letter of federal law. He stated that the answer he received to that question was twofold: the DHS has promulgated regulations through its interpretation of federal law that SSNs are required; and because the S2S system requires SSNs and is "the only game in town, the only game in the United States," Alaska effectively must comply with the SSN requirement. He added that there are both DHS regulations that come to bear, as well as, the fact that the S2S system requires SSNs; therefore, Alaska has no other option. He clarified that the S2S system does not require the entire SSN, but only the last five digits. REPRESENTATIVE WOOL responded that it was pointed out in the previous hearing on HB 74 [in the House State Affairs Standing Committee meeting of 3/31/17, 6:01 p.m.], if the first three digits indicate the state from which a person originates, and another five digits are known, then the probability of guessing the full SSN is one in ten. He questioned the security of one's SSN. He asked if one's SSN is linked to his/her driver's license ID number, so that the license number becomes a de facto federal ID. He mentioned that SSNs are now assigned at birth, whereas years ago one obtained an SSN for employment. 6:13:08 PM MARLA THOMPSON, Director, Division of Motor Vehicles (DMV), Department of Administration (DOA), explained that to obtain a driver's license, one must either submit his/her SSN or a letter stating that he/she is not able to obtain an SSN. The DMV does link driver's license information to SSN; however, the SSN is not displayed on the driver's license. For DMV, use of the SSN is to verify a person's identity. REPRESENTATIVE WOOL asked what DMV does with the SSNs and if they are kept in the DMV's database. MS. THOMPSON responded that DMV does keep the SSNs and uses them to verify identities for online or in-person transactions with DMV. 6:14:41 PM REPRESENTATIVE LEDOUX referred to the testimony of Tara Rich [Legal and Policy Director, ACLU of Alaska, during the 3/21/17 House State Affairs Standing Committee meeting], who made suggestions for making [compliance with REAL ID] less onerous for Alaska. Representative LeDoux asked if all the suggestions have been [included in Version J] and if not, why not. 6:15:40 PM ERIC GLATT, Staff Attorney, American Civil Liberties Union (ACLU) of Alaska, expressed his belief that Version J does not incorporate all the suggestions of the ACLU. He said that the ACLU has been opposed to the REAL ID Act at the federal level since it was first introduced by Congress. He stated that the ACLU's concern is that the Act inherently compromises privacy. He contended that if Alaska's intent is to comply with the REAL ID Act, it would be remiss of ACLU staff not to weigh in on achieving compliance while minimizing compromise to the greatest extent possible. MR. GLATT relayed that AAMVA's S2S system index uses the last five digits of the SSN, and Version J would continue to allow that practice. He maintained that ACLU regards use of the five SSN digits as a significant privacy threat: the resulting national database not only would contain information about all compliant driver's licenses and IDs in Alaska, it would contain information about all Americans in states that are participating in the S2S system; a national database containing such a valuable piece of identifying information is a major concern. MR. GLATT offered that the intent of introducing Version J was not to make compliance impossible; however, the staff at ACLU of Alaska urges Alaska to continue to pursue the question of why the [S2S] index requires information that the REAL ID Act does not. He concluded that because of the progress [toward REAL ID Act compliance] already accomplished by AAMVA through the S2S system and the fact that DHS will only recognize participation in that system as compliance, staff at ACLU of Alaska currently can see no way for Alaska to withhold SSN information and achieve compliance. 6:18:32 PM REPRESENTATIVE LEDOUX asked if Mr. Glatt has any recommendations for what Alaska should do. MR. GLATT responded that there are several approaches that Alaska could take. He relayed that AAMVA has indicated that any participating state may make a request to not share that [SSN] information in the [S2S] index; such a request would go to the steering committee within AAMVA to determine if AAMVA can facilitate the request. He suggested that Alaska make that request. He confirmed for Representative LeDoux that regarding SSNs, making that request is the optimal course of action. REPRESENTATIVE LEDOUX asked if there are any other suggestions for Alaska from the ACLU that have not been incorporated into Version J, and if so, why not. MR. GLATT responded that there is another area of grave concern to ACLU: the scanning and retention of digital images of documents. He explained that the REAL ID Act requires any applicant for a compliant card to have his/her identity source documents scanned and saved in a digital database for ten years. He expounded that currently when applying for a driver's license, one may