Real ID debate prompts fears about disclosure of Alaskans' Social Security numbers

JUNEAU — Gov. Bill Walker's administration this week said it's trying to pull back its participation in a multistate driver's license database that critics fear could expose Alaskans' Social Security numbers if it were hacked.

The state Division of Motor Vehicles has been sending the last five digits of residents' Social Security numbers to the multistate agency that runs the database, which is used to ensure applicants don't have licenses in more than one state.

But with the Walker administration pressuring lawmakers to bring the state into compliance with the federal Real ID Act, it's run into questions about its collaboration with the agency on its existing licenses and what could happen if the database was breached.

Current Alaska licenses are not Real ID compliant.

Until 2011, the Social Security Administration issued the same three-digit prefix — 574 — for all Alaska applicants' Social Security numbers.

That would leave only one unknown digit — a 1-in-10 chance — if a hacker stole the contents of the driver's license database, maintained by the American Association of Motor Vehicle Administrators, a consortium of U.S. and Canadian DMVs that includes Alaska.

Sheldon Fisher, the commissioner of the Alaska Administration Department  — which oversees DMV — on Tuesday wrote to AAMVA asking if it could limit the database to four digits, citing the potential problems if the database were hacked.

"I think it's a legitimate concern," Fisher said in an interview Wednesday. "We think that's a fair point and we will work to try to change that."

But security-concerned lawmakers are asking for more than a switch from five digits to four, which would still leave an Alaska Social Security number vulnerable, with a hacker facing a 1-in-100 chance in uncovering the actual ID number. Encryption keys typically have tens of thousands to millions of possible combinations.

Fisher spoke outside the Senate Finance Committee room where he'd just testified on the Real ID Act. The federal anti-terrorism legislation, approved in 2005, sets minimum security standards for licenses.

And the U.S. Department of Homeland Security is now threatening noncompliant states that their driver's licenses will soon stop being accepted at airport security screenings and federal military bases.

The current deadline is June 6 for military bases and restrictions at airports kick in January 2018.

The Alaska Legislature passed a bill in 2008 barring state agencies from spending money to comply with Real ID, with the sponsor, Anchorage Democratic Sen. Bill Wielechowski, calling its requirements the start of a "surveillance society."

Now, with deadlines for compliance just months away, Walker's administration — along with organized labor and contractors that do business on military bases — is pressing lawmakers to repeal the 2008 law.

[Legislative inaction on Real ID could be real problem for Alaskans]

Its new legislation — Senate Bill 34 and House Bill 74 — also tries to accommodate Alaskans' privacy concerns by offering so-called "noncompliant" licenses that would not be subject to Real ID's record-keeping and verification.

But in their review of the legislation — it got eight hearings in the House State Affairs Committee — lawmakers began asking questions about the AAMVA database.

The federal government says the AAMVA system will fulfill a Real ID Act requirement that states share data with each other. But the law doesn't require a specific agency to work with, and only 14 states are currently participating in AAMVA's database, according to its website.

Alaska has been using it since January. The state has submitted 660,000 records to the database, which now contains references to 36 million drivers. The actual driver data is kept by each state — the AAMVA system has "pointers," or shortened records, which reference the licensed drivers.

While the system will facilitate Real ID compliance, Walker administration officials say they're using it now because it makes it easier to cross-reference applicants' information with other states' data — which was previously done either manually or by requesting batch reports, said Marla Thompson, Alaska's DMV director.

"It was very clunky," she added.

Digital privacy advocates, however, say Alaska's participation in the database — and its inclusion of Social Security information, which is especially valuable to identity thieves — poses an increased risk if residents' personal information is stolen.

They also object to the collection of so many records in a centralized system operated by a nonprofit contractor, rather than a government entity directly accountable to the public.

A better system would have allowed states to digitally check applicants' data with each other state, said Tara Rich, legal and policy director for the Alaska branch of the American Civil Liberties Union.

"This could have been created totally differently. There was never a requirement that it be housed in one central location," Rich said in a phone interview. "These databases are breached regularly — we see it all the time."

Officials at AAMVA declined to be interviewed. But in an email, a spokesperson, Claire Jeffrey, said "security has been a design requirement since Day One."

The AAMVA system uses private, encrypted network connections for all data storage and exchange, according to Jeffrey.

Lawmakers have been pondering what to do about the AAMVA system as they've debated Walker's legislation.

A new substitute version advanced by the House State Affairs Committee would bar the state from sharing any data not required for the federal government to certify Alaska as compliant with the Real ID Act.

It would also direct Walker's administration to negotiate an agreement with AAMVA to allow the state to participate in the database without using Social Security numbers, and to publish an annual report on the results of its efforts.

"We live in a sort of brave new world in which cybersecurity as a concern is going to compound with each passing year — and to any extent you can minimize risk makes sense," said Sitka Democratic Rep. Jonathan Kreiss-Tomkins, the committee's chair.

But there's also a balance between privacy and government functionality, and the DMV has become "vastly more efficient" in recent years, Kreiss-Tomkins said in an interview.

"People love to gripe about the DMV being inefficient," he said. "It's realistic to be aware of that inherent tension. And you can't ask both things at the same time."