The American Civil Liberties Union (ACLU), Center for Democracy & Technology (CDT), Electronic Frontier Foundation (EFF), and Electronic Privacy Information Center (EPIC) submit these comments in response to the Transportation Security Administration’s (TSA) notice of proposed rulemaking on a REAL ID requirement waiver for state-issued mobile driver’s licenses (mDLs). TSA is proposing to establish a case-by-case system for exempting state mobile driver’s license programs from REAL ID Act requirements and to impose an interim set of standards for mDLs drawn from various federal government information technology standards
and standards proposed by private industry groups.
We urge the TSA not to shortcut the ongoing development of a privacy-preserving digital identity system by exempting mobile licenses from REAL ID requirements before such a system emerges. We ask: what’s the hurry? There is no popular demand driving TSA adoption of mDLs, and no reason to rush into incorporating them into the airline security process — especially given that doing so will have repercussions far beyond the airport context. At the same time, there are substantial risks to privacy, civil liberties, and a well-functioning mDL system created by defining standards for acceptable mDLs before all of the technology and infrastructure exists to support reliable, privacy-preserving digital identities. Even if the TSA chooses to go ahead despite risks of vendor and technology lock-in, the agency still should not rely on standards proposed by private groups like the American Association of Motor Vehicle Administrators (AAMVA) and the International Organization for Standardization (ISO). …