Coming soon to a republic near you: https://www.aclu.org/issues/privacy-technology/national-id/r...
The US seems to have one of the most vulnerable systems when it comes to identity theft, between SSNs being used as bearer tokens and utility bills being used as proof of residency.
National ID cards can be done in very concerning, but also very privacy-preserving ways. For example, the German ID card has an e-ID function that lets you assert minimal statements about yourself (e.g. you can provably assert "I'm over 18 years old and live in Berlin", without sharing your exact date of birth or name with the requesting party).
Something like that seems desperately needed in the US. Security questions (largely sourced from data in the public record) and taking a photo of your driver's license isn't going to cut it much longer, in a world of daily database breaches and plausible deepfakes.
We need a national ID without a national registry. The simplest (from a legal perspective) might be a national clearinghouse that polls states' registries.
It’s much simpler to eat the cost of a national registry and avoid all sorts of logistical challenges of coordinating across 50 States’ and 5 territories IT systems and disparate standards on record keeping.
For elections they need to keep track of each person’s status: EU citizens might be able to vote in local election in another EU country, but not national ones, so they have to record this type of information.
These three things are different: you can live in a country, pay taxes in another, and vote in a third. I guess states are just good at keeping records.
To prove you live, you would do it the same way as in the US/UK if I understand correctly, with whatever evidence you have. Rental contract in your name, utility bill, property deed, ... If you live with your parents and don't have anything in your name, they need to write a signed attestation you live there. And so on. It's not uncommon for the police to knock on your door and check if you actually live where you claim to if they have a doubt.
It's an absurd system. Why should you need to prove to the government you live anywhere? How much money is wasted sending policemen to knock on doors? And how does your absence at a given random moment prove anything at all about where you reside?
Locals are generally surprised, in my experience, when I tell them that Australia has no system of registered permanent abode at all. If you have a driver's licence, and you move, you probably want to update your address with the motor bureau, which you generally do online with no documentation at all. No one verifies your new address or particularly cares about it, because the only thing it affects is where you get sent mail (it has no legal consequences like council tax, as it does in the CR, etc). Other than that it's your business what address you give where. No one will ever demand you prove your 'registered address of permanent abode' because no such thing exists.
It fits into a broader pattern where everyone in Europe must have some kind of 'status' recorded. What's your registered place of permanent abode? What's your status with the mandatory state health insurance? For tax purposes, are you 'employed' or 'self-employed' or 'student' or 'retired'? Are you registered for self-employment with the social security bureau? There's generally no grey areas, and if you somehow fall outside the norm, they truly don't know what to do with you.
You have not experienced Europe until you've had a civil servant glower at you because there's no drop down box for what you're telling them, and this is very much something they want you to know is your fault. Can't you just be normal?
I think in countries where the majority of tax receipts come from income tax, they care a lot more about where you live than in countries like the US (and Australia apparently?) where they rely more in property taxes.
I'd say a big difference would be some system where there is no central registry at all vs. a system where one does exist. But a pseudo-central vs. central system hardly seems like a different solution.
Perhaps one benefit of a segmented or partitioned system is that it can be 'disconnected', but that would also mean that if you need to interact with anything non-local that is now also not possible. And the other way around it would do the same thing (i.e. "depeering" a partition) where you wouldn't be able to verify any identity within that partition.
The difference between centralisation and decentralisation. States can fight back against the federal government's requests in a way that is simply not feasible for almost any person.
> a pseudo-central vs. central system hardly seems like a different solution
Under this model, the e.g. TSA wouldn't be allowed to keep a copy of your ID. It would have to poll for it anew each time.
Looping back to the above: the TSA making this promise to us is almost meaningless. The TSA making this promise to the states could create real problems for it if it were found to be breaking the law.
> that would also mean that if you need to interact with anything non-local that is now also not possible
Correct.
I don't understand this idea. Usually there is more variance in the behavior of lower-level governments, while higher-level governments will be closer to the mean. If there is a real risk that the federal government will abuse its power in a certain way, many state governments must already be abusing their powers that way. And the same also holds between state governments and local governments.
The smaller the administrated population, the more likely the government is either really great or really bad. But because the government can more easily do harm than good, lower-level governments are worse on the average.