present his/her passport, which would be examined for validity and returned. He asserted that under REAL ID, the passport would be scanned. Under Version J, that would not be the case for anyone applying for a noncompliant card. He relayed that there is a dispute between DHS and AAMVA regarding the interpretation of "identity source documents." MR. GLATT said that among the documents that may be presented for a compliant driver's license is a utility bill for verification of address, and a pay stub, a 1099 form, or a W-2 form for verification of SSN. He stated that ACLU's interpretation of the Act and the regulations implementing the Act is that those documents should not be considered identity source documents and should not be subject to scanning and held in a database for ten years. He maintained that anyone concerned about his/her privacy would not appreciate his/her tax forms being held in a second database; once the information has been examined and verified, keeping it in a database serves no statutory purpose or security interest. MR. GLATT offered that because there is a dispute among the ACLU, DHS, and AAMVA about documents being scanned and kept in a database, Version J endeavors to incorporate the same disputed language from the REAL ID Act. In that way, interpretation of that language can be addressed another day while at the same time there is no doubt about Alaska's compliance with the REAL ID Act, because the language in Version J matches the language in the REAL ID Act and the regulations. 6:23:36 PM REPRESENTATIVE LEDOUX asked if the way Version J is written is "OK or not OK." MR. GLATT explained that the ACLU continues to believe that REAL ID represents a significant compromise of people's privacy. He expressed his belief that if Alaska's intent is to comply with the REAL ID Act, Version J endeavors to put Alaska within the scope of compliance and leave the contested issue alive to be resolved at another time. CHAIR KREISS-TOMKINS offered that Version J addresses many of the suggested revisions of the ACLU but not all of them - most notably the two mentioned by Mr. Glatt. He suggested that committee members wishing to address the two issues [not addressed] offer amendments. He summarized that there are two outstanding ACLU concerns; however, Version J does include other privacy improvements to HB 74. MR. GLATT agreed that Version J does incorporate most of the recommendations made by Ms. Rich, and his testimony focused on the aspects of Version J that the ACLU of Alaska still finds troubling. REPRESENTATIVE LEDOUX asked if ACLU of Alaska staff could assist in writing an amendment to address these two issues in a manner to comply with the REAL ID Act in the most minimal way possible. MR. GLATT answered absolutely; however, the language of the amendment would have to include recognition that the requirements of the S2S system - the only system recognized by DHS - goes beyond the requirements of the Act. CHAIR KREISS-TOMKINS stated that the State of Alaska is in an awkward position - one in which an amendment to Version J would meet federal law but not work with the S2S system. He suggested that through his discussion with DHS staff this morning, he learned that even if Alaska is compliant with federal law, if it cannot work with the S2S system, it would be ruled as noncompliant and, therefore, penalties would apply. He added that if that is the will of the legislature, then litigation might ensue; however, that would be for the committee and the legislature to decide. 6:27:34 PM REPRESENTATIVE TUCK reiterated that any change in the S2S system, which is managed by the State Pointer Exchange Services (SPEXS) and [operated] by AAMVA, would be decided by a general committee or general counsel [of AAMVA]. He asked how those committee members are selected or appointed. MS. THOMPSON responded that there is a governance board for the S2S specifically and she serves on that board. REPRESENTATIVE TUCK asked how long Ms. Thompson has been on the governance board. MS. THOMPSON answered that she has been on the board since March 1, 2017. REPRESENTATIVE TUCK reiterated that neither the federal government nor the [REAL ID] Act requires SSNs as an identifier for compliance with REAL ID; however, AAMVA does require SSNs. He asked what identity documents are used under the REAL ID Act for compliance when the SSN is not used for proof of identity, since the SSN is not required under the REAL ID Act. MS. THOMPSON answered that based on discussions with DHS, the S2S is what is required for Alaska to be compliant and required for S2S is the last five digits of the SSN, along with the applicant's name and date of birth. REPRESENTATIVE TUCK suggested that the requirement for SSNs for the S2S is the decision of the [AAMVA governance] board; he asked what DHS requires as a compliant ID for identification. MS. THOMPSON replied that the source documents include the following: a birth certificate, which is verified with the birth certificate database; an SSN, which is verified with the Social Security Online Verification System (SSOLV) under the U.S. Social Security Administration (SSA); a certificate of citizenship or naturalization; and a foreign passport with approved visas attached. 