From Newsweek:

COLUMBUS, Ohio – New federal security rules for issuing driver’s licenses could cost $11 billion to implement, raising concerns among states about paying for the changes, according to a national survey of states released Thursday.

“There’s no question that state legislators believe driver’s licenses should be as secure as is possible,” said William Pound, executive director of the National Conference of State Legislatures which helped conduct the survey. “The $11 billion question is, ‘Who’s going to pay for it?”’

Actually that’s not the question. The question is, “What will you get from spending $11 billion dollars?” The answer is, “Nothing of value.”

Here’s why:

The law requires states to incorporate common security features to prevent tampering or counterfeiting, such as using standard materials in every state to print the cards. States will have to verify the legitimacy of documents used to obtain a license and buy equipment to digitally store those documents.

The problem is that with a document that is common to 300 million people (coordination with Canada is supposed to be occurring too), and highly regarded/valued the efforts put into forging the document will be quite high. What they erroneously believe is that with the biometric identifier used on the document is that they can catch (nearly) all efforts of creating a duplicate identity for someone. There are only two biometrics that have a chance of this kind of quality. They are DNA and fingerprints. A duplicate iris scan shows up about once for every 200,000 people and that particular biometric has other issues as well (think specialty contact lenses for example). Voice and facial recognition biometrics don’t even come close to meeting the bar.

DNA testing as a biometric used on this wide of scale “isn’t ready for prime time” and may never be.  No matter how many times you watch Gattaca it’s still just a movie. Sometimes legislators have a difficult time distinguishing Hollywood from reality and I suspect this is one of those times. And even if were “ready for prime time” the character played by Ethan Hawke in Gattaca shows us how it is defeated it.

Fingerprints have been on California drivers licenses for something like 20 years (I wish I still had the notes from my biometrics class, but the people at PNNL didn’t return those to me after they committed their felony and wrongfully terminated me). Of those fingerprints on all those licenses only about 40% are actually usable. They were obtained at the DMV by people that were inadequately trained and motivated to get good fingerprints. Even if they were properly trained and motivated there will have to be thousands of people with authorization to enter and edit data in the system. With that large of an attack surface (read this to understand attack surfaces) and with the value of the document so high there will be lots of opportunity and motivation for obtaining an authentic, but fraudulent, document. See also my thoughts on an universal biometric ID which this is “a good first step” toward.

Since the terrorists, which this document is aimed at defeating, only need to find one hole in the system to “win” that particular battle we will have spent $11,000,000,000 on virtually nothing and it could have been invested in real security.

I’m thinking the UltiMAK school of charm would be a good place for some of those dollars.

At least some people that will be listened to are talking about it:

Security officials should concentrate on people not objects at airports but simplistic racial profiling is not the way to thwart potential attacks on airlines, experts say.

They warn, however, that more effective behavioural profiling would be very labour-intensive, expensive and would not guarantee success.

“It’s the only methodology that can stay ahead of terrorism and terrorists,” said Philip Baum, editor of the magazine Aviation Security International.

“Screeners are spending far too long trying to confiscate scissors and shampoos and gels from people who pose absolutely no threat.”

A debate over the merits of profiling — where security staff focus their search efforts on people they regard as suspicious on grounds such as ethnicity and religion — has erupted since British police said on August 10 they had foiled a plan to blow up trans-atlantic planes using liquid explosives.

Immediately, airports across Europe and the United States tightened security: passengers were banned from taking liquids or hand luggage on board and travellers were rigorously checked. Some of those measures were later relaxed.

Baum said such actions, which caused airport chaos, flight delays and cancellations, were unnecessary and ineffective.

“The existing technologies have been proven to have limited effectiveness,” he told Reuters. “They haven’t as yet identified anybody who has been carrying an improvised explosive device on their person or in their baggage, whereas profiling has been proven to be effective.”

This is all prior to boarding and I don’t disagree with any of it. Once people are on board more changes are necessary. All alternatives should be investigated.

As I have been saying for years current airport security doesn’t and probably can’t possibly work. Here are some other peoples thoughts on the topic:

• New Airline Security Rules (be sure and read the comments)
• Threat modeling airplane explosive detection
• Bruce Schneier points out knives and guns are built in prisons so how can we hope to keep them off of airplanes?
• Gaping holes in airport security

It’s time to investigate alternatives. Even scrapping the existing system entirely and taking all that money and investing it in intelligence and police work would be an improvement.