[House Hearing, 118 Congress]
[From the U.S. Government Publishing Office]



         IDENTITY MANAGEMENT INNOVATION: LOOKING BEYOND REAL ID

=======================================================================

                                HEARING

                               before the

                            SUBCOMMITTEE ON
                  TRANSPORTATION AND MARITIME SECURITY

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED EIGHTEENTH CONGRESS

                             FIRST SESSION

                               __________


                            DECEMBER 5, 2023

                               __________


                           Serial No. 118-42

                               __________

       Printed for the use of the Committee on Homeland Security
                                     




                 [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]


                                     

        Available via the World Wide Web: http://www.govinfo.gov

                               __________


                 U.S. GOVERNMENT PUBLISHING OFFICE

56-715 PDF                WASHINGTON : 2024










                     COMMITTEE ON HOMELAND SECURITY

                 Mark E. Green, MD, Tennessee, Chairman

Michael T. McCaul, Texas             Bennie G. Thompson, Mississippi, 
Clay Higgins, Louisiana                  Ranking Member
Michael Guest, Mississippi           Sheila Jackson Lee, Texas
Dan Bishop, North Carolina           Donald M. Payne, Jr., New Jersey
Carlos A. Gimenez, Florida           Eric Swalwell, California
August Pfluger, Texas                J. Luis Correa, California
Andrew R. Garbarino, New York        Troy A. Carter, Louisiana
Marjorie Taylor Greene, Georgia      Shri Thanedar, Michigan
Tony Gonzales, Texas                 Seth Magaziner, Rhode Island
Nick LaLota, New York                Glenn Ivey, Maryland
Mike Ezell, Mississippi              Daniel S. Goldman, New York
Anthony D'Esposito, New York         Robert Garcia, California
Laurel M. Lee, Florida               Delia C. Ramirez, Illinois
Morgan Luttrell, Texas               Robert Menendez, New Jersey
Dale W. Strong, Alabama              Yvette D. Clarke, New York
Josh Brecheen, Oklahoma              Dina Titus, Nevada
Elijah Crane, Arizona

                      Stephen Siao, Staff Director
                  Hope Goins, Minority Staff Director
                       Sean Corcoran, Chief Clerk

                                 ------                                

          SUBCOMMITTEE ON TRANSPORTATION AND MARITIME SECURITY

                  Carlos A. Gimenez, Florida, Chairman

Clay Higgins, Louisiana              Shri Thanedar, Michigan, Ranking 
Nick LaLota, New York                    Member
Laurel M. Lee, Florida               Donald M. Payne, Jr., New Jersey
Mark E. Green, MD, Tennessee (ex     Robert Garcia, California
    officio)                         Bennie G. Thompson, Mississippi 
                                         (ex officio)

                  Vacancy, Subcommittee Staff Director
           Alex Marston, Minority Subcommittee Staff Director










                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Carlos A. Gimenez, a Representative in Congress 
  From the State of Florida, and Chairman, Subcommittee on 
  Transportation and Maritime Security:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable Shri Thanedar, a Representative in Congress From 
  the State of Michigan, and Ranking Member, Subcommittee on 
  Transportation and Maritime Security:
  Oral Statement.................................................     4
  Prepared Statement.............................................     5
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security:
  Prepared Statement.............................................     6

                               Witnesses

Mr. Ian Grossman, President and CEO, The American Association of 
  Motor Vehicle Administrators:
  Oral Statement.................................................     7
  Prepared Statement.............................................     9
Mr. Jeremy Grant, Coordinator, Better Identity Coalition:
  Oral Statement.................................................    11
  Prepared Statement.............................................    14
Mr. Hal Wiediger, Senior Vice President, Client Success, Identity 
  & Security North America, Idemia:
  Oral Statement.................................................    18
  Prepared Statement.............................................    20
Mr. Jay Stanley, Senior Policy Analyst, Speech, Privacy, and 
  Technology Project, American Civil Liberties Union:
  Oral Statement.................................................    21
  Prepared Statement.............................................    23










 
         IDENTITY MANAGEMENT INNOVATION: LOOKING BEYOND REAL ID

                              ----------                              


                       Tuesday, December 5, 2023

             U.S. House of Representatives,
                    Committee on Homeland Security,
                        Subcommittee on Transportation and 
                                         Maritime Security,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 3:08 p.m., in 
room 310, Cannon House Office Building, Hon. Carlos A. Gimenez 
[Chairman of the subcommittee] presiding.
    Present: Representatives Gimenez, Higgins, LaLota, Lee, and 
Thanedar.
    Also present: Representative Foster.
    Mr. Gimenez. The Committee on Homeland Committee, 
Subcommittee on Transportation and Maritime Security will come 
to order.
    Without objection, the Chair may declare the subcommittee 
in recess at any point. Today's hearing will examine the status 
and challenges of identity management in the United States with 
a focus on the implementation of REAL ID.
    I now recognize the Ranking Member, the gentleman from 
Michigan, Mr. Thanedar, for the purposes of seeking unanimous 
consent.
    Mr. Thanedar. Thank you, Mr. Chair.
    I ask unanimous consent that Mr. Foster be permitted to sit 
with the subcommittee and question today's witnesses, please.
    Mr. Gimenez. So ordered.
    I now recognize myself for an opening statement.
    American identity management is fundamentally fractured. 
The REAL ID Act of 2005 was passed in response to September 11. 
The goal of the Act was to address the fact that hijackers were 
able to fraudulently obtain State drivers' licenses, and 
thereby enable their heinous acts of terrorism.
    Congress decided that there needed to be security standards 
for States when it came to identity documents.
    Eighteen years later, approximately 52 percent of the 
American population possess a driver's license that is REAL ID-
compliant. That means 48 percent do not. Only 4 States require 
REAL ID, which leaves 46 States and 5 American territories that 
provide non-REAL IDs as an option.
    The problem comes to a head on May 7, 2025. On this date, 
if you do not have a REAL ID, you will not be able to fly in 
the United States unless you happen to have a passport, a 
Global Entry card, or some other sort of Government-issued ID 
that is approved for air travel. Suffice it to say that May 7, 
2025, we're going to encounter utter mayhem at our airports.
    Since 2005, the Department of Homeland Security has awarded 
over $263 million in grant funding to assist in enhancements to 
driver's licenses. While this money has enabled individual 
States to update their processes, the REAL ID efforts have come 
in behind schedule and over budget.
    While all States are now offering REAL ID-compliant 
licenses, there's more work to be done to raise awareness and 
REAL ID adoption.
    Yesterday, I had the chance to meet with our Transportation 
Security Administration, which is now overseeing REAL ID 
efforts, given DHS headquarters' mismanagement of this 
important initiative since the beginning.
    In 2020, TSA took over REAL ID management and Congress 
passed the REAL ID Modernization Act, providing streamlined and 
innovative enhancements to REAL ID requirements. Since then, 
the work has expanded and become somewhat more efficient.
    Furthermore, the TSA's identity management team has sought 
to look beyond physical identity documents and engage the 
digital realm, bringing together experts from the National 
Institute of Standards and Technology, technology companies, 
and banks, to conceptualize the future of digital identity in 
the United States.
    I applaud these efforts, but I'm concerned that this is a 
bigger effort than just one agency and one department. It 
requires a whole-of-Government approach and leadership from the 
highest levels.
    Sadly, every American knows somebody or has themselves been 
a victim of identity theft. This year alone, the Identity Theft 
Resource Center recorded more than 2,800 data-breach notices, 
which included over 273 million individuals. The total 
financial losses for Americans is over $10 billion.
    The average cost for U.S. driver's licenses on the black 
market is between $150 and $200. The average cost of a Social 
Security number is worth only a few pennies. In other words, 
Social Security numbers are easy to forge and not a very secure 
way to identify yourself.
    There's also a darker side to identity theft. The Identity 
Theft Resource Center reports that 16 percent of identity crime 
victims contemplated suicide this past year due to the impact 
of their stolen identity.
    Simply put, this issue is about more--more than simply 
getting a driver's license. I firmly believe our current 
identity management challenges are solvable and provide us with 
an opportunity. However, it will require hard work.
    We need to fix the current problems by devaluing the stolen 
identity data of Americans that is already out in the open so 
that criminals cannot so easily leverage American identities 
for nefarious purposes. We must take a hard look at how we can 
protect future American identity by providing new ways to prove 
that you are, in fact, who you say you are--such as new mobile 
driver's licenses that are a digital counterpart to plastic ID 
cards and that can be used not only in person but also on-line.
    When it comes to the future of identity, Americans are 
rightly skeptical and concerned about privacy and civil 
liberties, especially the collection of biometric data. This is 
why in today's hearings we will draw the important distinction 
between biometric verification processes versus biometric 
recognition.
    As usual, the private sector has had solutions to identify 
management for decades, though, because the Government is the 
only authoritative issuer of identity, there are limitations on 
what the industry alone can deliver.
    We have with us today a panel of experts in the industry 
that have been involved in this discussion since the beginning 
of these discussions.
    The American people deserve a robust discussion about the 
time line of events, and how it is that we landed here 18 years 
after the passage of the REAL ID Act with even greater 
challenges than we had before.
    I look forward to the discussion and the solutions that are 
offered.
    [The statement of Chairman Gimenez follows:]
                Statement of Chairman Carlos A. Gimenez
    American identity management is fundamentally fractured.
    The REAL ID Act of 2005 was passed in response to September 11.
    The goal of the Act was to address the fact that the hijackers were 
able to fraudulently obtain State drivers' licenses and thereby enable 
their heinous act of terrorism.
    Congress decided that there needed to be security standards for 
States when it came to identity documents.
    Eighteen years later, approximately 52 percent of the American 
population possesses a driver's license that is REAL ID-compliant.
    Only 4 States require REAL ID, which leaves 46 States and 5 
American territories that provide non-REAL ID's as an option.
    The problem comes to a head on May 7, 2025. On this date, if you do 
not have a REAL ID, you will not be able to fly in the United States, 
unless you happen to have a Passport, Global Entry card, or some sort 
of other Government-issued ID that is approved for air travel.
    Suffice to say, on May 7, 2025, we are going to encounter utter 
mayhem at our airports.
    Since 2005, the Department of Homeland Security has awarded over 
263 million dollars in grant funding to assist in enhancements to 
driver's licenses.\1\
---------------------------------------------------------------------------
    \1\ Minimum Standards for Driver's Licenses and Identification 
Cards Acceptable by Federal Agencies for Official Purposes; Extending 
Enforcement Date, FEDERAL REGISTER (2023), https://
www.federalregister.gov/documents/2023/03/09/2023-04496/minimum-
standards-for-drivers-licenses-and-identification-cards-acceptable-by-
federal-agencies-for (last visited Dec 1, 2023).
---------------------------------------------------------------------------
    While this money has enabled individual States to update their 
processes, the REAL ID efforts have come in behind schedule and over 
budget. While all States are now offering REAL ID-compliant licenses, 
there is more work to be done to raise awareness and REAL ID adoption.
    Yesterday, I had the chance to meet with our Transportation 
Security Administration, which is now overseeing REAL ID efforts given 
DHS headquarters' mismanagement of this important initiative since the 
beginning.
    In 2020, TSA took over REAL ID management and Congress passed the 
REAL ID Modernization Act, providing streamlined and innovative 
enhancements to REAL ID requirements. Since then, the work has expanded 
and become more efficient.
    Furthermore, the TSA's identity management team has sought to look 
beyond physical identity documents and engage the digital realm--
bringing together experts from the National Institute of Standards and 
Technology, technology companies, and banks to conceptualize the future 
of digital identity in the United States.
    I applaud these efforts but am concerned that this is a bigger 
effort than just one agency in one department--it requires a whole-of-
Government approach and leadership from the highest levels.
    Sadly, every American knows somebody or has themselves, been a 
victim of identity theft.
    This year alone, the Identity Theft Resource Center recorded more 
than 2,800 data breach notices which included over 273 million 
individuals.
    Total financial losses for Americans was over $10 billion.
    The average cost for a U.S. driver's license on the black market is 
between $150 and $200.
    The average cost of a social security number is worth only a few 
pennies.
    In other words, social security numbers are easy to forge and not a 
very secure way to identify yourself.
    There's also a darker side to identity theft.
    The Identity Theft Resource Center reports that 16 percent of 
identity crime victims contemplated suicide the past year due to the 
impact of their stolen identity.
    Simply put: this issue is about more than simply getting a driver's 
license.
    I firmly believe our current identity management challenges are 
solvable and provide us with an opportunity.
    However, it will require hard work.
    We will need to fix the current problem by devaluing the stolen 
identity data of Americans that is already out in the open so that 
criminals cannot so easily leverage American identities for nefarious 
purposes.
    And we must take a hard look at how we can protect future American 
identities by providing new ways to prove that you are--in fact--who 
you say you are, such as new mobile driver's license that are a digital 
counterpart to plastic ID cards and that can be used not only in person 
but also on-line.
    When it comes to the future of identity, Americans are rightly 
skeptical and concerned about privacy and civil liberties--especially 
the collection of biometric data.
    This is why in today's hearing we will draw the important 
distinction between biometric verification versus biometric 
recognition.
    As usual, the private sector has had solutions to identity 
management for decades. Though, because Government is the only 
authoritative issuer of identity, there are limitations on what 
industry alone can deliver.
    We have with us today a panel of experts in the industry that have 
been involved in this discussion since the beginning of these 
discussions.
    The American people deserve a robust discussion about the time line 
of events and how it is that we landed here--18 years after the passage 
of the REAL ID Act--with even greater challenges than we had before.
    I look forward to the discussion and the solutions that are 
offered.

    Mr. Gimenez. I now recognize the Ranking Member, the 
gentleman from Michigan, Mr. Thanedar, for his opening 
statement.
    Mr. Thanedar. Good afternoon.
    Thank you, Chairman Gimenez, for calling today's hearing 
and thank you to our witnesses for sharing your expertise.
    A record number of passengers are traveling through 
Transportation Security Administration security checkpoints 
with TSA, recently screening a record 2.9 million people in a 
single day. TSA is charged with verifying the identities of 
each and every passenger entering a checkpoint and ensuring 
each passenger receives the appropriate level of screening 
based on the risk that they pose.
    As TSA approaches the deadline for requiring passengers to 
show REAL ID-compliant identification in May 2025, the agency 
must enhance public awareness efforts to ensure all passengers 
have compliant IDs.
    Our crowded aviation system cannot afford the challenge and 
the chaos of thousands of thousands of passengers arriving to 
TSA checkpoints without acceptable identification. Recently, 
TSA has begun piloting next-generation technologies for 
managing and verifying identities.
    In 8 States, passengers can now use mobile driver's 
licenses to access screening checkpoints, and in 25 locations, 
TSA's using facial recognition technology to match passengers 
to their IDs. Digital IDs and facial recognition technology 
both offer the potential for security enhancements and 
convenience, but the potential downsides are grave.
    TSA must prioritize protections for privacy, civil rights, 
civil liberties, and even to an extent, extreme degree. TSA's 
efforts to advance these technologies may set the standard for 
other sectors. So TSA must go out of its way and take the time 
to do the things the right way.
    TSA seems to be in a hurry to fast-forward into the future 
with these technologies, even as it allows vulnerabilities 
within existing identity verification process to persist.
    Last year, TSA notified Congress of security incidents that 
have occurred within the Registered Traveler Program operated 
by Clear. The program has allowed some travelers to enter 
security checkpoints using fraudulent identity. In one 
instance, an individual picked up a boarding pass out of a 
trash can and was able to use it to go through screening 
because a Clear employee falsely told TSA they had verified the 
individual's identity.
    Addressing these vulnerabilities does not require any 
futuristic technology or creative solutions. It simply requires 
TSA to stop outsourcing identity verification functions to a 
corporation seeking to make profit.
    Vetting and verifying passenger identities are inherently 
Governmental functions. For nearly a year, Ranking Member 
Thompson has been calling for TSA to require all passengers to 
go through TSA's own identity verification processes. TSA could 
mandate such a requirement today.
    I urge TSA to spend a little less time fast-forwarding into 
the future, and instead, focus on addressing security 
vulnerabilities that threaten the aviation system today.
    I look forward to hearing from our witnesses on these 
critical topics.
    Chairman Gimenez, I thank you for our witnesses again.
    I yield back.
    [The statement of Ranking Member Thanedar follows:]
               Statement of Ranking Member Shri Thanedar
                            December 5, 2023
    Record numbers of passengers are traveling through Transportation 
Security Administration security checkpoints, with TSA recently 
screening a record 2.9 million people in a single day. TSA is charged 
with verifying the identity of each and every passenger entering a 
checkpoint and ensuring each passenger receives the appropriate level 
of screening based on the risk they pose.
    As TSA approaches the deadline for requiring passengers to show 
REAL ID-compliant identification in May 2025, the agency must enhance 
public awareness efforts to ensure all passengers have compliant IDs. 
Our crowded aviation system cannot afford the chaos of thousands of 
passengers arriving to TSA checkpoints without acceptable 
identification.
    Recently, TSA has begun piloting next-generation technologies for 
managing and verifying identities. In 8 States, passengers can now use 
mobile driver's licenses to access screening checkpoints. And in 25 
locations, TSA is using facial recognition technology to match 
passengers to their IDs. Digital IDs and facial recognition technology 
both offer the potential for security enhancements and convenience--but 
the potential downsides are grave.
    TSA must prioritize protections for privacy, civil rights, and 
civil liberties, even to an extreme degree. TSA's efforts to advance 
these technologies may set the standard for other sectors--so TSA must 
go out of its way and take the time to do things the right way. TSA 
seems to be in a hurry to fast forward into the future with these 
technologies, even as it allows vulnerabilities within existing 
identity verification processes to persist.
    Late last year, TSA notified Congress of security incidents that 
have occurred within the Registered Traveler program operated by CLEAR. 
This program has allowed some travelers to enter security checkpoints 
using fraudulent identities. In one instance, an individual picked a 
boarding pass out of a trash can and was able to use it to go through 
screening because a CLEAR employee falsely told TSA they had verified 
the individual's identity.
    Addressing these vulnerabilities does not require any futuristic 
technology or creative solution; it simply requires TSA to stop 
outsourcing identity verification functions to a corporation seeking to 
make a profit. Vetting and verifying passenger identities are 
inherently Governmental functions. For nearly a year, Ranking Member 
Thompson has been calling for TSA to require all passengers to go 
through TSA's own identity verification processes. TSA could mandate 
such a requirement today.
    I urge TSA to spend a little less time fast-forwarding into the 
future and instead focus on addressing security vulnerabilities that 
threaten the aviation system today.