6:32:21 PM REPRESENTATIVE TUCK stated that in late January when DOA joined AAMVA, full SSNs were uploaded to the S2S system. He asked if there is any way Alaska could retrieve those SSNs. CHAIR KREISS-TOMKINS expressed his understanding that Alaska has been a member of AAMVA for some time, but since January, Alaska's representative to AAMVA was elevated to membership on the governing board. MS. THOMPSON responded that Alaska has been a member of AAMVA for years. She said that AAMVA is an association that bridges states together so that drivers are properly licensed: commercial driver's license (CDL) drivers are properly licensed; the Problem Driver Pointer System (PDPS) is consulted to identify people with driving under the influence (DUI) offenses; and people with suspended driver's licenses are identified. She maintained that there is a great deal of data that states share to ensure valid and proper driver's licenses. REPRESENTATIVE TUCK asked if there has been an attempt to retrieve Alaska's SSNs after they were uploaded [to the S2S system}. MS. THOMPSON answered that AAMVA only receives the five digits of the SSN, the date of birth, and first and last name. She maintained that this information is used to index to ensure that there is not a duplicate driver's license and to determine what state has issued a driver's license. REPRESENTATIVE TUCK asked if that is already occurring. MS. THOMPSON responded yes. 6:35:48 PM REPRESENTATIVE BIRCH asked if government or a business has a duty or responsibility to determine a person's identity. MR. GLATT relayed instances in which the government has a right to determine a person's identity: it controls access to military bases; it has assumed control over federally regulated air space, which explains the presence of the Transportation Security Administration (TSA) personnel in airports performing identity checks; and the Identity Project, which proports that if someone does not wish to present documents verifying identity, than he/she can submit to a more thorough individualized screening to establish that he/she is not a danger. He maintained that for someone "walking down the street," if the police do not suspect him/her of a crime, they are not allowed to demand identification and find him/her in violation if he/she fails to do so. He said that absent a reasonable suspicion of a violation of the law, a request for identification is not an inquiry the government can make. REPRESENTATIVE BIRCH asked Mr. Glatt if he concedes that at some level and at some point, it is a duty and responsibility of a business and government to affirm that a person is who he/she claims to be. MR. GLATT answered that he has not considered the question of whether a private operator may refuse service to someone who fails to meet that private operator's independent assessment that the person is who he/she claims to be. He maintained that if someone is holding oneself out as a provider of public accommodations, such as a restaurant, there are discrimination laws protecting certain classes of people from being treated differently; however, he stated that he has never examined the situation in which a business would only serve people who identified themselves first and convinced the business operator that they are who they say they are. REPRESENTATIVE BIRCH offered that in the case of someone getting on an airplane, it is important that a person's identity is verified because of security reasons. He asked for the best way to achieve that; he mentioned biometrics, iris scans, finger prints, and deoxyribonucleic acid (DNA), as well as the documentation alternatives such as birth certificate. He stated that he has attended meetings this week regarding credit scores, in which access to Facebook pages was mentioned. He asked if it is truly possible anymore for someone to be anonymous. He offered that one can find a "mountain" of information on a person by searching the internet. He said, "I'm trying to figure out if we're making a mountain out of a mole hill here." He maintained that the issue is valid and important but offered that there are "tons" of information out there on everyone. He offered that one's digital footprints may include that he/she bought Wheaties for breakfast, and he referred to "all that's out there." He asked Mr. Glatt for his sense of [access to personal information] and privacy matters, gained through his research and work with ACLU. 6:41:50 PM MR. GLATT replied that he considers [privacy] a very important issue. He maintained that today many Americans have the sense that the loss of privacy is already a foregone conclusion, so there is no point in caring. He offered that the committee has heard testimony in support of HB 74 by people who have prioritized expediency in getting the proposed legislation passed above paying attention to the details. He mentioned that the ACLU appreciates that the committee members are paying