National Conference of State Legislatures

Real ID Final Regulations: Brief #3

Physical Security of DMV Facilities and Databases; DMV Employee and Applicant Background Checks

January 16, 2008

This is the third brief in a series summarizing "Subpart D" of the final regulations for implementation of the Real ID Act of 2005. Brief 4 will focus on the physical security features of the Real ID card. A copy of the final regulations and other NCSL resources on Real ID, including other briefs, are available at: http://www.ncsl.org/realid/

Physical Security of DMV Facilities and Databases

Under the Real ID Act, a state must ensure “the physical security of locations where drivers’ licenses (DL) and identification cards (ID) are produced and the security of document materials and papers from which DLs and IDs are produced.”

NCSL, governors and motor vehicle administrators recommended that facility-based risk assessments and mitigation plans be included as part of a state’s self-certification process (for additional information on state self-certification, see Brief #1).

State Security Plans

The final regulations require that a state’s comprehensive security plan address:

the physical security of the facilities used to produce and store materials used in Real ID card production;
the security of personally identifiable information maintained at Department of Motor Vehicles (DMV) locations;
documents and physical security features of Real ID cards (see Brief #4);
access controls for DMV employees and contractors, including:
- employee identification and credentialing,
- employee background checks, and
- controlled access systems;
periodic training requirements for employees, including fraudulent document recognition programs and security awareness training;
emergency/ incident response plans;
internal audit controls; and
an affirmation that the state has the authority and means to protect the confidentiality of persons issued Real ID compliant ID and DL in support of federal, state and local criminal justice agencies, or special licensing or identification programs to safeguard ID holders in their official capacity.

Physical Security Requirements of Real ID Facilities and Storage Areas

States must take measures to ensure the physical security of facilities used in the manufacture and issuance of Real ID-compliant DLs and IDs, however, DHS does not stipulate the manner in which a state secures its facilities.

Security of Personally Identifiable Information

The regulations stipulate that states must take reasonable efforts to protect the personal information used to comply with the requirements of the Real ID, including protections to prevent unauthorized access, use or dissemination of such information. State security plans must detail policies and procedures for document retention and destruction; states must also institute a privacy policy for information collected and maintained by the DMV under the requirements of the Real ID. In addition, states must maintain minimum protections regarding the release and use of personal identifiable information under existing federal law (contact NCSL for more information).

Employee Background Checks

Under the Real ID Act, a state must ensure that “all persons authorized to manufacture or produce drivers' licenses and identification cards [are subject] to appropriate security clearance requirements.”

NCSL, governors and motor vehicle administrators recommended that states be allowed to:

identify those staff (employee/vendor/contractor) involved in the manufacture and production of DLs and IDs who require security clearance, as part of the state’s self-certification;
subject employees to a minimum of a state and federal background checks;
grant new hires provisional clearance pending results of a background check ;
enumerate disqualifying criteria in the state self-certification, as well as procedures for interim hiring pending results of background checks; and
have a means to deal with the realities of operative personnel laws, regulations and labor relations agreements applying to pre-existing employees.

Under the final regulations, states must conduct background checks on:

all persons involved in the manufacture or production of a Real ID compliant DL and ID;
persons that may affect the information on a Real ID compliant DL and ID; or
current employees or contractors that will be assigned to such positions, or a “covered employee” that meets the first two qualifications.

“Covered employees” are defined as “DMV employees or contractors who are involved in the manufacture or production of Real ID [DL] or [ID], or who have the ability to affect the identity information that appears on the [DL] or [ID].” Each state will also determine which applicants, employees or contractors will be subject to the background check. In addition, states will be required to provide notice to the applicant, employee and contractor that a background check will be conducted.

The background check must include, at a minimum:

a validation of references from prior employment;
a name-based and fingerprint-based criminal history records check through the state and two FBI’s databases—National Crime Information Center(NCIC) and Integrated Automated Fingerprint Identification System (IAFIS) (at the cost of the state); and
employment verification as otherwise required by law.

However, background checks substantially similar to the requirements of the regulations do not have to be repeated if conducted on or after May 11, 2006.

The regulations established a bifurcated system for disqualifying an applicant for employment due to a criminal history. Under a “permanent disqualifying criminal offenses,” any “covered” applicant, existing employee or contractor is disqualified from employment if the employee or applicant is convicted of certain felonies (for more details contact NCSL).

Under a “interim disqualifying criminal offenses,” a “covered” applicant, employee or contractor may also be disqualified, absent a state adopting a waiver process, if:

convicted of a disqualifying offense within 7 years of the date of employment;
released from incarceration within 5 years of the date of employment; and
under a felony warrant until the warrant is released.

If a state determines that an applicant does not meet the standards of the criminal history records check, the state must notify an applicant of the determinination to allow an applicant to appeal to the applicable court of jurisdiction.

For more information contact NCSL staff Jeremy Meadows (Jeremy.Meadows@ncsl.org, 202-624-8664) or Garner Girthoffer (Garner.Girthoffer@ncsl.org, 202-624-7753).