NOTE:  At end of article are many links

with a ton of information.

By Anita Ramasastry

FindLaw columnist
Special to CNN.com

(FindLaw) -- In May 2005, Congress

passed the "Real ID" Act, which

requires states - starting in May 2008 -

to issue federally approved driver's

licenses or identification (ID) cards to

those who live and work in the

United States.

Unlike the USA Patriot Act and other politically sensitive pieces of legislation, Real ID has not made many headlines. Last fall, it was voted down. But then it was reintroduced, and tacked onto the 2005 Emergency Supplemental Appropriations for Defense, the Global War on Terror and Tsunami Relief. (Real ID hence superseded conflicting portions of the Intelligence Reform and Terrorism Prevention Act of 2004.)

Hearings might have revealed that Real ID is going to create many headaches and nightmares for citizens, lawful permanent residents and state governments, which already labor under an unfunded mandate.

More than 600 organizations have expressed concern over the Real ID Act. Organizations such as the American Association of Motor Vehicle Administrators, the American Library Association the Association for Computing Machinery, the National Council of State Legislatures, the American Immigration Lawyers Association and the National Governors Association are among them.

'Real' requirements

The Real ID Act's identity cards will be required if one wants to drive, visit a federal government building, collect Social Security, access a federal government service or use the services of a private entity (such as a bank or an airline) that is required under federal law to verify customer identity.

It will be nearly impossible to live without such an ID. That creates a huge incentive for citizens and residents to get IDs and for states to comply with this unfunded mandate: If they didn't, their citizens and residents wouldn't be able to get access to any of the services or benefits listed above. Estimates of the cost of compliance range from $80 to $100 million -- and states will have to pay.

To get a new approved license, or conform an old one to Real ID, people will have to produce several types of documentation. Those records must prove their name, date of birth, Social Security number, principal residence and that they are lawfully in the .

Once created, the IDs must include the information that appears on state-issued driver's licenses and non-driver ID cards -- name, sex, addresses and driver's license or other ID number and a photo.

The act requires photos to be digital so authorities can include them in the multi-state database, which I discuss below. But the IDs must also include additional features that drivers' licenses and non-driver ID cards do not incorporate.

For instance, the ID must include features designed to thwart counterfeiting and identity theft. Unfortunately, while including such features may sound appealing, on the whole, these IDs may make our identities less safe.

Even with current, unlinked databases, thieves increasingly have turned their attention to DMVs. Once databases are linked, access to the all-state database may turn out to be a bonanza for identity thieves.

Finally, the IDs must include a "common machine-readable technology" that must meet requirements set out by the Department of Homeland Security. And, somewhat ominously, Homeland Security is permitted to add additional requirements -- which could include "biometric identifiers" such as our fingerprints or a retinal scan.

Privacy violations risks

It's that "machine-readable technology" requirement, along with the possibility of Homeland Security add-ons, that raises the most serious risk that the Real ID Act will cause privacy violations. (The fact that the technology must be "common" also raises the already-high risk of identity theft.)

Many commentators predict that radio frequency identification (RFID) tags will be placed in our licenses. (Other alternatives include a magnetic strip or enhanced bar code). In the past, the Department of Homeland Security has indicated it likes the concept of RFID chips.

RFID tags emit radio frequency signals. Significantly, those signals would allow the government to track the movement of our cards and us.

Private businesses may be able to use remote scanners to read RFID tags too, and add to the digital dossiers they may already be compiling. If different merchants combine their data -- you can imagine the sorts of profiles that will develop. And unlike with a grocery store checkout, we may have no idea the scan is even occurring; no telltale beep will alert us.

The State Department -- which is going to be use RFID devices in our passports -- is including some safeguards, but the Real ID Act requires none. At a minimum, the Real ID Act ought to be amended to ensure that -- as will be the case with passports -- national IDs have covers that will prevent them from being scanned when closed, and that the data inside will be encrypted so that it cannot be read until, and unless, it has been swiped and activated through a reader.

Act amendments

The Real ID Act ought to include the same privacy measures -- encryption, and some sort of metallic covers -- that the State Department uses to protect the privacy of passports.

And the Real ID Act ought to be amended to allow persons in danger to give only a P.O. box address; to accommodate the reality that homeless people may have neither an address nor a P.O. box.

In addition, Congress should appropriate funding to help the states in what will be a massive compliance effort -- rather than leaving them with this expensive, unfunded mandate. Lack of funding will only encourage the states to cut corners, defeating the act's purpose.

Finally, states should be able to choose to provide licenses to undocumented immigrants. Otherwise, such immigrants may end up driving without licenses or insurance. If they have accidents, their victims will have no recourse. And it's likely they will have accidents -- for there will be no reason for them to take driving lessons or tests, since a license will be out of the question.

Anita Ramasastry, a FindLaw columnist, is an associate professor of law at the University of Washington School of Law in Seattle, Washington, and a Director of the Shidler Center for Law, Commerce & Technology.