It can be argued that while the average state/local government is worse than the federal government, your government is special. But that is only plausible if there are persistent cultural differences between your area and the rest of the country. And I don't mean differences in political opinion but in things like corruption and respect to the rule of law. That could happen if there is little immigration from other areas to your area, or if immigrants must live there for a long time and prove that they fit in before they gain full rights.
Which is why the sanest level of government is usually the one corresponding to citizenship.
The point is in shattering that power. If it's all at the federal level, there is nobody who can realistically check its mis-use. While at the state level, mis-use will be (a) contained and (b) checkable.
Literally this article.
(Not saying it's consistent with our various national registries. But it's not some dumbshit concern.)
> every other developed country has one
American culture is uniquely individualistic. Our First Amendment, for instance, remains unique despite having hundreds of years of precedence.
That's where you see states that ban abortion and force religious views into education for instance, to take one extreme, and they sure don't want a ruling entity to tell them they can't do so. Same applies to any subject, including identifying people (I'm pretty sure there's a sizeable number of people who don't want any official ID at all, even limited to their town, under no circumstance)
Basically, where some countries/federations will strive for unity and common values, the US keeps an idea of letting extremes run around in their own pockets of land and sometimes sit in the country's driver seat.
That's close but not quite right. The idea is that by solving matters as locally as possible, it lets people with strongly held opinions on the government coexist more easily. One person thinks abortion is a fundamental right everyone should have, another thinks it's tantamount to murder and a moral abomination. Neither is budging, so instead of having half the country at each others' throats as they try to force their views on everyone, it can be better to let them solve these issues locally. Then we have a better chance at getting along as a whole, because we can each find a community where our values are upheld and "live and let live".
That's the idea, at any rate. There are various flaws we see in practice, and perhaps the idea is untenable in this day and age. But it's fundamentally an attempt to gain unity where otherwise there would only be division. And of course it's also tied to a strong cultural mistrust of government (especially centralized government), as I mentioned in my other post.
Florida is 22.6M people. That's not very "local" if you ask me.
States' rights are a concept that people value for its own sake, and are not automatically an attempt "to make it seem like the civil war was justified".
For better or for worse, Americans have a strong distrust of government in our civic DNA - the more centralized, the more distrust. The very design of our country's government is intended to distribute power as much as feasible, while doing only the bare minimum of activities at a national level. This design has been eroded over time (the 20th century in particular did a huge number on it), but many Americans still hold that vision dear. Thus, any proposal of "let's do a centralized X" is automatically controversial in the US in a way which it simply would never be in many other countries.
> Pretty every other developed country has one.
This sort of argument is not a good reason for anyone to do anything, but it's especially not a good reason for countries to base their national policies on.
Furthermore, the current identification systems are already being abused by surveillance companies as corroborating keys to facilitate their creation and storage of permanent dossiers on us. Until that is fixed (eg a US port of the GDPR that applies to every industry), I have absolutely no desire that the technical strength of identification be increased. People's hesitation at giving out their identifying info is basically the only thing holding back every single medium or large business from demanding even more of it.
This hasn't stopped a lot of negligent businesses from performing a fake authentication process that skips actually verifying the physical document and having people enter various fields from the ID card for some kind of dog and pony show, but the point remains there is still nothing to revoke.
The absence of such digital authentication methods is also a big problem in the way photo IDs are commonly used in the US ("take a photo of it, or maybe a video and wiggle it around a bit").
But it seems orthogonal to revocation, which would help when presenting a lost/stolen ID physically, e.g. to open a bank account or apply for credit card. (Not that that seems to be the most common way identity fraud is actually done these days in the US, so the lack of digital authentication seems to be the worse problem here.)
Other than taking the physical document, what is there to revoke? The state unilaterally declares Bob Smith's name is no longer Bob Smith? The state declares that one of Bob Smith's names is no longer #12345678?