    Mr. Gimenez. Thank you, Ranking Member.
    Other Members of the committee are reminded that opening 
statements may be submitted for the record.
    [The statement of Ranking Member Thompson follows:]
             Statement of Ranking Member Bennie G. Thompson
                            December 5, 2023
    The title of this hearing references ``Looking Beyond REAL ID''--
but in my opinion, we should not be focusing on the future of identity 
management until we address the glaring vulnerabilities present at 
security checkpoints today.
    Last December, TSA informed the committee of security incidents 
that have occurred within the Registered Traveler program. As carried 
out by the private sector, the Registered Traveler program has allowed 
some passengers to enter security checkpoints using fraudulent 
identities. In at least one known instance, the Registered Traveler 
program allowed a passenger to enroll in its program using a fake ID.
    In another case, a passenger found a boarding pass in an airport 
trash can, and a private-sector employee escorted the passenger into 
the security checkpoint without verifying their identity. Enough is 
enough. TSA must act to close these critical security gaps and regain 
control of identity verification. Vetting and verifying passenger 
identities is a core layer of TSA's approach to security. It should be 
carried out by Federal employees who are trained to a rigorous 
standard--not outsourced to a private company seeking to profit off the 
inconvenience of security screening.
    For the past year, I have called on TSA to require all passengers 
to go through TSA's identity verification processes. But instead of 
acting to address existing vulnerabilities that place travelers at risk 
every day, TSA has focused on developing next-generation technologies 
like digital IDs and facial recognition. These technologies are trendy, 
and they may offer some security and convenience benefits, but they 
also pose significant risks to privacy, civil rights, and civil 
liberties. Racial biases of some facial recognition algorithms have 
been well-documented.
    Though TSA has put its technologies through testing to prevent 
against bias, mass deployment of facial recognition threatens to 
normalize technology that could be easily abused in sectors not subject 
to such testing standards. Similarly, because of the breadth of TSA's 
operations, which screen millions of passengers each day, the agency's 
adoption of digital ID standards may drive the future of the identity 
industry. TSA must act responsibly to prioritize privacy protections 
above small improvements to passenger convenience.
    I also remain concerned that TSA is ill-prepared to enforce 
requirements for passengers to present REAL ID-compliant identification 
at TSA checkpoints. Though the current deadline for enforcement is not 
until May 2025, TSA must act now to push for increased REAL ID adoption 
rates to avoid major disruptions at checkpoints.

    Mr. Gimenez. Again, I am pleased to have a distinguished 
panel of witnesses before us today on this critical topic. I 
ask that our witnesses please rise and raise their right hands.
    Do you solemnly swear the testimony you will give before 
the Committee on Homeland Security of the U.S. House of 
Representatives will be the truth, the whole truth, and nothing 
but the truth, so help you God?
    Let the record reflect that the witnesses have answered in 
the affirmative.
    Thank you, and please be seated.
    I will now like to formally introduce our witnesses. Ian 
Grossman serves as president and CEO of the American 
Association of Motor Vehicle Administrators.
    Jeremy Grant serves as the coordinator for the Better 
Identity Coalition.
    Hal Wiediger serves as the senior vice president of Client 
Success at IDEMIA.
    Jay Stanley serves as senior policy analyst at the American 
Civil Liberties Union.
    I thank each of our witnesses for being here today.
    I now recognize Ian Grossman for 5 minutes to summarize his 
opening statement.

  STATEMENT OF IAN GROSSMAN, PRESIDENT AND CEO, THE AMERICAN 
          ASSOCIATION OF MOTOR VEHICLE ADMINISTRATORS

    Mr. Grossman. Thank you, Mr. Chairman, Mr. Ranking Member, 
Members of the committee. Thank you for the opportunity to 
appear before you today and discuss this important issue of the 
future of identity management.
    The American Association of Motor Vehicle Administrators, 
or AAMVA, is a nonprofit organization representing motor 
vehicle agencies and jurisdictional highway safety law 
enforcement.
    In plain speak, our association's primary members are the 
State DMVs and the State police throughout the United States 
and Canada. We enable collaboration to ensure safe drivers, 
safe vehicles, secure identities, all together to save lives.
    When first contemplated, driver's licenses were issued 
solely to indicate a person as having been granted the legal 
authority to operate a motor vehicle. Now the driver's license 
has become the de facto primary identity document in the United 
States. It serves as a document of choice for public services, 
financial institutions, and other entities seeking identity 
assurance.
    Americans use their State driver's license or 
identification card in countless everyday activities including 
making age-limited purchases, entering schools, visiting 
doctor's offices, and, of course, boarding an airplane.
    This is why driver licensing agencies has become the 
foremost trusted authority in identifying whether people are 
who they claim to be.
    As we live through the age of digital transformation, 
rapidly evolving in a post-COVID world of touchless 
transactions, it comes as no surprise that your driver's 
license is being transitioned to an electronic format. This 
improvement is the mobile driver's license, or MDL.
    The MDL is the future of licensing and proof of identity. 
In MDL, the driver's license hosts it on mobile device with the 
capability of being updated in real time. It contains the same 
data used to produce a physical license. However, MDL data is 
securely transmitted to a relying party's reader.
    The MDL is a significant advancement over physical 
credentials, which can easily be lost or stolen, become 
damaged, become outdated as information changes, or offer too 
much information. Unlike a physical credential which can easily 
be replicated by counterfeiters, the MDL offers a completely 
touchless transaction with selective information release, data 
protection, and so much more.
    The physical credential is limited by being a snapshot in 
time. The information it represents may change. But, once 
produced, it cannot be updated until it is reissued. Reissuance 
typically occurred infrequently, sometimes only after many 
years.
    Additionally, with a physical credential, the person 
inspecting the credential may be forced to draw conclusions 
about the validity of the document based on a visual 
examination. By comparison, a relying party authenticating an 
MDL, using a reader, will immediately know that the MDL was 
issued by a bona fide issuing authority, it was issued to the 
person presenting it, and the data is no more than 90 days old.
    Currently, to have adequate inspection of a physical 
credential, a relying party has to have extensive knowledge of 
security features or have tools to confirm that the security 
features are included in the correct places on the credential.
    In the case of an MDL, the authentication process can 
happen seamlessly behind the scenes so the relying party does 
not need to know what security features are part of the MDL. 
They only need to possess the public key, the encrypted public 
key which is used to authenticate the MDL, and if 
authenticated, the data is transmitted and displayed to the 
relying party. Without the authentication, no data is sent, 
protecting the credential holder's data and protecting the 
relying party from fraud.
    In the future, State driver licensing agencies will each 
publish their own public key. To support this, AAMVA has 
developed a Digital Trust Service to provide relying parties a 
trusted, central site to obtain all issuing authorities' 
public-issuing certificates.
    AAMVA's primary focus has been developing international 
standards and supporting early adopters of the process of 
issuing MDLs. However, regular interaction with relying parties 
will be critical in the future of identity management MDL 
proliferation. Educating and onboarding those who seek to 
access the data in the MDL must be prioritized.
    We urge Congress to consider investments critical to 
establishing these trust networks. This can include grant 
awards to States who invest in the foundational systems that 
support mobile driver's licenses or the expansion of identity 
transaction architecture.
    I appreciate your time and the opportunity to testify. In 
the realm of digital identity administration, the primary goal 
of State licensing agencies remains the preservation of 
identity as integrity as a public good by continuing for the 
DMVs to be the most secure, trusted, privacy-preserving, and 
convenient source of that identity.
    Thank you again for the time today, the commitment to this 
conversation, and I look forward to your questions. Thank you.
    [The prepared statement of Mr. Grossman follows:]
                   Prepared Statement of Ian Grossman
                            December 5, 2023
    Chairman Gimenez, Ranking Member Thanedar, thank you for the 
opportunity to submit testimony on the important issue of identity 
management innovation and the future of identity credentialing.
    The American Association of Motor Vehicle Administrators (AAMVA) is 
a tax-exempt, nonprofit organization that develops model programs in 
motor vehicle administration, law enforcement, and highway safety. The 
association also serves as an information clearinghouse in these areas. 
Founded in 1933, AAMVA represents the State and provincial officials in 
the United States and Canada who administer and enforce motor vehicle 
laws. AAMVA's programs encourage uniformity and reciprocity among the 
States and provinces.
    Since the advent of the driving credential, State driver licensing 
agencies have worked diligently to find effective ways to connect an 
individual's driving record to a specific individual. Because roadway 
safety is critical to the Nation's overall public safety, State driver 
licensing agencies have consistently sought to solve a complex issue--
ensuring that the person is who they say they are. This seemingly 
simple, yet critical and highly technical question, is the foundation 
of States' efforts in identity management.
    AAMVA members serve at the critical nexus of public safety and law 
enforcement by working to reach the goal of ``one driver, one license, 
one record'' for every individual operating a motor vehicle in the 
United States. What began simply as credential displaying a legal 
authorization to operate a motor vehicle has evolved over time to the 
becoming the de facto identity document. It is the State-issued 
driver's license and identity card that serves as the access document 
of choice for State services, financial institutions, and other 
entities seeking identity assurance.
    To support our members' evolving role in identity management, AAMVA 
provides guidance, standards, and best practices for the vetting of 
identities and issuance of a secure and interoperable identity 
credential. AAMVA is expanding members support with the fundamental 
understanding that identity management is not a commodity but the 
conveyance of a public benefit.
    The development of future credentialing cannot be performed in a 
vacuum. AAMVA is part of both national and international bodies that 
develop standards defining the identity ecosystem. AAMVA has provided 
leadership in the work within the bodies of the International 
Organization for Standardization's (ISO) which is responsible for the 
development and maintenance of the Personal Identification--ISO 
Compliant Driving Licenses international standard (18013) establishing 
guidelines in the format and content of motor vehicle driver licenses 
(DLs). AAMVA published and maintains the DL/ID Card Design Standard 
which localizes the international standard for use by North American 
jurisdictions. These documents create a common basis for international 
use and recognition of driver's licenses and identity cards across 
State and international borders.
    The most recent addition to the ISO 18013 standard is the Mobile 
Driving License (mDL) Application. This part provides the interface and 
data model requirements for safe, secure, trusted, and interoperable 
mobile driving licenses and IDs. AAMVA drafted the functional 
requirements that were used as a basis for the published standard and 
has served as convenor of the ISO working group for many years.
    The development of new standards in the identity space has been 
spurred by drastic technology change. As the world continues to become 
more technologically enabled and interactions shift toward digital 
channels, there is an obvious need for advancement of Government-grade 
identity management to address these new domains. It is becoming 
increasingly clear that the future of identity management lies in the 
credential's ability to be integrated onto a mobile device. It is for 
this reason that AAMVA and its membership have been thought leaders in 
transitioning the credential to a mobile driver's license, or mDL, 
platform. Within the realm of digital identity administration, the 
primary goal of issuing authorities remains the preservation of 
identity integrity as a public good by continuing to be its most 
secure, trusted, privacy-preserving, and convenient source.
    The mDL is the future of licensing and proof of identity. An mDL is 
a driver's license that is provisioned to a mobile device with the 
capability to be updated in real time. It is comprised of the same data 
elements that are used to produce a physical driver's license, however, 
the data is transmitted electronically to a relying party's reader 
device and authenticated.
    The mDL is a significant improvement over physical credentials 
which can easily be lost or stolen, become damaged, become outdated as 
information changes, offer too much information (including personally 
identifiable information not related to specific transactions), and 
more easily be replicated by counterfeiters. The mDL offers safe, 
secure, and trustable technologies that allow for completely touchless 
transactions, selective information release, data protection, and so 
much more. The mDL operates on the premise that the identity's owner is 
always in full control of what data is shared with the option of only 
providing those data elements (such as age) that are necessary for that 
particular use case.
    A physical credential represents a snapshot in time. It is a 
credential subject to change with no faculty for updating the 
credential once it has been issued until it is reissued, revoked, or 
modified (sometimes over the course of many years). Additionally, with 
a physical credential, the person inspecting the credential may be in a 
situation where they are making assumptions on the validity of the 
physical document by the very nature of visual examination. When the 
relying party authenticates an mDL using a reader, they immediately 
know that the mDL was issued by a bona fide issuing authority, was 
issued to the person with whom they are transacting, was issued to that 
specific holder's device, that the data is less than 30-90 days old, 
and that the data hasn't changed since it was provisioned to their 
device.
    Currently, for a relying party (or end-user) to adequately inspect 
a physical document's validity, they must meet complex conditions. They 
need intricate knowledge of security features the State uses on the 
credential, and they need the tools to confirm that the exact same 
security features are included in the document in the places they need 
to be. In the case of an mDL that authentication happens seamlessly 
behind the scenes, so the relying party does not have to know what 
security features are part of the mDL--all they need is the public key. 
The public key is used to authenticate the mDL data on the device, and 
if authenticated, the data is displayed on the relying party's device. 
If the data doesn't authenticate, no data renders for the relying 
party, protecting the credential holder's data.
    The process of authenticating a digital identity credential 
includes the technical trust point of relying party possessing an 
issuing authority's public key certificate. In a future environment 
where many issuing authorities (State driver licensing agencies) are 
each publishing their own public key certificate, it will be 
challenging for relying parties to obtain and trust all the issuing 
authorities' public key certificates. AAMVA's work in the mDL 
environment includes the development of a ``Digital Trust Service'' 
(DTS). The established AAMVA DTS collects public key certificates from 
vetted issuing authorities and ensures each key and the corresponding 
mDL product meets minimum international standards. The DTS aggregates 
the public keys so relying parties can easily access them in a singular 
and trusted location. The DTS provides validation that the State is a 
vetted issuing authority, validation that they are creating and 
maintaining their public and private keys per industry standards and 
comply with the ISO 18013-5 interoperability standard. Without the 
assurance of 18013-5 standard compliance, the credential may not be 
interoperable, the customer is not ensured control of their data, and 
there is no certainty that the mDL adheres to appropriate privacy 
protections.
    While AAMVA anticipates the mDL will eventually be used as a 
singular identity credential, we recognize for the immediate future 
both the physical card and the mDL must coexist for redundancy and 
operationally significant reasons. This includes the lack of available 
readers in all situations, including potential law enforcement 
interactions (or other unanticipated scenarios where a reader is 
absent). For these reasons, the mDL is currently viewed as an extension 
of the physical card rather than an immediate replacement.
    Additionally, AAMVA emphasizes that mDL interaction with relying 
parties will be a critical component in the future of identity 
management. Relying parties represent the other half of the identity 
equation, and in the sensible progression of identity management, the 
education and onboarding of those who seek access to the data 
provisioned on a device must be prioritized. While AAMVA and its 
members continue to work toward common goals in terms of public 
benefits, relying parties must also work collaboratively to fulfill the 
tenants and best practices of identity protection.
    As Congress continues its consideration of the future of identity 
management and its impact on constituent-Government interactions, AAMVA 
emphasizes trust as the determining factor for success. As we seek 
shared solutions on how to best build that trust, AAMVA urges Congress 
to continue studying what the future looks like and consider 
investments that will be critical to establishing trust networks. This 
includes availability of grant awards to States who invest in the 
foundational systems that support mobile driver's license platforms or 
expansion of identity transaction architecture. These investments will 
help ensure that as citizens make the transition to new identity models 
in the very near future, they are reassured that the Government is 
supporting that transition in the best way possible. Just as we have 
seen with traditional driving credentials, the purpose and opportunity 
of identity management extends well beyond the driving credential 
itself.
    AAMVA thanks the subcommittee for the opportunity to testify and 
stands ready to continue the important conversation of how we can help 
further the shared interests of security and identity management.

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]


    Mr. Gimenez. Thank you, Mr. Grossman.
    I now recognize Jeremy Grant for 5 minutes to summarize his 
opening statement.