attention to the details because the details matter, and they matter to privacy in general. MR. GLATT referred to Representative Birch's question regarding a person's commercial "lives" in relation to Facebook, Google, internet service providers (ISPs), and information brokers who compile information about people from publicly available and accessible databases. He said that he realizes many people believe it is too late to remedy the situation described by Representative Birch, but he maintained that the ACLU and other privacy advocate organizations do not believe it is too late. He compared it to taking a snapshot of the working conditions before the labor movement and concluding that it is too late to do anything about them: workers today would not have a two-day weekend, a 40-hour workweek, and minimum wage, and there would still be child labor. He asserted that when enough people come together to "express their will," they can change what might otherwise appear to be foregone conclusions. He suggested that people look to Europe, which has much more stringent privacy protections in the commercial sphere than America. He added that if the discussions regarding privacy prevail, there still would be hope for America that commercial privacy will assert itself more than it does today. He stated that this issue is certainly one that the ACLU will continue to pursue. REPRESENTATIVE BIRCH mentioned Ancestry.com, credit scores, and the digital presence, and added that he appreciated Mr. Glatt's testimony. 6:44:03 PM REPRESENTATIVE JOHNSON asked about the use of SSNs in Alaska to index facial recognition properties. She offered that doing so constitutes a stronger connection and makes the database more accessible. She asked if Mr. Glatt had any information on whether this kind of indexed connection has been a requirement in Alaska or anywhere else. MR. GLATT answered that if the question is why SSNs are linked to driver's licenses and identity cards and if there are other instances of similar linkage with SSNs, he does not know of any other instances in which SSNs are used in a state specific context, other than for licensing drivers. He maintained that the SSN linkage with driver's licenses and identity cards exists partly as a function of federal and state laws to cooperate in child support services provisions in the federal law if, for example, someone endeavors to evade child support payments by moving out of state and obtaining a new driver's license. He offered his belief that it was for this reason that SSN entered the driver's licenses realm. He maintained that the use of SSNs serves as one of the tools for enforcing child support laws and represents the specific nexus for tying SSNs to driver's licenses. CHAIR KREISS-TOMKINS offered that Representative Johnson's question referred to the linkage between facial and photographic data and SSNs. REPRESENTATIVE JOHNSON stated that she is unaware of any state database that has her SSN linked with her metric data and that is being shared in any way. MR. GLATT responded that it is true that even for noncompliant ID licenses in Alaska, the databases maintained by DMV even now include both the digital image of one's face and the SSN, which has been the policy for less than ten years. He conceded that he is unaware of how those combinations of biometrics, facial images, and SSNs are used, even within DMV. 6:47:59 PM REPRESENTATIVE WOOL relayed his understanding as follows: All the states share data to determine if an applicant for a driver's license has a license in another state, a revoked license in another state, a CDL, and to verify identity. If the applicant gives DMV his/her name and date of birth and there is another person with the same name and date of birth, then DMV uses the last five digits of the SSN to distinguish that applicant from the other person. He asked if there is an alternative to using the last five digits of the SSN, such as a digital image, that would satisfy the verification process in this case. He asked, "What would AAMVA do?" MR. GLATT opined that the question is an excellent one to pose to AAMVA. He said that if AAMVA were to give up using SSNs as a tool to reduce the number of false positives, one alternative simply would be to manually check the person's image to determine if the person is who he/she claims to be. He reiterated that the possibility of using an alternative to the last five digits of the SSN should be presented to AAMVA so that states would have an alternative. 