From Newsweek:

COLUMBUS, Ohio – New federal security rules for issuing driver’s licenses could cost $11 billion to implement, raising concerns among states about paying for the changes, according to a national survey of states released Thursday.

“There’s no question that state legislators believe driver’s licenses should be as secure as is possible,” said William Pound, executive director of the National Conference of State Legislatures which helped conduct the survey. “The $11 billion question is, ‘Who’s going to pay for it?”’

Actually that’s not the question. The question is, “What will you get from spending $11 billion dollars?” The answer is, “Nothing of value.”

Here’s why:

The law requires states to incorporate common security features to prevent tampering or counterfeiting, such as using standard materials in every state to print the cards. States will have to verify the legitimacy of documents used to obtain a license and buy equipment to digitally store those documents.

The problem is that with a document that is common to 300 million people (coordination with Canada is supposed to be occurring too), and highly regarded/valued the efforts put into forging the document will be quite high. What they erroneously believe is that with the biometric identifier used on the document is that they can catch (nearly) all efforts of creating a duplicate identity for someone. There are only two biometrics that have a chance of this kind of quality. They are DNA and fingerprints. A duplicate iris scan shows up about once for every 200,000 people and that particular biometric has other issues as well (think specialty contact lenses for example). Voice and facial recognition biometrics don’t even come close to meeting the bar.

DNA testing as a biometric used on this wide of scale “isn’t ready for prime time” and may never be.  No matter how many times you watch Gattaca it’s still just a movie. Sometimes legislators have a difficult time distinguishing Hollywood from reality and I suspect this is one of those times. And even if were “ready for prime time” the character played by Ethan Hawke in Gattaca shows us how it is defeated it.

Fingerprints have been on California drivers licenses for something like 20 years (I wish I still had the notes from my biometrics class, but the people at PNNL didn’t return those to me after they committed their felony and wrongfully terminated me). Of those fingerprints on all those licenses only about 40% are actually usable. They were obtained at the DMV by people that were inadequately trained and motivated to get good fingerprints. Even if they were properly trained and motivated there will have to be thousands of people with authorization to enter and edit data in the system. With that large of an attack surface (read this to understand attack surfaces) and with the value of the document so high there will be lots of opportunity and motivation for obtaining an authentic, but fraudulent, document. See also my thoughts on an universal biometric ID which this is “a good first step” toward.

Since the terrorists, which this document is aimed at defeating, only need to find one hole in the system to “win” that particular battle we will have spent $11,000,000,000 on virtually nothing and it could have been invested in real security.

I’m thinking the UltiMAK school of charm would be a good place for some of those dollars.

At least some people that will be listened to are talking about it:

Security officials should concentrate on people not objects at airports but simplistic racial profiling is not the way to thwart potential attacks on airlines, experts say.

They warn, however, that more effective behavioural profiling would be very labour-intensive, expensive and would not guarantee success.

“It’s the only methodology that can stay ahead of terrorism and terrorists,” said Philip Baum, editor of the magazine Aviation Security International.

“Screeners are spending far too long trying to confiscate scissors and shampoos and gels from people who pose absolutely no threat.”

A debate over the merits of profiling — where security staff focus their search efforts on people they regard as suspicious on grounds such as ethnicity and religion — has erupted since British police said on August 10 they had foiled a plan to blow up trans-atlantic planes using liquid explosives.

Immediately, airports across Europe and the United States tightened security: passengers were banned from taking liquids or hand luggage on board and travellers were rigorously checked. Some of those measures were later relaxed.

Baum said such actions, which caused airport chaos, flight delays and cancellations, were unnecessary and ineffective.

“The existing technologies have been proven to have limited effectiveness,” he told Reuters. “They haven’t as yet identified anybody who has been carrying an improvised explosive device on their person or in their baggage, whereas profiling has been proven to be effective.”

This is all prior to boarding and I don’t disagree with any of it. Once people are on board more changes are necessary. All alternatives should be investigated.

As I have been saying for years current airport security doesn’t and probably can’t possibly work. Here are some other peoples thoughts on the topic:

• New Airline Security Rules (be sure and read the comments)
• Threat modeling airplane explosive detection
• Bruce Schneier points out knives and guns are built in prisons so how can we hope to keep them off of airplanes?
• Gaping holes in airport security

It’s time to investigate alternatives. Even scrapping the existing system entirely and taking all that money and investing it in intelligence and police work would be an improvement.

The biometric ID card has been one of my hot buttons for a long time. The U.K. is a little ahead of us on this and they are finding out it’s a bad idea:

MPs attacked plans for identity cards as inconsistent and lacking clarity yesterday and called for a rethink of the technology to be used.

The Commons Science and Technology Committee published a report expressing incredulity that the Home Office claimed to be able to produce firm estimates of the costs of running ID cards when fundamental technical decisions were still unclear.

The Home Office has said that running costs would be £584 million a year, whereas the London School of Economics, in a controversial report, has put the total costs of setting up and running ID cards at between £10.6 billion and £19.2 billion.

The report called on the Government to disclose more information about how the scheme would operate, particularly the database on which personal details would eventually be held.

The criticism comes after the admission by the Home Office last month that the introduction of identity cards as a voluntary measure was likely to be delayed past the target date of 2008 because of practical difficulties in implementing a scheme of that size.

…

The MPs’ report, which focused on the use of science and risk management in the ID cards policy, was particularly critical of ministers for deciding at the outset to have a sophisticated identity card holding three forms of biometric data — ten fingerprints, two iris scans and a face scan.

They expressed surprise at the unscientific manner in which this was decided, without adequate evidence on their effectiveness, especially of iris scanning, and urged the Government to be ready to change this if necessary.

Subsequent trials of the biometric technology showed that iris scans had a higher recognition rate for white and Asian participants than those who were black, casting doubt on their effectiveness. The Government faced further embarrassment over ID cards yesterday when the Information Commissioner criticised the Treasury for refusing to release information about the programme’s budget and timetable.

So what does Blair say he is going to do about it?

Tony Blair brushed aside criticism of the Government’s plans for identity cards yesterday, saying that they would remain a central policy aim for Labour.

Addressing his monthly press conference at Downing Street, the Prime Minister said: “Don’t be in any doubt that this goes forward. Absolutely.”

He added: “Whatever the technical issues this is a major, major issue for us and will be a major plank of Labour’s manifesto at the next election.”

I just hope we can learn something from their mistakes–like don’t go there!