    STATEMENT OF JEREMY GRANT, COORDINATOR, BETTER IDENTITY 
                           COALITION

    Mr. Grant. Chairman Gimenez, Ranking Member Thanedar, 
Members of the committee, I appreciate the opportunity to 
testify today. I'm here on behalf of the Better Identity 
Coalition, an organization that's focused on working with 
policy makers to improve the way that Americans can protect and 
verify their identities when they're on-line. Our members 
include leaders in sectors like financial services, health, 
technology, fintech, payments, and security.
    Our 26 members are united by a common recognition that the 
way we handle digital identity today in the United States is 
broken and by a common desire to see both the public and 
private sectors each take steps to make identity systems work 
better.
    Five years ago, we released a blueprint for policy makers 
on how to improve digital identity infrastructure in America. 
The blueprint highlighted the ways the Government can play a 
role in delivering more secure, inclusive, privacy-preserving 
digital solutions by closing the gap between the nationally-
recognized authoritative credentials that we have here in the 
United States that work in the physical world, driver's 
licenses, passports, and birth certificates--and the lack of 
any digital counterpart to those credentials that can be used 
when Americans need to prove who they are on-line.
    Digital driver's licenses, also known as mobile driver's 
licenses, or MDLs, play a big role in the blueprint by virtue 
of the fact that driver's licenses and State ID cards are, by 
far, the photo ID that's most commonly obtained by people in 
the United States, and are thus the documents that are most 
commonly used to prove one's identity today in the physical 
world.
    We're thrilled to see this subcommittee focusing on the 
issue of digital identity and what is needed beyond the REAL ID 
Act.
    There's five key points we'd like to emphasize today:
    First, when it comes to mobile driver's licenses the 
Government's prioritizing the wrong-use cases. There's 
essentially two core-use cases for digital versions of States' 
driver's licenses and digital ID cards. The first are in-person 
cases such as clearing the TSA security checkpoints or proving 
age at a bar to buy alcohol. This is where you're presenting a 
digital version of a plastic card in your wallet that's instead 
stored on your phone.
    The second is remote or on-line use cases where you need to 
prove who you are on-line, say, to open a bank account or apply 
for Government services. Of these two, the first is a ``nice to 
have,'' while the second addresses a critical cybersecurity 
priority, a wave of identity-related cyber crime that's 
impacting millions of Americans and costing us hundreds of 
billions of dollars each year. This has been documented by 
agencies like FinCEN and the GAO.
    Now, this is not to say there aren't some tangible benefits 
to the in-person use cases. But given what's happening in the 
on-line world, it's time we get our priorities straight.
    Second, our understanding is that the reason DHS and the 
States have been focused on the in-person use cases is because 
work is still on-going in the International Standards 
Organization, known as ISO, to craft a standard for the on-line 
use cases of MDLs. This is a terrible reason for the Government 
to avoid focusing on solving a problem that leads to hundreds 
of billions of dollars in identity-related cyber crime, most of 
it perpetrated by organization crime or hostile nation-states.
    If ISO's moving too slowly, the United States should take 
the lead on creating its own standard and work to advance it in 
ISO, rather than sit back and hope that ISO eventually figures 
it out.
    Now, while DHS does not create standards typically, DHS or, 
even better, the White House or Congress, should request that 
NIST lead an effort to create the standards and guidance needed 
to accelerate the deployment of secure, privacy-protecting MDL 
apps that Americans can use to better protect and assert their 
identity on-line. There's actually a precedent for this here. 
There's a lot of ISO cybersecurity standards that are more or 
less based on work that NIST led first.
    Third, TSA alone should not be in the lead here in that 
there's things that TSA's responsible for with regard to 
identity. But there are a relatively smaller subset of issues 
with regard to the broader set of issues that's at play. It's 
not TSA's mission to ensure a safe and privacy-preserving 
foundation for, say, digital transactions in banking or health 
or Government services.
    While I admire a lot of the work TSA's doing here, 
particularly how their team is taking some very forward-looking 
steps in their proposed draft regulations on MDLs to look ahead 
to maybe solving these other issues, there's just a bigger 
structural issues where TSA's going to be limited in what they 
can accomplish.
    This brings up my fourth point which is that digital 
identity is critical infrastructure and needs to be treated as 
such. DHS said as much in 2019 when it declared identity as one 
of 55 national critical functions defined as those services so 
vital to the United States that disruption, corruption, or 
disfunction would have a debilitating impact on security.
    But compared to the other critical functions in that list, 
identity has gotten scant investment and attention. It's a 
little puzzling that DHS, after calling out digital identity as 
critical function, has then opted to focus so narrowly here as 
it implements the REAL ID Modernization Act of 2020.
    Finally, on that note, the White House could and should 
play a bigger role here by launching a whole-of-Government 
effort to address critical vulnerabilities in our digital 
identity fabric. President Biden actually had language on this 
in the March 2023 National Cybersecurity Strategy. But when the 
implementation plan for that strategy was published in July, it 
inexplicably skipped over the identity section entirely.
    In the wake of that White House inaction, Congress can 
force the issue. There's a bipartisan bill--I know Congressman 
Foster will be here in a bit, who was a lead sponsor--called 
the Improving Digital Identity Act that cleared key House and 
Senate committees last year, but fell just short of package--
short of passage.
    As currently drafted, it falls under jurisdiction of the 
House Oversight Committee and not this committee, but we'd 
welcome the bill to explore ways this committee might be able 
to drive action forward. It was also actually sponsored by 
Democrats and Republicans on this committee.
    I appreciate the opportunity to testify today. Note that I 
have submitted some lengthier testimony for the record, as well 
as a copy of our policy blueprint. I'll look forward to 
answering your questions. Thank you.
    [The prepared statement of Mr. Grant follows:]
                   Prepared Statement of Jeremy Grant
                            December 5, 2023
    Chairman Gimenez, Ranking Member Thanedar, and Members of the 
committee, thank you for the opportunity to testify today.
    I am here on behalf of the Better Identity Coalition--an 
organization focused on working with policy makers to improve the way 
Americans establish, protect, and verify their identities when they're 
on-line.
    Our members include leaders in sectors like financial services, 
health, technology, FinTech, payments, and security. Our 26 members are 
united by a common recognition that the way we handle digital identity 
today in the United States is broken--and by a common desire to see 
both the public and private sectors each take steps to make identity 
systems work better.
    Identity does not always get much attention, but is an important 
topic, in that the way we handle identity in America impacts our 
security, our privacy, and our liberty. From an economic standpoint, 
particularly as we move high-value transactions into the digital world, 
identity can be the ``great enabler''--providing a foundation for 
digital transactions and on-line experiences that are more secure, more 
enjoyable for the user, and ideally, more respectful of their privacy.
    But outdated identity systems enable a set of great attack points 
for criminals and other adversaries, such as hostile nation-states that 
are seeking to steal data and money and compromise American systems. As 
these threats grow--and new systems are put in place to try to guard 
against them--they often create new burdens for consumers, businesses, 
and Government agencies who need to accurately verify identity to 
enable high-value transactions to be delivered on-line.
    Five years ago, the Better Identity Coalition released a 
``Blueprint'' for policy makers on how to improve digital identity 
infrastructure in America. The Blueprint highlighted the ways that 
Government can help deliver more secure, inclusive, privacy-preserving 
digital solutions--by closing the gap between the nationally-
recognized, authoritative credentials that work in the physical world--
like driver's licenses, passports, and birth certificates--and the lack 
of any digital counterpart to those physical credentials that can be 
used when Americans need to prove who they are on-line.
    Why is Government action needed here? Well, at the end of the day, 
Government is the only authoritative issuer of identity in the United 
States. But the identity systems Government administers are largely 
stuck in the paper world, whereas commerce has increasingly moved on-
line. This ``identity gap''--a complete absence of Government-issued 
credentials built to support digital transactions--is being actively 
exploited by adversaries to steal identities, money, and sensitive 
data, and defraud consumers, governments, and businesses alike.
    And while industry has come up with some decent tools to try to get 
around this identity gap, adversaries have caught up with many of them.
    Moreover, with the rise of artificial intelligence (AI) now 
enabling new types of attacks on digital identity (such as cheap and 
highly convincing deepfakes that can fool remote identity verification 
tools), the security and economic risks are more acute than ever. It is 
imperative that the United States develop a strategy to ensure we have 
digital identity infrastructure that can mitigate and stay ahead of 
these threats.
    Indeed most of our peer countries have either created robust 
digital identity infrastructure or has launched a national initiative 
to do so. Each year that passes without a comprehensive initiative to 
prioritize more robust, privacy-preserving digital identity 
infrastructure puts Americans at greater risk than the rest of the 
world and threatens our international competitiveness.
    Going forward, Government will need to take a more active role in 
working with industry to deliver next-generation remote identity 
proofing solutions. This is not about a national ID--and we do not 
recommend that one be created. We already have a number of nationally-
recognized, authoritative Government identity systems--the driver's 
license, the passport, the SSN. But because of the ``identity gap'' 
these systems are stuck in the paper world, while commerce is 
increasingly moving on-line.
    To fix this, America's paper-based systems should be modernized 
around a privacy-protecting, consumer-centric model that allows 
consumers to ask an agency that issued a credential to stand behind it 
in the on-line world--by validating the information from the 
credential.
    Digital driver's licenses--also known as ``mobile'' driver's 
licenses or mDLs--featured prominently in our Blueprint. This is by 
virtue of the fact that driver's licenses and State ID cards are by far 
the photo ID that is most commonly obtained by people in the United 
States, and are thus the documents that are most commonly used to prove 
one's identity today in the physical world.
    The single best way to prevent identity theft and identity-related 
cyber crime is to give Americans tools that they can use to protect 
themselves from identity thieves. mDLs have much to offer here, as they 
can enable Americans to reuse a high assurance credential they already 
have--their driver's license or State ID card--when they need to prove 
who they are on-line for high assurance transactions. And because the 
REAL ID Act of 2005 established a Federal standard for a robust, in-
person identity-proofing process for States to follow, consumers can 
derive significant benefit if REAL ID-compliant driver's licenses are 
enhanced to support digital transactions.
    By binding proof of identity to a digitally-signed mDL app housed 
securely in a smartphone, a mDL can help Americans be better protected 
against identity thieves. And if designed properly, a mDL can offer not 
just better security, but also better privacy and increased convenience 
when Americans need to prove who they are on-line.
    We're thrilled to see this subcommittee focusing in on the issue of 
digital identity and what is needed beyond the REAL ID Act.
    I expect a good deal of this hearing will focus in on the role that 
TSA is playing with regard to mobile driver's licenses and REAL ID. And 
I think it is important to say that I admire the work TSA is doing 
here, at least in regard to the subset of issues around identity that 
are a part of TSA's mission.
    The more important question for this hearing to explore, in my 
view, is whether TSA alone should be in the lead? In that the things 
that TSA cares about with regard to digital identity are a relatively 
small set of issues relative to the broader set of issues at hand.
    There are five key points we would like to emphasize today:
First, when it comes to mobile driver's licenses, the Government is 
        prioritizing the wrong use cases.
    There are essentially two core use cases for digital versions of 
State driver's licenses and ID cards:
   The first is in-person use cases, such as clearing a TSA 
        security checkpoint, or proving age at a bar to buy alcohol. 
        This is where you are presenting a digital version of the 
        plastic card in your wallet that is instead stored on your 
        phone.
   The second is remote or on-line use cases, where you need to 
        prove who you are on-line, say, to open a bank account or apply 
        for Government services.
    Of these two use cases, there are certainly some tangible benefits 
to the in-person applications--I discuss those later in my testimony--
but viewed against the backdrop of a wave of identity-related cyber 
crime that is costing Americans hundreds of billions of dollars each 
year, the in-person applications look like a ``nice to have.''
    This is because the numbers on the cybersecurity side are 
staggering, and they are impacting many different sectors:
   FinCEN recently revealed that $212 billion in transactions 
        flagged in 2021 Suspicious Activity Reports (SARs) filed by 
        banks were tied to some form of breakdown in the identity 
        verification process.\1\
---------------------------------------------------------------------------
    \1\ https://www.nextgov.com/digital-government/2023/09/212b-
suspicious-activity-reports-fin- cenin-2021-concerned-identity-
officials-report/390279/.
---------------------------------------------------------------------------
   The Government Accountability Office (GAO) reported that 
        between $100-$135 billion in pandemic Unemployment Insurance 
        (UI) benefits was lost to fraud during the pandemic. Funds were 
        stolen both by organized criminals and State-sponsored actors, 
        with compromised identities being used to enable the bulk of 
        the theft.\2\
---------------------------------------------------------------------------
    \2\ https://www.gao.gov/assets/gao-23-106696.pdf.
---------------------------------------------------------------------------
   The Identity Theft Resource Center (ITRC)--a non-profit 
        which helps victims of identity theft--has stated that 2023 is 
        shaping up to be the worst year ever for identity theft and 
        data breaches.
    Why are there so many problems here? As I stated earlier, attackers 
have caught up with many of the ``first-generation tools'' we have used 
to protect, verify, and authenticate identity on-line, to the point 
that it is an anomaly when a major breach happens and some sort of 
identity compromise is not the attack vector. There are many reasons 
for this--but the most important question is: What should Government do 
about it now?
    With nearly $350 billion in identity-related cyber crime documented 
in just two sectors--banking and Government benefits--the deficiencies 
in digital identity infrastructure that enable most of this crime 
should be getting a ton of attention.
    Instead--inexplicably, in my opinion--the U.S. Government has been 
prioritizing the in-person use cases for mDLs while giving little 
attention to the on-line use cases that could address this massive wave 
of identity-related cyber crime.
    This is not to say that the in-person use cases have no value; on 
the contrary, there are notable improvements to security, privacy, and 
convenience that can be delivered by a properly-designed mDL that is 
used for in-person use cases. The ability, for example, to let someone 
share elements of their ID such as age or State of residence on a 
granular basis--without revealing all of the information printed on 
their ID--can improve privacy. Likewise, having digitally-signed data 
in a mDL app can offer security and anti-counterfeiting benefits above 
and beyond the security features that are built into plastic cards. 
However, when weighed against our most pressing problems in digital 
identity, these in-person use cases should not be the lead priority.
    There is some background here worth sharing:
   The initial pilots of mDLs were funded by the National 
        Institute of Standards and Technology (NIST) between 2012-2015, 
        as part of the National Strategy for Trusted Identities in 
        Cyberspace initiative. It's worth sharing here that I ran that 
        program, and served as NIST's Senior Executive Advisor for 
        Identity Management. The pilots were focused on the ways that a 
        mDL could be used to help people when they had to prove who 
        they were on-line for a high-value service like banking or 
        Government benefits.
   However when Congress passed the REAL ID Modernization Act 
        in 2020 to reflect the emergence in the market of mDLs, 
        Congress did not specify which use cases were a priority. The 
        law just more generally directed DHS to update regulations for 
        REAL ID driver's licenses to support digital mDLs. Rather than 
        focus on the applications of mDLs that can prevent identity 
        theft and identity-related cyber crime, DHS instead delegated 
        implementation of the law to TSA, who has largely focused on 
        in-person use cases such as using a mDL to clear a TSA 
        checkpoint.
    One question to consider is if TSA alone should be in charge--
especially when DHS originally led the REAL ID regulations out of its 
policy office back in 2005? We assume DHS made this decision because 
the ``core use case'' for REAL ID that impacts most Americans is 
whether they can use their driver's license to clear a TSA checkpoint.
    However, that's a small subset of the use cases where digital 
identity matters, and many of these use cases are well outside of TSA's 
jurisdiction--among those, the on-line identity use cases that are not 
getting much attention.
Second, our understanding is that the reason DHS and the States have 
        both been focused on in-person use cases is because work is 
        still on-going in the International Standards Organization 
        (known as ISO) to craft a standard for the online use cases of 
        mDLs.
    This is a terrible reason for the Government to avoid focusing on a 
solving a problem that leads to hundreds of billions of dollars in 
identity-related cyber crime and millions of victims of identity theft. 
Indeed, it is hard to think of another security crisis where the 
Government's response has been to say ``let's hold off on solving it 
until the International Standards Organization gets things figured 
out.''
    If ISO is moving too slowly, the United States should take the lead 
on creating its own standard, and work to advance it in ISO rather than 
sit back and hope that ISO eventually figures it out.
    While DHS does not create standards, DHS--or even better, the White 
House or Congress--should request that NIST lead a timeboxed, 1-year 
effort to create the standards and guidance needed to accelerate the 
deployment of secure, privacy-protecting mDL apps that Americans can 
use to protect and assert their identity on-line.
    There is precedent for this here--indeed a number of ISO security 
standards are more or less based on work that NIST led first. For 
example, in 2013, when the Obama administration determined that 
cybersecurity risks had reached a point that Government action was 
urgently needed, President Obama signed an Executive Order that gave 
NIST 1 year to create a Cyber Security Framework (CSF). NIST released 
the CSF in 2014, and it has since become recognized across the globe as 
the preeminent framework for organizations to use to manage cyber risk. 
So much so that ISO then used it as the basis of a ``formal 
international standard,'' leveraging the CSF content as the basis of 
both ISO 27103 and 27110. None of this would have happened without a 
recognition from the U.S. Government that Government action was needed 
here to jumpstart progress.
    Note that NIST has launched a small project here out of its 
National Cybersecurity Center of Excellence (NCCoE) focused on 
developing a reference implementation of the digital identity standard 
in partnership with industry. Some of the Better Identity Coalition's 
members are participating with NIST in this project; NIST has noted 
that outcomes of this project may result in contributions to the ISO 
standard currently being crafted. It's a good project that will help to 
move the ball forward--but bluntly, it's too small and too slow an 
effort relative to what is really needed here to accelerate the rollout 
of robust digital identity infrastructure.
Third, TSA alone should not be in the lead here.
    I do want to complement the TSA team working on this, in that they 
get that there is a bigger set of issues at play beyond the use cases 
directly relevant to TSA's mission, and they have been working with 
NIST and other Government stakeholders. TSA's proposed draft 
regulations here also include some elements dealing with the security 
of how a mDL is provisioned for in-person use cases that can be 
leveraged to also ensure a secure provisioning process for on-line use 
cases--they seem to be looking beyond the use cases that are in their 
scope.
    That said, TSA's mission does not involve ensuring a safe and 
privacy-preserving foundation for digital transactions in banking or 
health or Government services, or other places where Americans might 
have a need for digital ID.
    Nor does it include issues around identity inclusion, such as how 
to help people who might not have a driver's license or other 
Government credential today--and who may not be able to easily get one. 
This is an important point to flag: Roughly 10 percent of adults do not 
have a driver's license or State ID, and in many cases, people lack 
critical identity documents like birth certificates and Social Security 
cards needed to get one. This disproportionately impacts the most 
marginalized communities, including people of color, the elderly, the 
poor, as well as survivors of domestic violence and those reentering 
society after time in prison. As we talk about investing in new digital 
identity tools, it is important to make sure our most vulnerable 
neighbors are not left behind.
    And so while I admire much of the work TSA is doing here--
particularly how their team has taken some very forward-looking steps 
in their proposed draft regulations on mDLs to look ahead to solving 
some of these other issues, there is a bigger structural issue where 
TSA is limited in how much they can accomplish.
    We desperately need to elevate protecting people from ID theft and 
identity-related cyber crime so that it is a national priority, not a 
transportation security priority.
This brings up my fourth key point, which is that digital identity is a 
        critical infrastructure issue and needs to be treated as such.
    DHS said as much in 2019 when it declared identity as one of 55 
``National Critical Functions''--defined as those services ``so vital 
to the U.S. that their disruption, corruption, or dysfunction would 
have a debilitating effect on security.''
    But compared to other critical functions, identity has gotten scant 
investment and attention. And it's a bit puzzling that DHS, after 
calling out digital identity as a critical function, has opted to focus 
so narrowly here as it implements the REAL ID Modernization Act of 
2020.
Finally, on that note, the White House could and should play a bigger 
        role here, by launching a ``whole-of-Government'' effort to 
        address critical vulnerabilities in our ``digital identity 
        fabric.''
    The administration actually had great language on digital identity 
in its March 2023 National Cybersecurity Strategy; Strategic Objective 
4.5 of the Strategy called for the Government to ``Support Development 
of a Digital Identity Ecosystem'' and stated:

``Today, the lack of secure, privacy-preserving, consent-based digital 
identity solutions allows fraud to flourish, perpetuates exclusion and 
inequity, and adds inefficiency to our financial activities and daily 
life. Identity theft is on the rise, with data breaches impacting 
nearly 300 million victims in 2021 and malicious actors fraudulently 
obtaining billions of dollars in COVID-19 pandemic relief funds 
intended for small businesses and individuals in need. This malicious 
activity affects us all, creating significant losses for businesses and 
producing harmful impacts on public benefit programs and those 
Americans who use them. Operating independently, neither the private 
nor public sectors have been able to solve this problem.''