6:50:24 PM REPRESENTATIVE WOOL expressed his understanding that Alaska, although not currently REAL ID compliant, presently shares data containing the last five digits of the SSN with AAMVA in a system. He stated that he did not know if the data is exchanged or just viewed; in any case, it is currently being used and the only way to prevent its use would be to retrieve the data. He asked if the data resides in an Alaska location and is accessed by other states through a central port or if the data is uploaded to some other server in a non-Alaska location. MR. GLATT answered that he is unable to speak authoritatively about exactly what the S2S system operated by AAMVA accomplishes. He said his understanding is that a central index for the S2S system is managed in Virginia and operated by AAMVA, and in that index, are several identifying factors for all compliant state licensees. He added that the identifiers are first name, last name, all prior names, date of birth, the type of license, the state of issue, and the last five digits of the SSN. This comprises the part of the record used to identify the full record that a state or territory maintains for its licensees. It is in the full record that the driver history can be found, including the existence of points, suspension, and other information about the driver. MR. GLATT said that the central index, managed by AAMVA and located in Virginia, is meant to locate records. He stated that the inclusion of SSNs in the index causes ACLU of Alaska great concern, and he asked, "If all it's meant to do is locate a record, why should it have something so valuable included in it on the front end?" MR. Glatt relayed that he did not know if Alaska or the other S2S participating states are using the pilot program as it will be used once compliance for all states is operational or if they simply are testing it. He offered his understanding that until Alaska and the other states participated in S2S, they utilized a more cumbersome process of relying on faxes and "sifting" data to verify that an applicant does not already have a license in another state or is trying to hide his/her record. He stated, "To that question of - How do you know? - it was a very cumbersome process." 6:54:03 PM REPRESENTATIVE WOOL referred to a passport and a passport card as alternatives to a REAL ID card and offered that because they were in a separate database, they were more secure. He speculated that the government agency that issues passports has his name, date of birth, SSN, and all the other data being discussed. He asked how the database used to implement REAL ID is different from the passport database and why it is more concerning. He asked if the reason is that the data is not shared with other states or that it is less accessible. MR. GLATT replied that the context of Representative Wool's questions is, What's one more database? He offered an analogy as explanation: Someone gives a neighbor a copy of his/her house key in case he/she gets locked out of the house. In this case, the neighbor is a trusted person who can be relied upon not to misuse the key. If the key is given to ten neighbors, anyone of whom may intend some mischief or is careless with the key, then one breach resulting in someone making multiple copies of the key would cause a serious problem. He conceded that national databases do exist - such as at the U.S. Department of State (DOS) for passports, the Internal Revenue Service (IRS) for taxes, and SSA for issuing retirement benefits - and the state has its own databases; however, he maintained that the presence of these databases does not justify having one more database. He asserted that having one more database that could be attractive to a [security] "hacker" or identity thief, is one more unnecessary risk. CHAIR KREISS-TOMKINS asked Mr. Glatt to comment on the difference between SSA, DOS, IRS, and AAMVA as custodians of data and the relative cyber security maintained by each agency. MR. GLATT responded that the federal government is governed by the federal Privacy Act [of 1974] whenever it manages personally identifiable information (PII) in a system of records. He stated that a federal agency that maintains PII must comply with many standards and must conduct a privacy impact assessment, which becomes publicly available. The public has a right to information about what a government agency is doing to protect people's privacy. He maintained that any time a federal agency implements a program that will impact people's privacy, it must perform a privacy impact assessment. He asserted that for states creating a database maintained by a private non-profit organization, the Privacy Act does not apply. He offered that Alaska's Freedom of Information Act provisions [Alaska Open Records Law, AS 40.25.110] allow Alaskans to request information about records that Alaska shares with S2S, or AAMVA; however, AAMVA does not have a legal obligation to do the same type of assessment to make itself transparent, as would a federal agency. 