    Of note, the National Cybersecurity Strategy noted the role that 
mDLs could play, encouraging ``a focus on privacy, security, civil 
liberties, equity, accessibility, and interoperability.''
    We agree that all of these are important, and, indeed, essential. 
It is critical as mDLs are emerging that Government defines what 
``good'' looks like with regard to these credentials, and puts a plan 
in place to make sure that we get there--and that we avoid bad outcomes 
that might arise if the architecture for mDLs is not properly designed 
to maximize benefits and minimize any potential harms.
    Unfortunately, when the implementation plan for National 
Cybersecurity Strategy was published in July, it inexplicably skipped 
over the identity section entirely--jumping from Strategic Objective 
4.4. to 4.6, as if the identity objective was never in the Strategy. 
The administration has said that identity might be addressed in future 
versions of the implementation plan, but for now this work has been 
sidelined. That means there is no vision of what ``good'' looks like to 
guide different agencies working on these issues, nor is there any plan 
to address some of the difficult inclusion issues I discussed earlier 
to make sure that we are not leaving anybody behind as we invest in 
better digital identity.
    In the wake of White House inaction, Congress can help to drive 
progress. Last year a bipartisan bill that is based on our Policy 
Blueprint--the Improving Digital Identity Act--cleared the House 
Oversight Committee and the Senate Homeland Security and Governmental 
Affairs Committee (HSGAC), but came up just short of passage. That bill 
has been reintroduced in the Senate and passed the HSGAC in March, and 
is currently awaiting further action. As currently drafted, it falls 
under the jurisdiction of the House Oversight Committee and not the 
Homeland Security Committee, but the bill was sponsored by Democrats 
and Republicans on this committee--former Ranking Member John Katko and 
former Congressman Jim Langevin were original authors of the bill--and 
we'd love to explore ways this committee might be able to drive action 
forward.
    Thank you for the opportunity to testify today. Note that I have 
submitted a copy of the Coalition's Policy Blueprint \3\ for the record 
to augment this testimony; I look forward to answering your questions.
---------------------------------------------------------------------------
    \3\ The Blueprint can be found at https://www.betteridentity.org/s/
Better_Identity_- CoalitionBlueprint-July2018.pdf.

    Mr. Gimenez. Thank you, Mr. Grant.
    I now recognize Hal Wiediger for 5 minutes to summarize his 
opening statement.

   STATEMENT OF HAL WIEDIGER, SENIOR VICE PRESIDENT, CLIENT 
       SUCCESS, IDENTITY & SECURITY NORTH AMERICA, IDEMIA

    Mr. Wiediger. Thank you, Chairman Gimenez and Ranking 
Member Thanedar, for inviting me to this important topic for--
to testify today.
    IDEMIA is on a mission to unlock the world and make it 
safer. IDEMIA provides unique technologies, underpinned by 
long-standing expertise in biometrics, cryptography, data 
analytics, systems, and smart devices that secure billions of 
transactions.
    With 15,000 employees, IDEMIA is trusted by over 600 
governmental organizations, and more than 2,300 enterprises 
spread over 180 countries with an impactful, ethical, and 
socially responsible approach.
    For more than 60 years, IDEMIA has been a trusted partner 
of Government agencies, offering unmatched expertise in 
identity management. We have produced over 1 billion driver's 
licenses in the United States and currently produce driver's 
licenses for 34 States and mobile driver's licenses for 5 
States.
    Additionally, the Transportation Security Administration 
relies on our Credential Authentication Technology, CAT, to 
authenticate and verify and identify millions of travelers 
every day.
    Identity verification is a critical part of the security 
mission of TSA. Our CAT machine helps TSA validate a 
passenger's identity, and provide real-time security data on a 
passenger's vetting status. The newest iteration of this 
technology will enable the use of digital IDs and facial match 
to further increase the security effectiveness of identity 
validation processes.
    As TSA implements the REAL ID mandate, the CAT machine will 
let the officer know if a REAL ID is counterfeit. Digital 
identity solutions provide consumers with unlimited benefits. 
Digital IDs are here today and will be increasingly relied upon 
in the future. Driver's licenses, passports, and other 
credentials can be accessible on our mobile devices, much like 
your credit cards today. This innovation fundamentally changes 
the identity security market, enhancing security and improving 
the customer experience, providing consumers with ultimate 
control over their identity.
    Digital IDs are derived from physical ID and the fidelity 
of the information is tied to how robust the initial proving 
process for the physical ID was. For example, a customer with a 
REAL ID-compliant physical credential has proven both their 
identity and their legal presence in the United States. A 
digital ID derived from a REAL ID-compliant physical credential 
provides the consumer with a digital document that enables them 
to verify both their identity and their legal presence in the 
United States.
    Unlike a physical ID, which can be lost, used by an 
imposter, or presented even if it has been revoked, a digital 
ID can only be unlocked and used by the individual to whom it 
was issued if the issuer allows it to be accessed, 
significantly reducing opportunities for fraud and ensuring 
only you can authorize the use and validation of your identity 
information.
    The use cases for this innovative technology provides 
significant consumer benefits, making it easier for disaster 
victims to file claims, preventing fraudulent transactions, 
enabling customers with accessibility challenges to enroll for 
important services wherever they are, faster provisioning of 
public aid to services to citizens, or creating a frictionless 
experience for travelers. Consumer demand and convenience will 
force ID verification to be digital. Digital identity solutions 
are secure, enhance privacy, and meet robust global standards.
    Like many tools and technology innovations, our technology 
is safe because we and our customers adhere to the highest 
ethical privacy and accuracy standards. We demonstrate our 
leadership and commitment by regularly taking part in tests by 
the National Institute for Standards and Technology, NIST, to 
check how our technology platforms and assess its accuracy to 
ensure it is safe, secure, and accurate.
    The test results confirm IDEMIA'S long-standing expertise 
and demonstrate how advanced our technology is, giving us and 
our customers confidence that they are using proven technology 
that has been tested to ensure both accuracy and fairness.
    However, we also have a role to play in determining who we 
sell our technology to and how our technology is used. Any tool 
in the wrong hands can cause harm. We ensure that our customers 
respect using our technology in a way that aligns with our 
values and makes it safe and easier for people to prove their 
identity in a secure manner that also enhances privacy 
protection.
    For society to unlock this potential, we need a legal and 
regulatory framework that ensures responsible use while also 
enabling and supporting continuous innovations and society 
benefits.
    In closing, we're grateful to work with the fantastic 
partners like the Department of Homeland Security, the 
Transportation Security Administration, the American 
Association of Motor Vehicle Administrators, and advocacy 
groups like The Better Identity Coalition and the American 
Civil Liberties Union.
    Thank you for inviting IDEMIA to engage in this important 
discussion today. We look forward to your questions and 
appreciate an open dialog to discuss digital identity solutions 
and the important benefits they provide society.
    [The prepared statement of Mr. Wiediger follows:]
                       Statement of Hal Wiediger
                            December 5, 2023
                              introduction
    Thank you, Chairman Gimenez and Ranking Member Thanedar, for 
inviting me to testify today on this important topic. IDEMIA is on a 
mission to unlock the world and make it safer. Backed by innovative 
R&D, IDEMIA provides unique technologies, underpinned by long-standing 
expertise in biometrics, cryptography, data analytics, systems, and 
smart devices that secure billions of interactions around the world. 
With 15,000 employees, IDEMIA is trusted by over 600 governmental 
organizations and more than 2,300 enterprises spread over 180 
countries, with an impactful, ethical, and socially responsible 
approach.
    For more than 60 years, IDEMIA has been a trusted partner of 
Government agencies--offering unmatched expertise in identity 
management. We have produced over 1 billion drivers licenses in the 
United States, and currently produce driver's licenses for 34 States, 
and mobile driver's licenses for 5 States. Additionally, the 
Transportation Security Administration relies on our Credential 
Authentication Technology (CAT) to authenticate and verify the identity 
of millions of travelers every day.
Digital Identity Solutions Provide Consumers with Unlimited Benefits
    Digital IDs are already here, and their issuance and adoption will 
only increase in the future. Drivers licenses, passports, and other 
credentials are now accessible on our mobile devices, much like credit 
cards are today. This innovation fundamentally changes the identity 
security market, simultaneously enhancing security and improving the 
customer experience--providing consumers with ultimate control over 
their identity. Digital IDs are derived from a physical credential, and 
the fidelity of information is tied to how robust the initial proofing 
process for the physical credential was.
    For example, a customer with a REAL ID-compliant physical 
credential has proven both their identity and their legal presence in 
the United States. A Digital ID derived from a REAL ID-compliant 
physical credential provides the consumer with a digital document that 
enables them to verify both their identity and their legal presence in 
the United States. Unlike a physical ID which can be lost, used by an 
imposter, or presented even if it has been revoked, a digital ID can 
only be unlocked and used by the individual to whom it was issued, and 
if the issuer allows it to be accessed, significantly reducing 
opportunities for fraud, and ensuring only you can authorize the use 
and validation of your identity information.
    The use cases for this innovative technology are endless and 
provide significant consumer benefits--making it easier for disaster 
victims to file claims, preventing fraudulent transactions, enabling 
customers with accessibility challenges to enroll for important 
services from wherever they are, faster provisioning of public aid and 
services to citizens, or creating a frictionless experience for 
travelers. Consumer demand will force ID verification to be digital 
where it is physical and in-person today.
Digital Identity Solutions Are Secure, Enhance Privacy, and Meet Robust 
        National and International Standards
    Like many tools and technological innovations, our technology is 
safe because we and our customers adhere to the highest ethical, 
privacy, and accuracy standards. We demonstrate our leadership and 
commitment by regularly taking part in tests by the National Institute 
for Standards & Technology (NIST) to check how our technology performs 
and assess its accuracy to ensure it is safe, secure, and effective. 
The test results confirm IDEMIA's long-standing expertise and 
demonstrate how advanced our technology is. This third-party validation 
gives us and our customers confidence that they are using proven 
technology that has been tested to ensure both accuracy and fairness.
    However, we as a company also have a role to play in determining 
who we sell our technology to and how our technology is used. Any tool 
in the wrong hands, can cause harm, and we are very selective to ensure 
that our customers are using our technology in a way that aligns with 
our values and mission to unlock the world and make it safer and easier 
for people to navigate the physical and digital worlds in total 
security. For society to unlock all this potential, we need to ensure 
that we create a legal and regulatory framework that ensures 
responsible use, while also enabling and supporting continuous 
innovation and societal benefits. We are grateful to have fantastic 
partners like the American Association of Motor Vehicle Administrators 
(AAMVA), and advocacy groups like the Better Identity Coalition and the 
American Civil Liberties Union
                                closing
    Thank you for inviting IDEMIA to engage in this important 
discussion today. We look forward to your questions and appreciate an 
open dialog to discuss digital identity solutions and the important 
benefits they provide to society.

    Mr. Gimenez. Thanks, Mr. Wiediger.
    I now recognize Mr. Stanley for 5 minutes to summarize his 
opening statement.

   STATEMENT OF JAY STANLEY, SENIOR POLICY ANALYST, SPEECH, 
PRIVACY, AND TECHNOLOGY PROJECT, AMERICAN CIVIL LIBERTIES UNION

    Mr. Stanley. Chairman Gimenez, Ranking Member Thanedar, and 
Members of the subcommittee, thank you for inviting me to 
testify today. Thank you for your attention to the emerging 
issues around digital IDs.
    Let me start by saying that our immediate concern is that 
the TSA is pushing ahead with a set of digital ID standards 
that aren't ready for prime time. If we are to have a digital 
ID system, it's vital that we take the time to do it right.
    The TSA proposes to incorporate into U.S. regulations an 
MDL standard set by the international standards body, the ISO. 
That standard, which allows for centralized tracking of how we 
use our IDs, was created behind closed doors by a secretive, 
international committee made up of Government agencies, tech 
giants, and for all we know, the Chinese and Russian 
Governments.
    We don't know because, when we ask the ISO for the list of 
who was in the group that wrote this standard, they refuse to 
disclose it. The standard is not even available to the public 
without paying thousands of dollars. That is no way to make 
policy in a democracy on something that will affect us all, as 
Mr. Grant said, will be a piece of our critical infrastructure.
    We're concerned that the TSA appears to be working 
extremely closely with one company, Apple, even for mysterious 
reasons signing over to Apple the agency's patents governing 
the operation of its airport digital ID checkpoints.
    It's also unclear that the TSA has the authority for its 
proposed digital ID plan, and there are larger questions about 
why the TSA with its relatively narrow mission has been 
positioned to determine the shape of the Nation's identity 
system.
    The TSA is pursuing an initiative not important to its 
mission, but that will have wide-spread spillover effects on 
American society. Let me flesh this out by making three overall 
points:
    First, a digital identity system would have far-reaching 
consequences. The idea might sound simple, but the creation of 
a digital ID, especially one that could be used over the 
internet, would be a turning point that could have enormously 
harmful effects. Once it starts to become easy to share your ID 
with the press of a button, the danger is that we start getting 
identity demands from all quarters.
    Want to enter a 7-Eleven? Scan your ID. Want to browse a 
clothing store? Scan your ID. Buy a cup of coffee, park your 
car, scan your ID.
    If we get a digital ID that can be used on-line, we may 
wake one day and find, if you want to watch a video or log on 
to social media or look at a news site, we get a demand to, 
quote, press a button and send us your driver's license.
    There's already far too much tracking that takes place of 
us on-line and polls show that Americans are very uncomfortable 
with it, but that tracking is far from perfect. A digital ID 
could make it inescapable.
    A digital ID system, if not built carefully, could send a 
report back to the Government every time you show your ID, a 
record of every bar, club, casino, bank, and doctor's office 
visits and, once it goes on-line, every website and on-line 
service you use, too. The ISO standard permits this.
    The second point I would like to make is that any digital 
ID system must come with safeguards. If we are to have a 
digital ID, on a technical level, the system should have 
privacy built in. We need legal safeguards. For example, we 
need to make sure that police officers do not and cannot access 
our phones during ID checks. We need protections to make sure 
we aren't swamped by identification demands at every turn. We 
need to ensure that a digital ID remains optional.
    My third point is that we need to take the time to do this 
right. If we must have a digital ID system, we can design one 
that makes use of the newest innovations in technology to 
protect our privacy, while at the same time, making legitimate 
ID requests easier and more secure. There's an enormous amount 
of innovation, invention, and discussion still under way around 
identity and encryption technologies, but there are still many 
missing pieces that need to be worked out.
    We are at a formative moment. It would be a pity to find 
ourselves locked into a suboptimal standard, an ID system, the 
way we're stuck with our QWERTY keyboards where the keys are 
intentionally placed to slow down typists because early 
typewriters jammed easily.
    There's no hurry here. Digital IDs are not going to speed 
people through airline security. ID checking is not the 
bottleneck, and it won't free people from having to carry their 
physical ID cards. The TSA warns on its website, quote, ``You 
must still carry your physical ID.''
    Nor is there any popular clamor for digital IDs from 
residents of the State. Those that have rolled out digital ID 
have not had substantial public sign-on except where people 
have been forced to use them. Digital IDs are being driven by 
vendors and other corporations, not by any public excitement 
about the technology.
    So again, to summarize, my three points are that a digital 
identity system could have profound consequences, could become 
a major piece of our public, critical infrastructure, and it 
needs technological and legal safeguards, and we need to take 
the time to do this right. It's too big to leave to the 
Nation's Departments of Motor Vehicles. It's too big to leave 
to the TSA. It will become a significant thing.
    Thank you very much. I look forward to your questions.
    [The prepared statement of Mr. Stanley follows:]
                   Prepared Statement of Jay Stanley
    Chairman Gimenez, Ranking Member Thanedar, and Members of the 
subcommittee: thank you for your attention to the emerging issues 
around next-generation identity proofing and thank you for inviting me 
to testify today. I would like to focus on one component of this still-
developing ecosystem: digital IDs and the Transportation Security 
Administration's role in setting applicable Government-wide standards. 
I will touch on three dimensions of digital IDs and TSA's related work: 
the risks to security, privacy, and equal opportunity; necessary 
safeguards; and the importance of the TSA slowing down adoption of 
digital driver's license standards to address those risks and 
corresponding safeguards.
    We believe that a digital identity system could have far-reaching 
consequences for people's privacy and other civil liberties, 
potentially leading to an explosion in identification demands. A 
digital identity system could allow for new ways of tracking us, and 
further disadvantage those who don't use the technology. Any such 
system, therefore, must be accompanied by careful technological and 
legal protections.
    If we are to have a digital ID system, it's vital that we take the 
time to do it right. There is a lot of innovation under way in the 
digital identity space, including when it comes to privacy protection. 
The TSA proposes to adopt a ``mobile driver's license'' standard set by 
the International Organization for Standardization (ISO)--a standard 
that was created behind closed doors by a secretive committee at the 
ISO that, so far as we can tell, was made up of representatives of U.S. 
security agencies like DHS, tech giants, and authoritarian governments. 
This ISO standard is inadequate and incomplete when it comes to the 
protection of our privacy.\1\
---------------------------------------------------------------------------
    \1\ See Jay Stanley, ``Identity Crisis: What Digital Driver's 
Licenses Could Mean for Privacy, Equity, and Freedom,'' American Civil 
Liberties Union (May 2021), https://www.aclu.org/sites/default/files/
field_document/20210913-digitallicense.pdf.
---------------------------------------------------------------------------
    In particular, it is vital that any digital ID system this Nation 
adopts be based on open, non-proprietary standards. We are concerned 
that the TSA also appears to be working extremely closely with one 
company, Apple, Inc., even signing over to Apple the agency's patents 
governing the operation of its airport mobile drivers' license 
checkpoints.\2\
---------------------------------------------------------------------------
    \2\ See Jason Mikula, ``Apple's Homeland Security Deal Yields 
Checkpoint, KYC, Voter ID Patents, Documents Suggest,'' Fintech 
Business Weekly (Sept. 11, 2022), https://
fintechbusinessweekly.substack.com/p/apples-homeland-security-deal-
yields.
---------------------------------------------------------------------------
    It's also unclear that the TSA has the authority to issue interim 
compliance waivers for digital IDs, as the agency proposes to do in its 
August Notice of Proposed Rulemaking.\3\ There are also larger 
questions about why the TSA, with its relatively narrow mission, has 
been positioned to determine the shape of an identity system that will 
affect all of the Federal Government, and indeed all of U.S. society.
---------------------------------------------------------------------------
    \3\ Minimum Standards for Driver's Licenses and Identification 
Cards Acceptable by Federal Agencies for Official Purposes; Waiver for 
Mobile Driver's Licenses, 88 Fed. Reg. 60056, 60072 (proposed Aug. 30, 
2023).
---------------------------------------------------------------------------
 i. a digital version of our id might sound simple but would have far-
                         reaching consequences
    A movement is under way to create a digital identity system that 
would allow people to carry their ID on their phones or on digital 
smart cards and, eventually, use them over the internet. That might 
sound handy at first blush, but it would not be as simple as it might 
sound. The creation of a digital ID--especially one that could be used 
over the internet--would be a turning point that could have enormously 
harmful effects on our privacy, on the right to anonymous speech, on 
financial access, and more. The adoption of any such system must be 
approached with great care and deliberation, and accompanied by both 
technological and legal protections against the negative side effects 
the creation of a digital ID is likely to have.
    The current discussion centers largely around digital versions of 
people's plastic driver's licenses that can be used for in-person 
presentations such as at TSA checkpoints, known as ``mobile drivers' 
licenses.'' But the real game for big tech companies and Government 
agencies is a digital ID that can be used on-line, and while the former 
is not without potentially significant ramifications, it is the on-line 
digital ID that will be a real game-changer. Since the dawn of the 
internet, on-line speech and activity has been relatively anonymous, 
and much policy discussion in the past three decades has centered on 
questions of whether, when, and how to verify identities on-line. Those 
questions--and their answers--would be fundamentally altered by the 
development of an easily presentable and ubiquitous digital ID. The 
possibility that our digital IDs would be required to access not just 
on-line governmental services but also social media platforms, news 
sites, and digital services is reason for great caution in this space. 
As I will touch on soon, the future of digital IDs and the future of 
these questions can very much be shaped by Congress and the TSA.
    Some say a digital ID is inevitable. We don't know whether that's 
true. There do seem to be a lot of forces gathering to make it happen, 
including big banks, tech companies, and other on-line advertisers. 
Digital driver's licenses currently being adopted in a number of States 
are based on a standard created by the International Standards 
Organization (ISO)--and that organization is currently working to 
expand the standard to cover on-line, at-a-distance ID presentations. 
Even if another standard is adopted instead, it is likely that we will 
see a continued push for an ID that can be used on-line. Some of these 
institutions just want to make existing verification systems easier, 
while others likely would love to use a digital identity system to 
track people. If a digital ID system does come about, we do know that 
this new infrastructure will have a lot of unanticipated consequences, 
as is always the case with a major new technological and identity 
infrastructure, going back to the Social Security card created in the 
1930's.
    Some of those consequences, however, we can anticipate. Negative 
side effects that a digital ID would predictably create include:
a. An explosion in demands that we prove our identity
    A digital ID would make it much easier to present one's full, 
cryptographically-signed, DMV-vetted proof of identity. That also means 
it will become much easier for all manner of stores and on-line sites 
to request or demand proof of identity, since it wouldn't be a big ask. 
A digital ID could create a world where we get asked for ID at every 
turn. Want to enter a 7/11? Scan your ID. Want to enter a national 
park? Scan your ID. Want to browse a clothing store, buy a cup of 
coffee, or park your car? Scan your ID.
    And that dynamic becomes even more intense once it's extended to 
the internet, where every web site and service demands not just an 
email address, but your full, DMV-vetted ID. We already live in a 
digital ecosystem that goes to great lengths to connect our on-line and 
off-line activity to key identifiers. If not properly guarded, digital 
IDs may simply facilitate that effort. We may wake up one day and find 
that overnight, if we want to watch a YouTube video, or log on to 
social media, or look at a news site, we are asked to ``press a button 
and send us your driver's license.''
    A powerful Big Tech motivation for that is likely to be marketing. 
As some other techniques for tracking people on-line, such as cookies, 
lose their utility, companies are hungry for alternate ways of 
identifying people so they can collect reliable personal data for 
advertising, have a reliable unique identifier so they can track us 
across different sites, and increase the value of the data they 
collect.\4\ Other motivations are likely to be cybersecurity (``We need 
to know who is on our site in case they turn out to be a bad actor''), 
enforcement (``We need to make sure you aren't someone we've previously 
banned due to violations of our terms of service''), and age 
verification (``For our legal due diligence, we need to know you're 
over 13 or we can't market to you'').\5\
---------------------------------------------------------------------------
    \4\ The loss of utility comes from several sources, including the 
``death of tracking cookies,'' the influence of E.U. privacy law, and 
changes to the operating system on Apple's phones, which limit 
advertisers from accessing an iPhone user identifier. Google has also 
moved toward limiting the tracking technology in its Chrome browser and 
in the Android phone operating system. See Owen Ray, ``Tracking Cookies 
are Dead: What Marketers Can Do About It,'' Invoca Blog (Oct 2. 2023), 
https://www.invoca.com/blog/tracking-cookies-are-dead-what-marketers-
can-do-about-it; Brian Chen, ``To Be Tracked or Not? Apple Is Now 
Giving Us the Choice,'' The New York Times (April 16 2021), https://
www.nytimes.com/2021/04/26/technology/personaltech/apple-app-tracking-
transparency.html; Brian Chen and Daisuke Wakabayashi, ``You're Still 
Being Tracked on the Internet, Just in a Different Way,'' The New York 
Times (April 6, 2022), https://www.nytimes.com/2022/04/06/technology/
online-tracking-privacy.html.
    \5\ The Children's Online Privacy Protection Act bars the on-line 
collection of personal information from children under 13 without 
parental permission. 15 U.S.C.  6502.
---------------------------------------------------------------------------
    Without protections in place, any digital ID that emerges that can 
be used on-line is likely to lead to an explosion in on-line identity 
demands. The ease and convenience of using a pre-built, Government-
sanctioned identify proofing as a single sign-on method is likely to 
prove game-changing. Currently people have the flexibility to offer 
different log-in information for different accounts. Depending on how 
much we trust a web site, we can use different email addresses, 
different login handles, and real or fake names and other data. This 
flexibility empowers individuals. It allows us to choose when we wish 
to reveal our identity, and when we want to remain anonymous or 
pseudonymous. To provide your real identity is to enter a lifetime 
relationship with a company or web site--they will always be able to 
find you. People don't always want that.
    These kinds of dynamics could lead us toward a ``checkpoint 
society'' where an increasingly dense net of identity checkpoints and 
access controls is woven throughout American life, on-line and off-. It 
could also become impossible to do anything without proving your 
identity. That would mean a significant loss not only of privacy, but 
also an erosion of Americans' ability to engage in anonymous speech. 
Anonymous speech has been an important American tradition since the 
Nation's founding--the Federalist Papers and many pro-revolutionary 
pamphlets were written anonymously, for example--and it brings many 
benefits, including the ability to speak truth to power, to freely 
associate and exchange ideas, and to seek support on-line for 
conditions and experiences that many find shameful to disclose.\6\
---------------------------------------------------------------------------
    \6\ McIntyre v. Ohio Elections Commission (1995) (anonymous 
election- and issue-related leaflets); Talley v. California, 362 U.S. 
60 (1960) (anonymous handbills).
---------------------------------------------------------------------------
    Verification of a person's real identity is currently difficult, 
cumbersome, and expensive, and as a result is not usually asked of 
customers unless absolutely necessary. Once we create a way of proving 
our identity that is quick and easy, demands will proliferate.
b. Centralized tracking of presentations
    Another danger posed by a digital ID is that, depending on how an 
ID system is architected, it could allow people's presentations of 
their ID to be tracked. When I present my plastic driver's license at a 
wine store to prove I'm over 21, generally, no record of that 
interaction is created, and it remains between me and the clerk.\7\ 
Digital technology, however, magnifies the potential for those 
presentations to be recorded, reported, and tracked.
---------------------------------------------------------------------------
    \7\ See Heather Brown, ``What Do Driver's License Scanners Do With 
Our Information?'', WCCO (Mar. 3, 2022), https://www.cbsnews.com/
minnesota/news/drivers-license-scanners; Dana Fowle, ``Retailers 
Scanning Drivers Licenses Raises Privacy Issues,'' Fox 5 Atlanta (Jan. 
21, 2022), https://www.fox5atlanta.com/news/retailers-scanning-drivers-
licenses-raises-privacy-issues.
---------------------------------------------------------------------------
    In digital identity systems that permit such tracking, information 
could be gathered by the issuer (in the case of digital driver's 
licenses, that would be motor vehicle departments or the contractors 
that they hire) about every bar, club, casino, office lobby, bank, 
pharmacy, doctor's office, sporting arena, concert venue, and airport 
that an ID holder visits; every convenience store beer purchase, 
equipment rental, or hotel check-in; any applications for social 
services; and any other circumstance in which they may be asked to show 
an ID. And again, if a digital identity system starts being used on-
line, that list could grow exponentially to cover the websites and on-
line services a person uses. Digital IDs would also make it trivial for 
those stores, bars, banks, and other establishments to tie every 
transaction to your real identity and monetize that data, unless 
Congress provides meaningful safeguards.
    The ISO standard that the TSA proposes to embrace allows for 
systems in which the verifier (such as a liquor store or web site) 
electronically pings the ID issuer to confirm that the ID is valid. 
That ``server retrieval'' method gives the ID issuer a variety of data 
that can give them a bird's-eye view of when, where, and to whom a 
person is presenting their ID. The ISO standard also permits off-line 
verifications, which unlike remote over-the-internet verifications 
don't require the verifier to connect to the issuer or any other third 
party when doing an ID verification.\8\ This is how any digital 
identity system should work, but we are concerned that some States may 
use the server retrieval method, thereby creating an infrastructure 
that allows for the tracking of ID holders.
---------------------------------------------------------------------------
    \8\ The verifier will need to periodically download verifiers' 
public encryption key, which is used to cryptographically verify that 
the digital ID has been digitally signed by the DMV or other issuing 
party and has not been altered.
---------------------------------------------------------------------------
    Some digital ID systems, such as the ISO standard, may also provide 
for IDs that ``phone home'' to their issuers at regular intervals. This 
also threatens to invade identity holders' privacy by providing the 
issuer with information about the holder such as their IP address, 
which can reveal location and other information.
c. Further disadvantaging those without technology
    If digital IDs become mandatory, either legally or practically, it 
could also have significant implications for equity and the ``digital 
divide'' by disadvantaging those who don't have a smartphone or other 
necessary devices. That is a surprisingly large group of people, 
including many from our most vulnerable communities. Studies have found 