6:58:55 PM REPRESENTATIVE TUCK stated that the question is, Is it hopeless to fight for privacy because no one cares or because it is truly hopeless? He relayed that SSA advises against the use of SSNs for [issuing driver's licenses]. He said that Alaska driver's licenses no long display SSNs. He expressed his appreciation for the recommendation by the ACLU of Alaska that "we should not give up." REPRESENTATIVE TUCK relayed his experience when traveling by plane from Juneau to Anchorage on March 1, 1917: He forgot to take his wallet, therefore, flew without any ID. The TSA gave him a "red bin" and screened him using pat-down procedures. Coming back to Juneau by plane, he was able to use his expired Costco card [at the TSA checkpoint]. He asked if Mr. Glatt knew what may be required in the future as ID for plane travel. MR. GLATT answered that the experience described by Representative Tuck is a perfect example of the fact that one does not need an ID to gain access to federally regulated airspace; by subjecting oneself to further screening, there is a way to get past the security checkpoint. He stated that he is not aware of a federal law or rule pending that would prohibit that access. REPRESENTATIVE TUCK pointed out that based on Mr. Glatt's testimony, privacy is not dead. He noted that in the November issue of Consumer Reports, there is an article about how to protect one's privacy. The author of the article writes, "I've called the bluff on those who believe privacy is dead; in fact, there is a lot you can still do." Representative Tuck asked, "Why in the world would we want to be giving up all these documentations to something that is not federally secure?" He stated that the article also points out that "data is the new currency," and private entities clamor for it. He mentioned the new surveillance industrial complex that is continuing to expand; it is a multi-billion-dollar trade in personal data. He reiterated his appreciation for the efforts of ACLU of Alaska to ensure the privacy rights of Alaskans are secure. 7:03:31 PM LESLIE RIDLE, Deputy Commissioner, Department of Administration (DOA), explained that although she has immediate comments on Version J, she reserves the right to more formally respond after a more thorough study of the proposed CS and discussion with staff and the attorney general. She referred to page 2, lines 13-19, to point out a requirement that she believes would make Alaska noncompliant [with the REAL ID Act] - the requirement prohibiting DOA from keeping source documents for compliant cards. She reminded the committee that Mr. Glatt indicated that the Alaska Department of Law (DOL) and DHS disagree with ACLU on what documents are required. MS. RIDLE referred to page 2, lines 26-27, which states that the state or municipal government may not require a person to possess or use an ID card that is federally compliant. She asserted that within the Department of Military & Veterans' Affairs (DMVA), the state currently does require people to access base to work. She said the state is considering whether it must change all its personnel descriptions to include as a condition of employment the requirement of a federally compliant license allowing plane travel or for accessing a military base. She added that this would not apply to all state jobs, but some. She expressed her concern that the sentence [in Version J] that she cited would keep the State of Alaska from saying that an employee must be able to travel by plane or access a base, if that is needed for the job. REPRESENTATIVE LEDOUX asked why not simply require an employee to be able to access a base or to travel by plane. She posed the question, If a state employee decides to have a passport in lieu of a REAL ID card, why require him/her to have a REAL ID card? MS. RIDLE responded that since page 2, lines 26-27, of Version J states that the state government can't require an employee to use a federally compliant ID card, and a passport is federally compliant, her belief is that Version J would prevent the state from requiring even a passport. She added that she will clarify this point with the attorney general. 7:07:12 PM MS. RIDLE referred to page 3, line 7, [which prohibits copying, scanning, or retaining the SSN] and pointed out that there are other agencies that use the SSN, such as Child Support Services Division (CSSD) for the enforcement of child support, for a PFD application, and the Unemployment Insurance (UI) program for application for benefits. She reminded the committee that DOA databases are shared with the Department of Public Safety (DPS), which is used to investigate PFD fraud and unemployment insurance benefit fraud. MS. RIDLE referred to Section 4 on page 4, lines 11-15, which states that DOA may not share data with an entity or individual that is not a state agency or employee or permit the conveyance or distribution of the data with any entity [or individual] that is not a state agency or employee. She expressed her concern that this would prevent police departments and the Federal Bureau of Investigation (FBI) from accessing DOA data, which may create too much of a limitation on data sharing. She said she would consult with the attorney general and DPS regarding this issue. MS. RIDLE referred to page 5, line 9, which she asserted was confusing and may need clarification. It states that DOA may not keep an image of the applicant's face, regardless of whether the applicant has renewed his/her ID card, but if he/she renews the ID card, DOA must keep the applicant's photo. MS. RIDLE referred to page 5, lines 11-17, which also prohibits the retention of source documents for REAL ID, and she maintained that DHS has indicated that these documents must be retained; therefore, it is her belief that adopting this requirement would make Alaska noncompliant. MS. RIDLE referred to page 5, lines 24-25, which also prohibits the state from requiring a person to possess a federally compliant license. 