that more than 40 percent of people over 65 and 25 percent of people 
who make less than $30,000 a year do not own a smartphone.\9\ People 
with disabilities are 16 percent less likely to own a smartphone, and 
many who are homeless also lack access.\10\ Some may lack the resources 
to afford a smartphone and mobile data access, while others spurn 
smartphones to protect their privacy or because they just don't see the 
need. In other cases, a single phone may be shared among family 
members.
---------------------------------------------------------------------------
    \9\ See ``Mobile Fact Sheet,'' Pew Research Center (April 7, 2021), 
https://www.pewresearch.org/internet/fact-sheet/mobile/.
    \10\ See Andrew Perrin and Sara Atske, ``Americans with 
disabilities less likely than those without to own some digital 
devices,'' Pew Research Center (Sept. 10, 2021), https://
www.pewresearch.org/short-reads/2021/09/10/americans-with-disabilities-
less-likely-than-those-without-to-own-some-digital-devices/.
---------------------------------------------------------------------------
    To worsen inequality, digital IDs need not become legally mandated, 
just practically required. There's no law that says anybody has to get 
a credit card or driver's license, but it's hard to participate fully 
in society without one, and those who lack them suffer significant 
disadvantages in today's world. If digital credentials become similarly 
practically required, the effects would be even worse. This is why we 
have called for a ``right to paper'' (see below).
            ii. any digital id system must offer safeguards
    If we are to have a digital ID, we need to make sure we build it in 
a way so that it does not become an infrastructure that allows us to be 
tracked and regimented in new ways. That means building both technical 
and legal safeguards that protect our privacy and guard against 
overuse.
a. Technological safeguards
    The technological protections that should be incorporated into a 
digital ID include (but are not limited to):
   No tracking.--A system must not allow ID issuers visibility 
        into where and when an ID is presented to a verifier, as 
        discussed above.
   Holder control.--An ID holder--the individual to whom the ID 
        belongs--should have technological control over what data they 
        reveal to a verifier, allowing them to reveal some fields of 
        data and not others, and to reveal characteristics such as 
        ``over age 21'' without revealing details the holder's date of 
        birth, or ``resident of county'' without revealing their 
        address. This is one area where a digital ID can have 
        advantages for privacy over a physical ID, and that advantage 
        should be made use of.
   Unlinkable presentations.--When the holder presents their 
        digital credentials, the verifier should be unable to link that 
        presentation with others from the same holder. For example, the 
        verifier should not be able to tell that the ``over 21'' person 
        buying a case of beer today is the same person who bought a 
        bottle of wine last week. This limits the ability of any 
        verifier (or their vendors) to assemble a map of data about who 
        does what where.
   Verifier transparency.--An ID holder should have 
        transparency into who is requesting identifying or 
        authenticating information, their authority for making that 
        request, what the specific circumstances and purpose of the 
        request are, what information is and has been transmitted, and 
        if that transmission involves third parties.
   Open not proprietary.--If the United States is to adopt a 
        digital ID, it's also vital that that ID be open and free of 
        proprietary corporate strings. There must be no one 
        corporation, or small handful of corporations, that Americans 
        are de facto required to deal with in order to participate in a 
        digital identity system. The system must be clearly documented 
        and open enough that it is possible for any party with the 
        relevant skills to build an interoperable digital wallet that 
        any legitimate ID holder can use or an interoperable verifier 
        tool that any legitimate verifier can use. No system that our 
        society depends upon should be built on proprietary 
        specifications, proprietary hardware, or patent-encumbered 
        technology.
b. Legal safeguards
    In addition to technical protections built into digital IDs, 
Congress should consider establishing legal safeguards to protect 
individuals from surveillance and Governmental incursions:
   No police access to phones.--By placing people's mobile 
        phones at the center of law enforcement driver's license 
        checks, a digital identity system raises the risk that police 
        officers will gain warrantless access to people's phones, a 
        potentially severe violation of privacy. No one seems to be 
        contemplating a system that as a technological matter requires 
        people to hand over their phones, but that is not enough. Many 
        people, especially vulnerable people such as the elderly, 
        immigrants, and members of marginalized communities, may not 
        feel able to decline a police request to hand over or unlock 
        their phone. Despite a crystal-clear Constitutional requirement 
        that police must obtain a warrant for smartphone searches, 
        questionable ``consent-based'' police searches of people's cell 
        phones happen thousands of times a day.\11\ A police officer's 
        request--``mind if I look at your phone?''--may make a search 
        ``voluntary'' in the eyes of the law, but few searches based on 
        such police requests are truly voluntary. That is especially 
        true for members of poor and marginalized communities. Police 
        officers should be legally prohibited from making requests for 
        ``voluntary'' taking or search of people's phones.
---------------------------------------------------------------------------
    \11\ Riley v. California, 573 U.S. 373 (2014); Logan Koepke et al., 
``Mass Extraction: The Widespread Power of U.S. Law Enforcement to 
Search Mobile Phones,'' Upturn (2020), https://www.upturn.org/work/
mass-extraction/.
---------------------------------------------------------------------------
   Protections against excessive identity demands.--As 
        discussed above, a digital identity system, by making it very 
        easy to share our ID, is likely to lead to a significant 
        expansion in the times and places where our IDs are demanded. 
        As a result, no digital identity system should be rolled out 
        without legal limits on when those engaged in commerce or other 
        regulated activities may demand that people identify 
        themselves.
   ``A right to paper''.--We believe that people should have a 
        right to obtain and use paper, plastic, or other physical 
        identity documents instead of or in addition to a digital ID. 
        The use of digital IDs should never become mandatory as a legal 
        or practical matter. Digital IDs should be accompanied by 
        policies that bar those engaged in commerce or other regulated 
        activities from refusing to accept physical IDs on a reasonably 
        equal basis.
   Protections against data collection by verifiers.--Verifiers 
        in any system of digital IDs should come with concrete legal 
        obligations to minimize collection and retention of data, with 
        appropriate consequences for violations. One tempting business 
        model for verifiers will be to offer free verification 
        terminals (for in-person use) or software (for network use) in 
        order to collect data about where and when a person is using 
        their ID. This could be for marketing, surveillance, or other 
        purposes. Even where vendors are well-intentioned, these data 
        collections are attractive targets for hackers, criminals, and 
        espionage agencies.
             iii. we need to take the time to do this right
    Because the emergence of a digital identity standard is likely to 
have significant consequences and to require development of mitigating 
policies such as those we outline above, it is important that the 
United States take care to minimize the negative impacts a digital ID 
would have. That will take some time.
a. A lot of work is still under way on ID standards and technology
    The standards and technologies we need to build an identity system 
that protects the interests of ordinary people including privacy are 
not yet ripe. There is an enormous amount of innovation, invention, and 
discussion still under way with regards to this technology and to 
encryption technologies that can allow us to protect privacy even while 
retaining many useful functions of an ID card.
    As the TSA itself has pointed out, the privacy protections 
governing mobile driver's licenses are ``evolving and unsettled.''\12\ 
The ISO standards for mobile driver's licenses (currently ISO/IEC 
18013-5:2021) are currently incomplete and address only some aspects of 
a digital identity system.
---------------------------------------------------------------------------
    \12\ Minimum Standards for Driver's Licenses and Identification 
Cards Acceptable by Federal Agencies for Official Purposes; Waiver for 
Mobile Driver's Licenses, 88 Fed. Reg. 60056 (proposed Aug. 30, 2023), 
at 60072.
---------------------------------------------------------------------------
    One example is the provision in the ISO standard under which IDs 
``phone home'' to their issuers. Under a privacy-protective 
architecture, an ID holder who needs to perform a specific task such as 
an update or renewal should be in control of when and how they connect 
to the DMV (or another issuer) rather than having that built into their 
phone. These sorts of check-ins should be minimized and infrequent, 
should be doable over anonymized networks such as Tor and Apple Private 
Relay, and should be subject to strict data destruction requirements on 
any metadata gathered by the issuer or their vendor during these check-
ins. None of these considerations have been addressed, and if they were 
debated at all within the ISO the public had no role in or visibility 
into it. These are the kinds of considerations that need more mature 
development.
    Another example of the system's current immaturity is the 
implementation of unlinkable presentations, in which a verifier has no 
way of knowing that the person who is proving they're over 21 is the 
same person who proved that last week. One way to do this is with a 
stack of unique, single-use ``tickets'' (cryptographic tokens signed by 
the issuer). But there has been little if any discussion of that kind 
of functionality as part of the ISO standards process, so far as we 
know.
    Other missing components include standards governing the design of 
digital wallets and their privacy protections, protections for data 
stored on the phone, mechanisms for the ID holder to receive 
information about the legitimacy of the requester, and provisioning 
(the process States use to install a mobile drivers' license in 
people's wallets).
    Even the incomplete ISO standard that the TSA proposes to embrace 
is only one of a number of approaches to digital identity that are 
being developed around the world. Interest in digital identity systems 
has fueled the emergence of an entire community that has been working 
on the problems of on-line identity and authorization for many years, 
including privacy. That movement has created a variety of proposed 
systems, including a promising open standard created by the World Wide 
Web Consortium (W3C) called Verifiable Credentials (VCs). VCs are 
regarded as superior by many in the digital identity community, and 
should be given time to further evolve and ripen before TSA pushes a 
standard that is likely to become locked in. Simply put, people are 
still figuring things out.
    That is also true when it comes to the field of privacy-enhancing 
cryptography, which is advancing quickly with a great deal of creative 
research that promises to allow us to ``have our cake and eat it too'' 
when it comes to privacy and security across a wide variety of 
applications. For example, a privacy-enhancing technology called ``zero 
knowledge proofs'' allows people to prove they know certain things 
without revealing what those are--a technique that is still in the 
process of being applied in new areas.\13\ As a Federal Reserve Board 
report put it, privacy-enhancing technologies remain ``an emerging 
category of tools.''\14\
---------------------------------------------------------------------------
    \13\ See Jay Stanley, ``Paths Toward an Acceptable Public Digital 
Currency,'' American Civil Liberties Union (March 3, 2023), https://
www.aclu.org/sites/default/files/field_document/
cbdc_white_paper_0882_0.pdf (on encryption tools in digital payments); 
Jay Stanley and Daniel Kahn Gillmor, ``New Mobile Phone Service Shows 
We Can Have Both Privacy and Nice Things,'' American Civil Liberties 
Union (February 15, 2023), https://www.aclu.org/news/privacy-
technology/new-mobile-phone-service-shows-we-can-have-both-privacy-and-
nice-things (on the use of privacy-enhancing technologies in a 
telephone network).
    \14\ See Kaitlin Asrow and Spiro Samonas, ``Privacy Enhancing 
Technologies: Categories, Use Cases, and Considerations,'' Federal 
Reserve Bank of San Francisco (June 1, 2021), https://www.frbsf.org/
banking/wp-content/uploads/sites/5/Privacy-Enhancing-Technologies_FI- 
NAL_V2_TOC-Update.pdf.
---------------------------------------------------------------------------
b. Any standard that emerges is likely to become ``locked in''
    We need to be extremely careful about the details of any digital 
identity system we adopt, because it's going to need to be 
interoperable across all the States, and potentially across the world. 
It will likely be adopted by Federal agencies, companies, and small 
businesses across the Nation. Therefore, once put in place, it is going 
to be very difficult to change.
    It would be a pity to find ourselves locked into a sub-standard ID 
system that doesn't make use of the newest innovations in technology, 
the way we're locked into our QWERTY keyboard standard, where the keys 
are intentionally placed to slow down typists because early typewriters 
jammed easily. Yet that is what is in danger of happening.
   iv. there is no need for the tsa to rush a digital id system into 
                               operation
    The TSA's rapid movement toward setting standards (even supposedly 
interim ones) for State digital driver's licenses is premature and 
unnecessary, and threatens to create just the kind of lock-in of a 
substandard system that we should seek to avoid.
a. The Federal Government has the power to rapidly standardize a 
        digital ID system
    Whatever rules the TSA comes up with for Federally-compliant 
digital IDs will force the States to comply and are likely to govern 
what the Nation ends up with. Requirements and standards that the TSA 
sets for Federal acceptance of digital identification are going to 
force States' departments of motor vehicles to meet those requirements. 
The Nation's DMVs, in turn, put credentials in the pockets and purses 
of most Americans, an enormous power that could stifle efforts to 
create other, superior ID systems. While it's possible that 
alternative, parallel, competing identity systems emerge and find broad 
acceptance--which would be a good thing--it's likely that the driver's 
license will continue to remain the primary ID that Americans use when 
asked to prove their identity, age, or residency.
b. TSA is adopting standards that are not optimal
    The TSA proposes to adopt an ISO ``mobile driver's license'' 
standard that was created behind closed doors by a secretive committee 
at the ISO that, so far as we can tell, was made up of representatives 
of U.S. security agencies like DHS, tech giants, and authoritarian 
governments. This ISO standard would allow for IDs that ``phone home'' 
to the DMV (or its corporate contractor), and allow tracking of where, 
when, and to whom an ID holder is showing their ID. As discussed above, 
it is also incomplete.\15\
---------------------------------------------------------------------------
    \15\ See Jay Stanley, ``Identity Crisis: What Digital Driver's 
Licenses Could Mean for Privacy, Equity, and Freedom,'' American Civil 
Liberties Union (May 2021), https://www.aclu.org/sites/default/files/
field_document/20210913-digitallicense.pdf.
---------------------------------------------------------------------------
    The TSA also appears to be working extremely closely with Apple, 
Inc. Documents obtained by journalist Jason Mikula reveal that the TSA 
has entered into contracts that appear to give Apple significant power 
over the implementation of mobile drivers' license checkpoints. For 
puzzling and unclear reasons, the TSA even signed over to Apple the 
agency's patents governing the operation of its airport mobile drivers' 
license checkpoints.\16\
---------------------------------------------------------------------------
    \16\ See Jason Mikula, ``Apple's Homeland Security Deal Yields 
Checkpoint, KYC, Voter ID Patents, Documents Suggest,'' Fintech 
Business Weekly (Sept. 11, 2022), https://
fintechbusinessweekly.substack.com/p/apples-homeland-security-deal-
yields.
---------------------------------------------------------------------------
c. There's no hurry for the TSA
    Any increased use of digital driver's licenses won't speed people 
through airline security--ID checking is not the bottleneck--and it 
won't free people from having to carry their physical ID cards, since, 
as the TSA warns, ``You must still carry your physical ID.''\17\
---------------------------------------------------------------------------
    \17\ See ``Biometric and Digital Identity Solutions For TSA 
PreCheck Members,'' Transportation Security Administration, https://
www.tsa.gov/digital-id.
---------------------------------------------------------------------------
    Nor is there a popular clamor for digital IDs from residents of the 
States. Those that have rolled out digital driver's licenses have not 
had substantial public sign-on. Alabama, for example, has had a digital 
driver's license available to residents since 2015, but was rarely used 
even as mobile payments skyrocketed. Digital IDs are being driven by 
vendors and other corporations, eager to define digital driver's 
licenses as ``the future'' and conjure a non-existent public excitement 
about the technology.\18\
---------------------------------------------------------------------------
    \18\ See Lauren Walsh, ``Alabama's digital driver's license: What 
you need to know,'' ABC 33/40 (Oct. 8, 2018), https://abc3340.com/news/
local/alabamas-digital-drivers-license-what-you-need-to-know.
---------------------------------------------------------------------------
d. There are serious questions about the TSA's authority to dictate ID 
        standards for the whole U.S. Government
    The authority of the Department of Homeland Security to regulate 
the forms of identity that are accepted by the Federal Government stems 
from the Real ID Act of 2005 and the Real ID Modernization Act of 
2021.\19\ Those acts direct the Secretary of DHS to promulgate 
regulations specifying compliance requirements, and to certify State 
compliance therewith. Those acts do not contemplate the issuance of 
interim compliance waivers that permit the Federal acceptance of 
identity documents that are not subject to requirements created through 
the regular regulatory process, which is what the agency proposes in 
its August Notice of Proposed Rulemaking.\20\
---------------------------------------------------------------------------
    \19\ REAL ID Act of 2005, Pub. L. 109-13, div. B, title II,  
202(a)(1), (c)(3), 119 Stat. 311 (2005) (codified as amended at 49 
U.S.C.  30301 note); REAL ID Modernization Act, Pub. L. 116-260, div. 
U, title X,  1001(b)(2)(D), 134 Stat. 2304 (2020) (codified at 49 
U.S.C.  30301 note) (amending the REAL ID Act  202).
    \20\ Minimum Standards for Driver's Licenses and Identification 
Cards Acceptable by Federal Agencies for Official Purposes; Waiver for 
Mobile Driver's Licenses, 88 Fed. Reg. 60056, 60072 (proposed Aug. 30, 
2023).
---------------------------------------------------------------------------
    Also questionable is DHS's decision to delegate its authority under 
these acts to its sub-agency TSA. This creates a situation, not 
contemplated by Congress, in which an agency with a narrow mandate of 
protecting the safety of aviation, and which has an interest only in 
one narrow use of identity documents (matching against airline 
tickets), is positioned to determine the shape of an identity system 
that will affect all of the Federal Government, and indeed all of U.S. 
society.
v. conclusion: this is a big decision with far-reaching ramifications, 
              and we should take the time to get it right
    The major questions about any digital identity system are whether 
it will be designed to protect privacy to the maximum extent possible, 
and whether people will be forced to participate in it. Will it be 
built to give control to people, or built to spy on people and increase 
the control of Government agencies and companies over people? Making 
somebody show ID is sometimes necessary, but it's also an act of power. 
Who should be able to require someone else to identify themselves? What 
can the requestor do with that information once they have it? What 
recourse does the identified person have if the requestor misuses the 
information? These questions should be answered before we rush into 
locking in a sub-optimal digital identity system.