7:10:29 PM MS. RIDLE referred to page 7, Section 9, which restricts the sharing of photos. She maintained that DOA has worked with ACLU and met with them four or five times, both with Representative Kreiss-Tomkins, with DMV, and alone. She referred to the question posed by Representative Johnson regarding the sharing of photos in conjunction with SSNs and stated that DOA does not share photos outside the state unless presented with a subpoena or court order. She stated that DOA fully supports that restriction. MS. RIDLE continued by saying that DOA offered amendments, requested by ACLU, addressing the retention of records. In response to Representative LeDoux's question on which recommendations were not incorporated into Version J, Ms. Ridle declared that DOA did not include the amendments requiring DOA to store all records and paper in lieu of scanning them. She asserted that the sheer volume of paper to be retained in DOA archives would be overwhelming. She maintained that DOA is attempting to balance efficiency - having documents readily accessible in multiple locations - with privacy - the total private storage of data. She reiterated that she is sympathetic to the public's desire keep its information private; however, the public expects efficiency as well. 7:13:12 PM REPRESENTATIVE BIRCH asked what concerns exist regarding facial recognition. MS. RIDLE answered that DOA does not share data outside of Alaska, and one's photo should not show up anywhere else unless he/she has used it, or the police have "put it up"; the DMV does not give it out. She gave as an example the case of the person from Alaska who committed a crime in the Florida airport; the DMV got many requests for his photo but did not comply. She maintained that subsequently his photo was released, but it wasn't his driver's license photo. MS. RIDLE relayed that after someone comes into DMV and gets a driver's license, DMV will check its own database at night for other pictures of the applicant, photos of anyone else applying for a driver's license under the same name, or photos that the computer finds that look somewhat like the photo of the applicant. She said that "human" review usually clearly reveals there is no fraud; however, DMV does find about five cases of possible fraud per month, which are turned over to the police to be investigated. She maintained that DMV does not compare Alaska photos to photos outside of its database. REPRESENTATIVE BIRCH asked if DMV then would use the other data points such date of birth or location of birth to review the matches. MS. RIDLE said that she understood why people might want photos destroyed after one year but maintained that DPS used historical photos for investigating crime and for identity questions. 7:16:41 PM REPRESENTATIVE LEDOUX referred to the original presentation of HB 74 [during the 2/7/17 House State Affairs Standing Committee meeting] and said that her understanding is that it would take five years for the state to recoup the money invested in implementing the program. She said that her hope is that the cost would be recouped in one or two years [through higher fees]. She asked what fees would be required to accomplish that. MS. RIDLE answered that the $5 [per person] fee would cover the cost to produce the REAL ID driver's licenses and cards; a $10 fee would pay back the $1.5 million cost in five years; and a $20 fee would cut that time in half [for recouping the cost]. She added that these estimates are based on about half the number of people getting driver's licenses getting REAL ID licenses: if more got REAL ID licenses, it would be recouped faster; if less got them, it would take longer. She maintained that the estimate [of half] is based on numbers from other states provided by DHS. REPRESENTATIVE LEDOUX asked for clarification that under the current version of the proposed legislation, someone wanting a REAL ID would have to pay an extra $10. MS. RIDLE replied yes. REPRESENTATIVE LEDOUX asked if someone getting a new driver's license would have to pay $5 plus the extra $10 for it. MS. RIDLE explained that under Version J, the cost of a REAL ID driver's license would be the cost of a noncompliant driver's license - $25 - plus an extra $10 for a total of $35. REPRESENTATIVE LEDOUX suggested that a person may not need a driver's license except for the REAL ID requirement. She asked what someone would pay under Version J of HB 74 if he/she applied for a driver's license. MS. RIDLE responded that for someone obtaining a brand-new license, it would cost $35. REPRESENTATIVE LEDOUX asked how long it would take to recoup the cost of the program if charging $10 extra per license - five years or ten years. MS. RIDLE answered that at the extra $10 cost, it would take five years [to recoup the money spent for the program]. REPRESENTATIVE LEDOUX asked what the fee would have to be for the state to pay for the program in two years. MS. RIDLE responded that with a $45 fee, the money could be recouped in about two years. CHAIR KREISS-TOMKINS clarified that the $45 represents an extra $20 over the $25 cost of a noncompliant driver's license. 