    Mr. Gimenez. Thank you, Mr. Stanley.
    Members will be recognized by order of seniority for their 
5 minutes of questioning. An additional round of questioning 
may be called after all Members have been recognized.
    I now recognize myself for 5 minutes of questioning.
    I want to make it very clear that I'm not here to advocate 
for digital anything. My issue is really the fact that we have 
a standard, which is REAL ID, in order to pass a TSA checkpoint 
and that maybe 50 percent of the American public will not have 
REAL ID come March--May 7th of 2025. A digital ID doesn't solve 
the problem.
    So, Mr. Grossman, a digital motor driver's license is based 
on a driver's license issued by a State. Yet, only 5 States out 
of the 56 issuing jurisdictions that we have actually will only 
give you a REAL ID with the requirements of a REAL ID.
    So the other jurisdictions, you may get a REAL ID or think 
they may ask you to pay more to get a REAL ID and that's up to 
the individual whether they want a REAL ID or not. At the end 
of the day, whether--if it's not a REAL ID, even if it's a 
digital driver's license, it won't get you past TSA. That's 
what this committee's about. OK. So we can talk about some 
other issues.
    By the way, some of the issues you brought up, Mr. Stanley, 
are provocative. Actually, you know, some caught me, starts me 
to think. Those are outside the purview of this committee. If 
TSA is, in fact, involved in that, then, you know, I think we 
need some further hearings on what is TSA doing to set 
standards for digital ID, and why is TSA the only Government 
agency doing that. That's for another day.
    Today what I'm really thinking about: What are we going to 
do on that day when you're trying to get into the airport and 
you have 2.9 million people going through airports and 50 
percent of them can't get in, get on their plane because they 
don't have a REAL ID?
    So the push for digital IDs, is there any--Mr. Grossman, 
maybe you can answer this question. Is there a push to convert 
all of that digital ID to REAL ID, or are we going to still 
have some people have ID REAL ID, some people don't have REAL 
ID?
    Mr. Grossman. So certainly in the current State, most 
States offer that option of you can either access a REAL ID or 
have a non-REAL-ID-compliant credential. The focus of States 
right now are to continue to provide that option when they're 
providing it. Then working with TSA for the ones that an REAL 
ID-compliant, is there a way to reflect that in the mobile 
device, as well? That's the rule making that was referred to by 
other testimony.
    So the States' focus as relates to REAL ID has always been 
following the Federal guidelines. It said if you want to use 
your State-issued driver's license or identity card for Federal 
purposes, meet these standards. That's why all States have 
provided the option for their constituents to receive that 
Federally-accepted credential.
    Mr. Gimenez. Correct. But isn't it true that also some of 
these States or some of these jurisdictions will charge you 
more for that REAL ID?
    Mr. Grossman. The fees certainly do vary across the States. 
That's correct.
    Mr. Gimenez. OK. I don't know if any of you can answer this 
but I know that--you know, what percentage of the American 
public actually has a passport? That's another way to get 
through, have a REAL ID. Does anybody know the answer to how 
many--what percentage of the American public actually has a 
passport?
    Mr. Grant. I think it's a little less than half. The 
numbers surged a little after 9/11 when some of the land-border 
points required some sort of ID, but it's not something that's 
a viable alternative for at least half the country.
    Mr. Gimenez. All right. So there we go back to my original 
premise is that come that day on 2025, we will have utter chaos 
at our airports because a great number of people will not have 
the identification that is required by TSA in order to board a 
plane.
    So, what is it that we're going to do about it? 
Unfortunately, I don't think any of you really have the answer 
to that question.
    That's a question--yes, Mr. Stanley.
    Mr. Stanley. I will say that the TSA has been threatening 
chaos in airports for the last 18 years. It has been its main 
hammer to try to get recalcitrant States into line.
    You may recall, after REAL ID was passed, it was enormously 
unpopular. Over half the States passed either resolutions 
against it or laws that banned their DMVs from complying with 
it. We opposed it. We've worked with a lot of conservative 
allies and State legislators to get these. The TSA has 
consistently threatened that it's going to cause chaos in 
airports and forced State legislators to pull back on those--in 
that opposition to REAL ID.
    The TSA is engaged in a game of chicken that I don't--I 
think it's highly unlikely that TSA would actually make half 
the population of any State have to go through secondary 
screening at an airport because of the chaos that would ensue 
and I would not--and each time they set a new deadline, we say 
to people, They will probably push this back, and they always 
have so far.
    So I would be unsurprised if they don't push it back again.
    Mr. Gimenez. But that would also take Congressional action, 
right, to do that?
    Mr. Stanley. My understanding is, no, because they never 
got Congressional action the last 4 or 5 times they kept 
pushing the deadline back.
    Mr. Gimenez. Fair enough. But if it's something that was 
mandated by Congress, I think that maybe it takes--it should 
take Congressional action to push it back. So, maybe that's the 
reason why we're having this hearing so that I can educate our 
colleagues that, Hey, we have a problem looming in that we 
are--are we going to hope that TSA pushes it back or are we 
going to do something about it?
    Then if we are going to do something about it, how can we 
fix this problem? Because this problem has been going on for a 
number of years. Do we continually kick the, you know, can down 
the road?
    The testimony that I've seen opens up a whole can of other 
worms, OK, that--that maybe we, maybe not this subcommittee 
will take up. But if TSA's actually involved in those 
activities, maybe this subcommittee will take them up. So the--
my time is up for right now.
    So I recognize the Ranking Member, the gentleman from 
Michigan, Mr. Thanedar.
    Mr. Thanedar. Again, thank you, Chairman Gimenez, for 
scheduling this hearing.
    This is important. You know, I'm a scientist by training. 
I'm an innovator. I love technology, and can't wait for my 
Christmas presents hopefully with some good technology in the 
market.
    As a scientist, I recognize we need to continue to 
innovate, improve our processes, make people's lives better. 
But the question here that I raise and the concerns I have 
about using technology before it is completely baked.
    You know, I represent Michigan's 13th Congressional 
district. I represent the city of Detroit with 78 percent 
African-American population. We have seen use of facial 
technology, facial IDs. The police department has used some of 
that and seen some horror situations, people incorrectly 
identified, wrongly accused, using a technology that I'm not 
quite sure, you know, is appropriate or has been fully tested, 
that it does not have biases and discrimination against people 
of color, for example.
    So my concern here is, you know, are we rushing this so 
much that we are affecting people's privacy and rights and the 
potential, although the potential to enhance security and 
convenience of those benefits may be outweighed by the risk 
they pose to privacy.
    Mr. Stanley, what risk does it pose to privacy and people's 
civil liberties?
    Mr. Stanley. Thank you, Mr. Ranking Member.
    The face recognition is a very, very powerful biometric. In 
many ways, it's the most powerful biometric. If somebody wants 
to take your fingerprint, they can't do it unless you know that 
you're doing it, whereas if you're walking down the street, you 
can be subject to face recognition.
    We have, given the enormous number of cameras in our 
society, if we were to plug face recognition into all of them, 
it would be basically--it could come close to the same as 
putting a GPS tracker on everybody. That can reveal a lot of 
information about people.
    So, people in the privacy and civil liberties community 
have been, rightly, very wary of face recognition technology 
and it's especially--it's used before it's ready for prime 
time, which I thought you said very well, before the biases are 
worked out, or procedures are worked out and, you know, in 
police departments and the like. We have called for a 
moratorium on its use by law enforcement until we can get all 
that straight.
    Face recognition also plays a role in the identity context, 
and that's a very complicated issue, again. For example, every 
time you show a digital ID, does it transmit a digital photo of 
yourself to the person that is verifying you? Now they can--now 
they have your digital photo. Or do you self-verify to your 
phone?
    There are a lot of complex issues that need to be worked 
out around there, and I think that that is part of what makes 
the current digital identity technology immature.
    Mr. Thanedar. Thank you.
    Mr. Stanley and Mr. Grant, what recommendations do you have 
for TSA and the Federal Government for developing digital ID 
standards in a responsible manner?
    Mr. Grant. Well, from my perspective, as I mentioned in my 
opening statement, I would get this--I think TSA deserves a 
seat at the table but this is something that's much bigger than 
TSA in that the issues we're trying to deal with, particularly 
with this wave of ID-related cyber crime that we've seen and 
sort-of this new threats that are emerging there, you know, 
both to the technical side, the security side, and also the 
privacy side that you're talking about. We have other parts of 
government that are quite good at this.
    In fact, you know, this is a place where it would be great 
to see NIST, the National Institute for Standards and 
Technology, be directed to play a bigger role.
    You know, I think one thing Jay and I agree on is that we 
need to get this right. I'm saying go fast. He's saying go 
slow. But at least from our perspective, let's get this to the 
experts, you know, within the digital identity team at NIST, at 
the privacy engineering team at NIST, you know. Give them a 
time box deadline, say, a year, to try and actually bring the 
right stakeholders together and get this figured out.
    We actually know how to do this. In fact, I say a lot of 
the technologies that, perhaps, we would have dreamed of a few 
years ago are now starting to become mature and we know how to 
build robust and privacy-preserving digital identity systems.
    But tying this into REAL ID compliance, I think we're 
conflating two different objectives right here and not 
necessarily focusing on the right ones.
    Mr. Thanedar. Thank you.
    Mr. Stanley, if you have time.
    Mr. Stanley. Yes, I would agree that TSA is not the right 
agency to lead. As I said in my comments, I would urge that TSA 
not to exert pressure on the States to move to build a digital 
identities around the ISO standard which is basically what 
they're doing.
    I would urge them to be very careful about working with 
particular vendors. At the end of the day we need a system is 
that open and where an American who wants to participate in our 
identity system doesn't have to deal with one company or a 
small number of companies but can deal with a whole variety of 
competitive companies.
    So those are two of the recommendations I would make.
    Mr. Thanedar. Thank you. Thank you.
    Sorry, Mr. Chairman. Thanks for letting me go over a little 
bit more of my time.
    Mr. Gimenez. It's fine. It's fine, Mr. Ranking Member. I'm 
pretty lax here. We don't have a big crowd.
    So I now recognize the gentlewoman from Florida, Ms. Lee.
    Ms. Lee. Thank you, Mr. Chairman.
    Mr. Grant, I'd like to pick up just where Ranking Member 
Thanedar left off with you there.
    You mentioned in your written testimony that Congress 
passed the REAL ID Modernization in 2020, but did not give TSA 
direction on what use cases should be a priority.
    So I'd like to hear a bit more about whether you believe 
Congress should give TSA a directive to prioritize the on-line 
identity use cases, or, rather, give a separate entity the 
authority to be prioritizing, like NIST, the authority to be 
prioritizing and the direction to prioritize these types of 
cases.
    Mr. Grant. Thanks for the question.
    So I'd like to see NIST more involved. I also think one of 
the things that was interesting is when the original REAL ID 
Act was passed in 2005, DHS, in general, was given directions 
to figure out the standards and the regulations. It was led out 
of their policy office at the time.
    When the Modernization Act was passed in 2020, which 
essentially said a REAL ID could either be a plastic card or it 
could be digital, the assumption was that the same team in DHS 
might lead it again, but then TSA was basically given the 
authority.
    Jurisdictionally, this becomes a bit of a tricky issue. But 
there is certainly, as I talk about the cybersecurity 
implications of digital identity writ large, and the way that 
mobile driver's license could play a role in solving those 
problems, one of thoughts has been that CISA could play a role, 
but CISA does not seem to be engaged on this particular issue.
    I don't know that CISA would be ideal necessarily. I would 
personally prefer to see this at NIST. But even within the 
scope of DHS and the current legislation that we have, DHS has 
the ability to bring in a cybersecurity set of experts as 
opposed to just TSA with its more limited focus.
    Ms. Lee. Mr. Grossman, I would like to go back to your 
testimony about MDLs. I believe you described that they could 
offer better security and better privacy for consumers if 
they're designed properly. I'd like to hear more from you 
about: What are the elements of that proper-designed that could 
ensure the security and the privacy?
    Mr. Grossman. So there's a number of elements that are laid 
out both in the standard, as well as the AAMVA implementation 
guidelines, and a couple of that I'll highlight for an example.
    One is to not track where it is being used. So when someone 
uses it and it's red, that is not what we call calling home, 
phoning home back to the State agency. The State agency doesn't 
know where and how you're using it. Making sure the protocols 
and policies are in place is a key protection.
    Another key protection of the mobile driver's license is 
you as the holder can decide what elements of my information am 
I going to share with this individual. By contrast right now, 
if you think about every time you use your driver's license or 
identity card, you're physically handing that over to that 
person who may only need to know you're older than 21. Yet, 
you're giving them your name, your address, information about 
you, whether or not you're an organ donor. The list goes on and 
on and, whereas you only need to know I am old enough to make 
this purchase.
    So the ability for, as an individual, to say I'm only going 
to give you what you need, nothing more and nothing less, is 
the opportunity to protect that information.
    Ms. Lee. Thank you, sir.
    Mr. Grant, back to you, one of the things that you 
mentioned was attributing the lack of progress to DHS to their 
desire to wait on the International Standards Organization to 
develop standards. We've touched on CISA, NIST.
    Can you elaborate on the advantages of DHS not waiting for 
the International Standards Organization to finish their work, 
both in terms of immediately protecting millions of victims 
from identity theft, in addition to wanting to remain the world 
leader in the digital identification space?
    Mr. Grant. Yes, thanks for the question. So I'll preface 
this by saying that I mentioned in my written testimony, I used 
to work at NIST. I used to lead digital identity efforts there 
from 2011 to 2015.
    Generally speaking, the voluntary consensus-based standards 
process that we embrace, along with a lot our peers across the 
globe, is the best way to go. Every now and then, we have a bit 
of a crisis where we need to move a little quicker, and that's 
where I can think of at least two situations over the last 20 
years, where the White House or Congress have turned to NIST 
and said you've only got 9 months, 12 months and you've got to 
act.
    The first was in 2004 when President Bush issued Homeland 
Security Presidential Directive 12 in response to the need to 
have stronger IDs for Government workers and contractors. That 
was a Presidential directive. NIST provided FIPS, Federal 
Information Processing Standards, FIPS 201 within 9 months.
    The second was in the Obama administration when Congress 
deadlocked on cybersecurity legislation. So, they said, well, 
let's at least come up with a cybersecurity framework that can 
be voluntary that not only Government agencies but also 
industry can start to use to manage cybersecurity risks.
    It was an Executive Order in February 2013. A year later, 
because NIST only had a year, they rolled out the CSF. In fact, 
that's become the basis of an ISO standard today.
    I think we're at a moment right now with FinCEN's 
documented $212 billion in suspicious activity reports in 2021 
tied to compromised identity. The GAO said between $130- and 
$135 billion in pandemic unemployment benefits lost to 
fraudsters, again, mostly organized criminals in hostile 
nation-States.
    You add those numbers up, that's between $300- and $350 
billion just in two sectors, just in 1 year. We can't afford to 
wait, and I think this is why we're at a point where we should 
stop deferring to ISO in hoping the voluntary process works. 
Instead, we basically put NIST and really I think we really 
need a broader whole-of-Government effort to address what I 
really think is a crisis right now when it comes to identity-
related cyber crime.
    Ms. Lee. Thank you.
    Mr. Chairman, I yield back.
    Mr. Gimenez. Thank you.
    I now recognize the gentleman from Illinois, Mr. Foster.
    Mr. Foster. Thank you, Mr. Chair, for waiving me onto this. 
You know, we have been wrestling with this and, you know, for 
some years now. It's, you know, we're forced to sort-of spread 
our effort into multiple committees and multiple agencies, and 
that's slowed things down.
    I had a Zoom earlier this morning with a gentleman, Norbert 
Sagstetter, who is leading the European Union effort on this, 
and they're making impressive progress.
    You know, their goals are that I think by February, they 
will have passed the enabling legislation, and that by some 
time around 2026 or 2027, every E.U. citizen will have the--who 
wants one, will be able to get a secure digital ID they can 
present on-line to prove they are who they say they are.
    They are wrestling the same things that we have, where the 
States are going to be holding the biometrics and a lot of the 
key databases which people are comfortable with, and yet you 
need something which interoperates and prevents, you know, 
synthetic identity fraud and things like that.
    So, they are really doing the same, going through the same 
things we are and it seems to me like maybe a year ahead, which 
is sort-of ironic because their biggest collaborator is NIST, 
because all the standards that they're rolling out were 
actually developed at NIST years ago and they still consult 
with NIST.
    They're very eager also to collaborate with the United 
States, which I thought was very interesting, that they 
repeatedly approached me with the idea that we should be--the 
free democracies of the world should be working together on 
this because we are the--that's where you want to draw the 
fence on these efforts.
    So actually, Mr. Grant, could you say a little bit about 
your perception of what the rest of the world is doing compared 
to the United States?
    Mr. Grant. Thank you, Congressman Foster, and thanks for 
your leadership on this issue.
    We're at an interesting inflection point. I'm going to 
digress for about 15 seconds to say back in 2011, when I first 
joined NIST, I learned that when it came to payment cards, the 
United States had 25 percent of the transactions, but 50 
percent of the fraud, in other words, an eight-times-higher 
fraud rate because we were the only country that had not 
migrated away from insecure magnetic to more secure chip-based 
smart cards.
    It was only after the Target breach happened in 2013 where 
we had so much damage that finally the banks and retailers and 
other stakeholders said we need to start to move toward the 
rest of the world so we can erase all of this massive crime 
that we're seeing tied to our reliance on insecure technology.
    I think we're at an inflection point right now when it 
comes to identity where we are seeing all our peers across the 
globe--be it European Union, Canada, Australia, Singapore--you 
know, other countries that we tend to think of as our, you 
know, both often competitors, but also peers, every one of them 
has a strategy right now to try and address this issue of 
digital identity on-line. The United States is the only country 
that has no strategy whatsoever.
    So I worry that in a few years from both an economic 
competitiveness standpoint, along with the security losses that 
we're suffering because of identity-related cyber crime, 
compared to the rest of the world, we're going to be in 
somewhat of a dark place.
    Mr. Foster. You didn't mention India which is making 
really--you know, they came up with a basic identity, mandatory 
identity program for every Indian.
    There are lots of things that Americans would not be 
comfortable about their system. But after having established 
that, there's an incredible ecosystem of financial innovation 
that's come into being based on the ability to prove you are 
who you say you are on-line.
    When you get past that hurdle, then the start-up costs for 
fintechs are much smaller. There's a lot of enthusiasm, 
particularly among smaller banks, where one of their biggest 
costs is the cost of on-boarding customers. You remember during 
COVID when we had to bring a lot of unbanked individuals into 
the system? It was costing $400 to bring an un-banked person 
in.
    You know, in India it's essentially free. You just get out 
your cell phone, prove you are who you say you are, consult the 
list of bad actors. If you're not on it, boom, you've opened 
your bank account. That is, you know, that's an impressive step 
forward.
    Other countries are noticing it, and it's in the process of 
being adopted. The Indian system and their payment rails are 
being adopted by, you know, Singapore and Indonesia and the 
Philippines and so on, and as well as some of the Gulf states.
    So, you know, there's a danger that usually we spend a lot 
of time worrying that the Chinese currency is going to take 
over for the U.S. dollar. But I think there's a more real worry 
that the payment rails that were developed in India based on a 
secure digital ID will take over. So we have to--we have 
competitive worries to look at on that.
    So the other thing that I guess has been mentioned and 
talked about is the business of AI, AI and deepfakes which are 
really frightening.
    All the banks--I serve on Financial Services. The banks are 
all terrified by this because they use voice recognition. When 
people say what can Congress do about deepfake and AI 
generally, the No. 1 thing that we could do today is to have 
Federal recognition of mobile ID on-line to prevent people from 
being impersonated from this. That's--that should be a 
bipartisan thing that we can really move the ball forward on 
this.
    So thank you again for letting me participate in this.
    Thank you to our witnesses.
    Mr. Gimenez. You're quite welcome.
    I now recognize the gentleman from Louisiana, Mr. Higgins.
    Mr. Higgins. Thank you, Mr. Chairman.
    I thank our panelists for being here today.
    Mr. Stanley, having been on other side during the course of 
my life, many interactions with the ACLU, I look forward to us 
agreeing to something today. It would be a first in history.
    So I say that lightheartedly, because we are a free nation. 
Generally speaking, the purpose of this committee is to 
maintain the security of our homeland. But that's the security 
of our homeland is to maintain without sacrificing individual 
rights and freedoms of our citizenry. Or else what's the 
purpose of the security of the homeland?
    So this hearing touches on subject matter that is 
reflective of that need for balance. In my State of Louisiana, 
we were one of the first to push through, through our State 
legislature, digital identification. It was official through 
the State, recognized by the State.
    So as a cop, if I interact with you and I ask for your ID, 
for your driver's license, you can show me your phone. There's 
an official app on the phone that State--that's recognized by 
the State, that I can look at your documentation. So retail 
stores and State government offices and police officers, you 
know, recognize this digital ID, but TSA does not.
    So a common question that, you know, a conservative 
Republican like me, we hear back home is: Why we have 9, 10 
million illegals coming across the border, and I can't use my 
digital ID to get on an airplane but these guys get tickets 
from the Department of Homeland Security? You know, we pay to 
send them wherever they want to go anywhere in the country. 
That's sort-of a generalization of what's happening, but it's 
very accurate. It's pretty much true.
    So, Mr. Grossman and Mr. Grant, could you speak to what are 
the benefits of the expansion of official digital IDs as it 
relates to both enhanced security and protected individual 
rights and freedoms, which is, for Mr. Stanley, I'm going to 
hope we can agree on.
    Mr. Grossman and Mr. Grant.
    Mr. Grant. Sure. Well, it's great question. I'll say with 
regard, first, to Louisiana's mobile driver's license, 
Louisiana's definitely been an innovator here. It was one of 
the first States out of the gate.
    I will say with the draft regulations that TSA's put 
forward on MDLs, if the Louisiana ID or any other State ID 
that's gone forward on the mobile driver's license side meets 
those rules, they would be able to use that to board a plane. 
That's my understanding. I'll let TSA tell you that 
authoritatively.
    I think the balance between security and privacy is an 
important one, and where, as somebody who's generally--I've 
generally been a privacy advocate.
    Mr. Higgins. Between security and freedoms.
    Mr. Grant. Freedoms, yes.
    Mr. Higgins. Yes, sir.
    Mr. Grant. I think we can give people more privacy than 
they have today by architecting these solutions the right way 
in that, for example, if I hand my ID over at a bar, you can 
read everything about me, when what you only need to know is 
that I'm over 21. I don't get that question a lot these days, 
but there was a time when it mattered.
    Digitally, I can just share one attribute about me. The 
same with trying to do something on-line, everything that's on 
my driver's license might not be needed to be shared with the 
bank or with the fintech app that I'm trying to apply for an 
account with. But they can get those validated details about me 
that they need directly from the authoritative source rather 
than relying on some other solutions that are looking at other 
sources to try and guess if it's you or not.
    So I do think that, again, with the proper design, and this 
is why we're really calling for, sort-of a whole----
    Mr. Higgins. So if the digital designs, in the interest of 
time, would comply with, say, REAL ID, then you would see a 
path forward for not just for Louisiana but every sovereign 
State to be able to allow the citizenry the option of using a 
hard ID versus a digital ID?
    Mr. Grossman. That's under way already.
    Mr. Higgins. Yes, sir.
    Mr. Grossman, you concur?
    So, Mr. Grossman, do you concur?
    Mr. Grossman. Yes, I concur, and I would add, the reason 
why States are going down the road of mobile driver's licenses, 
as fascinating and as exciting as new technology is, the core 
driving purpose is, where does this technology allow us to 
improve on safety, security, freedom from the physical world?
    Mr. Higgins. Right.
    Mr. Grossman. So through all these testimonies, through the 
privacy, through the security, through getting it right, it all 
has to do with that driving purpose of making it better than 
the status quo of the physical world.
    Mr. Higgins. So, Mr. Chairman, my time has expired, but I 
would ask the indulgence of the Chair to allow Mr. Stanley to 
agree or disagree. It would be a historical moment.
    Mr. Gimenez. Yes, go right ahead, Mr. Stanley. Let's make 
some history here.
    Mr. Stanley. I thoroughly agree with you that----
    Mr. Higgins. That's it, I'm out.
    Mr. Stanley [continuing]. That it is vital to keep an eye 
on freedom even as we look at what a digital ID----
    Mr. Higgins. Thank you, Mr. Stanley.
    I appreciate the indulgence, Mr. Chair.
    Mr. Gimenez. All right. We have some time for a second 
round, and so I'll start with myself.
    Mr. Grossman, you know, we're talking a lot about the 
digital, the digital world and all, and digital IDs, but 
digital IDs are going to be based on a standard just like a 
hard copy ID right now is.
    So, while States may be offering digital IDs, there's no 
guarantee that they will be REAL ID. They may not be REAL ID. 
So that is not going to be as secure as REAL ID, or do you 
think that a State-issued non-REAL ID, you know, driver's 
license is as secure as a REAL ID, that that individual, in 
fact, is who they say they are?
    Mr. Grossman. Fundamentally, yes. This is because States, 
even before 9/11, even before the REAL ID Act, States were 
already recognizing the challenges of the vetting, identity, 
and credentialing process, and making significant changes and 
investments to producing a more secure credential, and a more 
secure vetting process to make sure someone is who they say 
they are.
    All credentials that U.S. DMVs issue, there is an 
enormously high level of confidence that that person is who 
they say they are. It is fundamental to their mission, and is 
something that they provide a high level of insurance 
regardless of the type of credential they're carrying.
    Mr. Gimenez. So what's the difference between a non-REAL ID 
and a REAL ID issued by a State?
    Mr. Grossman. So there are certain steps and documentation 
that Department of Homeland Security has identified as, we 
would like States to follow these steps to meet the REAL ID 
requirements in order to use the State driver's licenses for 
Federal purposes.
    The non-REAL ID credentials in the States that offer it, we 
would have to provide you a list by State. Some are very close 
to the REAL ID process, and some have different gaps in between 
the REAL ID process and the non-REAL ID process.
    Mr. Gimenez. Would it be easier for somebody to go into a 
State and say, I'm Mr. Grossman, and you may be Mr. Grossman, 
but then Mr. Stanley may go and say, I'm Mr. Grossman, and get 
a driver's license that says that actually that he's Mr. 
Grossman if it weren't a REAL ID? Which is easier to do?
    If it's not a REAL ID, would it be easier for Mr. Stanley 
to become Mr. Grossman or vice versa? Which is the more secure?
    Mr. Grossman. That would be--I can't answer that question 
of which one is more secure because our States are dedicated to 
making sure they're both secure.
    The fundamental challenge of someone coming in and claiming 
to be someone else is something DMVs are battling every single 
day, and that's why they're using every tool in the toolbox to 
fight that fraud, to stop that fraud, regardless of which type 
of credential someone is trying to get.
    Mr. Gimenez. OK. Now, my question, Mr. Stanley, why are 
States fighting the standards for REAL ID?
    Mr. Stanley. Largely the States have given up that battle. 
I think that a lot of REAL ID was about strengthening the 
security protections--you know, physical security protections 
on physical IDs, and that ship has basically sailed.
    Today's digital IDs are much more physically secure, as Mr. 
Grossman said, than they were before 9/11. That was going to 
happen anyway probably.
    Mr. Gimenez. I'm not talking digital ID. I'm talking REAL 
ID----
    Mr. Stanley. No, no, no.
    Mr. Gimenez [continuing]. Versus non-REAL ID, because the 
majority of the jurisdictions, they do not issue just solely 
REAL ID. They issue--they issue REAL IDs, but they also give 
you an option not to get a REAL ID, the majority of the 
jurisdictions.
    So why are States not just saying everybody's going to get 
a REAL ID in order to get a driver's license?
    Mr. Stanley. The REAL--I don't know exactly what a lot of 
the thinking is, but generally the objections to REAL ID is 
that it's a huge unfunded mandate from the Federal Government 
that imposed a lot of very particular regulations on exactly 
how the DMVs did their business.
    REAL ID was rammed through without hearings, without 
consulting with the DMVs, and the experts in the DMVs, exactly 
how they should proceed, and that led to a lot of the 
objections. In addition to objections, people saw it as a 
national identity system.
    I think that--you know, the answer of--the answer of, like, 
what is a REAL ID, it's whatever Homeland Security says it is. 
Under the regulation, under the law, they get to make up the 
regulations for what it is.
    The same thing will apply to digital ID, which is what the 
concern about digital ID is, is that we're leaving it up to 
Homeland Security, and specifically they've delegated it to 
TSA, to decide for the whole Nation what is and is not a REAL 
ID-compliant----
    Mr. Gimenez. What the standards are to get that digital ID, 
that's being left up to TSA and Homeland Security?
    Mr. Stanley. Correct.
    Mr. Gimenez. OK. I understand the issue now. All right. 
Thank you. My time is up.
    I now recognize the Ranking Member.
    Mr. Thanedar. Chairman, I'm good. Thank you.
    Mr. Gimenez. OK. Back to the gentleman from Louisiana, Mr. 
Higgins.
    Mr. Higgins. Mr. Wiediger, am I pronouncing your name 
correctly?
    Mr. Wiediger. You're close.
    Mr. Higgins. Wiediger? Mr. Wiediger, IDEMIA is rolling out 
the CAT 2 technology, correct?
    Mr. Wiediger. That's correct.
    Mr. Higgins. So one of the airports where that's being 
deployed is New Orleans. I anticipate, of course, it will be 
well-received, reflective of the training that our TSA agents 
and the CLEAR personnel and the airline personnel, the staff on 
the ground there, interact with the general public. Have you 
had pushback in any of your deployments that this committee 
should be aware of----
    Mr. Wiediger. We've had no----
    Mr. Higgins [continuing]. That's notable?
    Mr. Wiediger. We've had no pushback. TSA plans the activity 
closely with all the jurisdiction, all the airports that are 
gaining CAT 2s. Our teams go out and deploy them. There have 
not been issues that have arisen in the deployment of the 
assets. They've generally been very well-received.
    Mr. Higgins. If there's an update on the boarding pass, 
like in the absence of a boarding pass, which is one of the 
ways that this new technology can function, am I correct, is to 
coordinate the ID as presented and scanned with the records for 
the airline regard so a person would not have to have their 
boarding pass? Is that correct?
    Mr. Wiediger. That's correct.
    Mr. Higgins. OK. So that means that the technology would 
have some record of a boarding pass. Is that correct?
    Mr. Wiediger. So the----
    Mr. Higgins. In the absence of the traveler presenting a 
boarding pass, if you're saying that the technology will locate 
and confirm the boarding pass that's associated with the ID 
that's been presented and scanned and compared with the image 
of the person that's standing before it, then you're saying 
that the technology has possession of the boarding pass data 
for that individual, correct?
    Mr. Wiediger. In essence, that's correct. The platform is 
updated by TSA through their software back-end processes.
    Mr. Higgins. OK. So--and if--what if there's a variance of 
what the traveler believes is their accurate boarding data? 
They've upgraded or something like that, or if they've arranged 
to have seats adjoining with their traveling companion or 
something like that, like how fast is the technology updated 
from the airlines?
    Mr. Wiediger. I apologize. I don't have an answer for that. 
TSA controls that part. We don't do that piece as it relates to 
the boarding data. As it relates to their seats and the 
assignments, I don't believe that's a conversation at the TSA 
checkpoint, but I'd have to defer to TSA on that.
    Mr. Higgins. So that's just something we have to watch?
    Mr. Wiediger. I'm sorry?
    Mr. Higgins. It's just something we'll have to watch?
    Mr. Wiediger. Generally my understanding, based on the 
airline processing, is that's handled by the airline. So what 
TSA gets is the flight manifest to know that you're----
    Mr. Higgins. Right. But that's the boarding pass?
    Mr. Wiediger. Correct. Correct.
    Mr. Higgins. So you see what I'm saying, there's an 
intersection there between the new technology and the traveler 
and the airline as it relates to the details of the boarding 
pass. Don't want to get in the weeds there.
    So the gentleman, my colleague, brought up AI. Do any of 
you have concerns, in my remaining minute here? I mean, TSA is 
not deploying, is not using AI, but it certainly--at least not 
on the front line where there's intersections.
    I'm not saying there's no research being done, but at the 
point of intersection with American citizens, TSA is not using 
AI. Do you see it as an issue and a challenge, and if so, how 
and why? Because we certainly see it as an issue.
    Mr. Grant. I think the threat from AI when it comes to 
identity will probably be less acute in person and more on-
line, where we're seeing cheap deepfakes. You know, I can get 
15 seconds of your voice or a photo of you and suddenly you're 
on-line saying something you've never said before, never 
recorded before. I think this is going to be the new frontier 
in attacks in the cyber world where particularly, you know, I 
mentioned before, it's a bit of an anomaly when we see a big 
breach in identity, does it not provide the attack vector?
    I think that might be about to explode if we don't have the 
right defenses in place to be able to block some of those. But 
I think that's going to--this is actually an area where I think 
mobile driver's licenses, because they're rooted in public e-
cryptography, they can't be spoofed by AI----
    Mr. Higgins. OK.
    Mr. Grant [continuing]. Really important in the cyber 
world. The in-person world, my personal view is that's less of 
a threat.
    Mr. Higgins. Well, we certainly have to build guardrails 
into everything we do as we look at the emerging technologies 
of AI. Apologize, my time is expired, gentlemen, Mr. Chairman.
    Mr. Gimenez. Thank you. So that video I saw of you praising 
the former President, that wasn't you? OK.
    I recognize the Member from Illinois, Mr. Foster.
    Mr. Foster. Thank you. I appreciate it, again.
    Could you return a little bit to the phone-home problem? 
Because I, this morning, had a long discussion with the E.U. 
representative, because the worry that I understand is that if 
every time you present your mobile ID, there's a query made to 
the database to say, is this--the database maintainer, is this 
really valid or not then, which is a sort-of innocuous thing, 
until you realize that means they have a record of every time 
you presented it and potentially even where you were when you 
presented it.
    They believe, the European Union, believes that they have 
technological solutions that will make that not a worry. You 
know, Mr. Stanley, you're on the leading edge of this. Do you 
believe that that is something, if you pay attention to the 
rules under which you can demand a mobile ID, you know, maybe 
even license, making the collection of data from the mobile ID 
a licensable activity, which I think is the E.U. approach, 
whether this can actually be made into something that isn't 
really a privacy concern?
    Mr. Stanley. Yes. I mean, we have definitely called for 
off-line only, you know, verifications so that the verifier is 
not phoning home because, as you said, it creates a record--it 
gives a record to the DMV, whatever, you know, their vendor or 
whoever, of everywhere that you've showed your ID.
    Instead, they can just pre-download the public key of the 
DMV, and use the public key to verify that your digital token 
is: (A), was signed by the DMV, and (B), has not been altered 
by even one bit, and that solves that side of the tracking 
problem.
    There are other tracking problems where----
    Mr. Foster. There is also a revocation problem that if you 
say, there's the proof that I live in Naperville, Illinois, 
whereas I've, in fact, moved 2 months ago, at some point you 
have to consult the database. I have been told that there are 
ways to publish the revocation list in a way that's encrypted, 
so that the questioner can just sit there and ask a question of 
the encrypted database, and whoever's maintaining it won't even 
know which individual is being asked about.
    So, I was just wondering if that is ready for prime-time 
technology that could actually pretty much make this a 
nonissue?
    Mr. Stanley. So, No. 1, that's a question for a 
cryptographer, but my general understanding is that, yes, with 
new technologies such as zero-knowledge proofs, you can prove 
that you know something without revealing what it is that you 
know.
    There's currently a lot of exciting research and 
applications of these new cryptographic techniques that's being 
explored by cryptographers and others, and this is part of the 
reason we're saying let's take our time and do this right. 
Let's make use of those technologies.
    If they exist, it would be a pity if TSA and, you know, 
DMVs barrel ahead with this somewhat privacy-protective--on 
privacy-protective terms, primitive ISO standard rather than 
taking the time and working in these kinds of technologies that 
the European Union is looking at and so forth, so that we can, 
to some degree, have our cake and eat it too here, have the 
advantages that come from, you know, high technology but 
protect our privacy at the same time.
    Mr. Foster. Yes. It really highlights the difference 
between the end-use case. If you're getting on an airplane, the 
Government knows you're getting on the airplane. You know, 
there isn't an issue of phoning home there.
    But if you're buying something on-line, maybe the 
Government shouldn't know that you presented your mobile ID for 
that purpose.
    So, you know, it's really encouraging. I've been told by 
some cryptography types that this is actually a semi-solved 
problem at this point, and the European Union is trying to get 
that--we'll find out in February, I guess, when they roll out 
their official technical specifications and so on.
    Do you have any other comments on the whole concept of 
having collection of information a licensed activity, so that, 
you know, if you decide, OK, I'm holding a rock concert, I'm 
worried about terrorists sneaking in, and so for 24 hours 
afterwards, I want to maintain a record of who walked through 
the turnstile, maybe that's OK, as long as you get a license 
for collecting that information from everyone who walked in.
    If there's no terrorist event in 24 hours, you have--the 
terms of your license makes you destroy that kind of 
information. Is that the sort of thing that is contemplated in 
the United States?
    Mr. Stanley. I know that the European Union is looking at 
that approach. In many ways it seems like a characteristically 
European approach to things, and we don't have an opinion on 
whether that's the best way to, you know, impose limits.
    But we do think that one way or another, we need to make 
sure--because, you know, the fact that a digital ID makes it 
much easier and cheaper for a bank to know who you are--they 
don't have to go through these kludgy, face-recognition things 
and exploring databases to see if you can answer questions.
    It makes it much easier and cheaper for banks to know you 
are who you say you are, but that means it makes it cheaper an 
effort for everybody as well. So everybody is going to start 
asking you for your ID, and we have to pay attention to that 
flip side.
    So whether it's by putting in place laws that restrict who 
can ask for an ID and when, or a licensing scheme like that, we 
haven't thought deeply enough about that. We don't have a 
position on that, but one way or another it's the right goal.
    Mr. Foster. OK. Well, thank you. Again, I appreciate it, 
the witnesses.
    Mr. Gimenez. Thank you. From what I understand, one of the 
things that is actually at risk with AI is encryption and 
cryptology, and so, we put too many eggs in that basket. That's 
a subject to--that's a subject for another hearing, which by 
the way I think we're going to have a couple more hearings.
    This hearing actually is going to lead to more hearings, 
one with TSA about what's going to happen on May 7, 2025, 
specifically, and then, what are they doing as far as digital--
digital IDs themselves and their role in it.
    So with that, I want to thank the witnesses for their 
valuable testimony and the Members for their questions.
    The Members of the subcommittee may have some additional 
questions for the witnesses, and we will ask the witnesses to 
respond to these in writing. Pursuant to committee rule VII(D), 
the hearing record will be held open for 10 days being.
    Without objection, the subcommittee stands adjourned.
    [Whereupon, at 4:28 p.m., the subcommittee was adjourned.]

                              [all]