7:20:15 PM REPRESENTATIVE WOOL offered that because AAMVA is not a recognized federal agency, it is the least trusted for data security; it is a non-profit made up of 51 entities that can do as it pleases - "a bit of a loose cannon." MS. RIDLE responded that AAMVA "is us"; it consists of all the DMVs and has been in existence since 1933. The AAMVA is an organization of all state DMVs that came together to: ensure uniform procedures for Americans to get licenses; ensure that licenses across the country have the same "strength"; and ensure that CDLs were valid across states. She pointed out that AAMVA partners with SSA to provide a "pointer system" for the SSA database and with [SPEXS] to facilitate the S2S database. Other partnerships include data sharing with the Commercial Driver's License Information System (CDLIS), the DHS Systematic Alien Verification for Entitlements (SAVE) Program, and the DHS passport database. She asserted that many agencies consider AAMVA a stable group of states; it is the DMVs that come together and make the rules by which AAMVA operates. 7:23:13 PM CHAIR KREISS-TOMKINS pointed out that AAMVA is to Alaska's DMV as the National Conference of State Legislatures (NCSL) is to the Alaska legislature, except that AAMVA has more functional responsibilities for coordinating policy than does NCSL. MS. RIDLE replied, "That's a perfect analogy." She added that the National Governors Association (NGA) is another good example. REPRESENTATIVE WOOL commented that his assumption is that Alaska has been a member of AAMVA since it had a DMV. He asked if there have been any data breaches or any major incidences related to data. He also asked if there is a central database in Virginia, maintained by a group of AAMVA personnel, with which all 51 DMVs interface. MS. RIDLE answered that she does not know if the database has been breached. She asserted that when the REAL ID Act became law and the regulations were created, the 51 DMVs began to consider how best to comply. The question was, What is the best way to verify a person's identity when he/she comes into the DMV? She maintained that AAMVA consulted privacy experts and researched best practices of encryption to create a system in which a state could verify someone's identity and determine that he/she is not a problem driver and doesn't have a license in another state. She stated that in the past, DMV used faxes and phone calls to obtain this information, which most likely did not meet privacy standards and was not efficient. She relayed that when Alaska began utilizing the [S2S system], Alaska DMV found 3,200 people with duplicate licenses; Alaska's best efforts could not avoid missing duplicate licenses. She pointed out that not all 3,200 people were being fraudulent; some did not want to admit they had another license or couldn't locate it to submit it. MS. RIDLE, in response to Representative Wool's second question, said that her understanding is that queries are transmitted to AAMVA by computer and answers are transmitted back to DMV by computer. The question of whether someone has another driver's license is answered with a "yes" or "no"; DMV personnel do not see any background information except the name of the other state that issued the person a driver's license. She suggested that there are a couple other keystrokes used - one example is the keystroke to cancel the other license. She emphasized that only DMV personnel can access the data through the "bridge"; employees of DPS or the Federal Bureau of Investigation (FBI) do not have access. 7:27:39 PM REPRESENTATIVE WOOL asked how many people within DMV have access to the bridge. He suggested that a disgruntled clerk, angry at someone, could access the data. MS. RIDLE responded that DMV employees are subject to a background check, their access to the database is monitored, and misuse of the data is punishable by termination of employment or criminal proceedings. She added that the same standards exist for the bridge through DPS. She maintained that as people started realizing the importance of data, it became criminal to misuse data. She concluded that the possibility for misuse of data exists; the DMV attempts to hire honest employees; and when an employee uses an electronic database, the supervisor can see who signed in and what is being viewed; with paper files, that is not possible. 7:32:04 PM REPRESENTATIVE TUCK removed his objection to the motion to adopt the proposed CS for HB 74, Version 30-GH1781\J, Martin, 4/4/17, as the working document. There being no further objection, Version J was before the committee as a work draft. [HB 74 was held over.] 7:33:37 PM ADJOURNMENT  There being no further business before the committee, the House State Affairs Standing Committee meeting was adjourned at 7:34 p.m.