I think your point is that physical IDs could be augmented with an online digital revocation method - every issued ID could have a serial number, for which there could be an online database to look up whether that specific issued credential has been reported lost or stolen. But that seems like just another give away to banks (etc) of one more talking point to hassle their own victims with - "When we were defrauded by someone presenting your ID, you had not yet reported it stolen, which [somehow] means that you are responsible for covering our losses". Never mind the Kafkaesque situation of someone being suddenly told that the document they're carrying is no longer valid due to some unknown-to-them happenings (this is already bad enough with things like car registrations).
Really, the biggest problem with identity-based fraud continues to be aligning the incentives, such that the negligent institutions that get defrauded can no longer externalize the damage they caused onto everyone else. The extreme hassle of us having to clean up the banks' messes is the only reason this is a subject of popular concern.
The state revoking the statement "license #12345678 is a valid credential for Bob Smith".
> I think your point is that physical IDs could be augmented with an online digital revocation method - every issued ID could have a serial number, for which there could be an online database to look up whether that specific issued credential has been reported lost or stolen.
Yes, that's exactly what some ID-issuing entities already do! That's why e.g. US Department of State strongly advises against traveling with a passport previously reported lost or stolen [1].
I don't think this is commonly available to non-governmental ID-validating entities such as banks in the US, but it arguably ought to be.
You raise a very good point on banks potentially attempting to shift liability to customers for any resulting fraud – that's something that would have to be legally clarified before such a system is made available widely.
That, and the fact that banks would still not want to miss out on the significant volume of online account openings, which would actually require a digitally-verifiable credential (the "photo of ID" pattern is truly absurd), are probably the primary reasons for why this does not exist yet in the US (with a healthy dose of historical distrust in government institutions and some immigration-related state vs. federal disputes sprinkled on top).
[1] https://travel.state.gov/content/travel/en/international-tra...
"#12345678" as I used it was the "driver's license number". This isn't a serial number for the issued credential, but rather a numeric name for the given person. Adding a serial number for each issued credential such that there can be an online revocation protocol might make sense, but it's not what we have now.
Banks, and especially online banks, are definitely optimizing for account opening convenience rather than caring about fraud. They could most certainly require a notarized form to open an account (which requires verifying an ID in person), they'd just rather not because it would interrupt some new customers signing up. Which is why I say the main regulatory reform we need starts with making them fully cover the damage they've opted for. If they continue to make the same tradeoff that's fine - as long as they stop harming the public with the backscatter.
Also as I said in my original comment, we need a privacy law like the GDPR before it makes sense to support any smoother systems of authentication. The existing identification systems are already being abused so routinely and thoroughly by the surveillance industry, so this isn't an abstract concern. As things currently stand there are virtually no regulations on creating surveillance dossiers, so the more friction keeping businesses away from frivolously asking for ID (and then backhauling your activity), the better.
There's also a barcode on the back that looks high-entropy enough that it could at least contain a URL, and maybe even a digitally signed statement by the issuing authority.
Between these two things alone, it should be possible for an issuing authority to publish a document number revocation list that verifiers can query in a privacy-preserving way (i.e. without the issuer learning who's checking somebody's license when)
> the more friction keeping businesses away from frivolously asking for ID (and then backhauling your activity), the better.
Is it, though? Banks and even random places like Airbnbs still regularly ask me for a photo of my driver's license for all kinds of purposes, so arguably this is the worst of both worlds: Pervasive data collection without actual security against fraud.
How would this be any worse if the ID verification was at least more secure, if not hopefully also more private (which is more likely with a digital signature than with a photo of a license in any case; how would you anonymize the photo of something inherently identifying)?
The point is that an SSN/name pair is not a mechanism of authentication. Many companies are negligently using it in place of one because they don't actually care about fraud, having pushed most of the damage onto the public. Then they invented the nonsensical concept of "identity theft" to enshrine how they wish things worked, as a further fuck you to the public. So no, further entrenching anything about that broken approach is a horrible idea. Revoking a social security number makes as much sense as revoking someone's natural name.
I don't understand your point what high speed rails have to do with privacy.
They are not required for trains and buses.
https://www.reuters.com/world/europe/russia-opens-terrorist-...
Millions of Americans face risk of a toxic ‘bomb train’
https://www.washingtonpost.com/climate-environment/2024/01/2...
Less than a year ago, a disastrous train derailment sent a massive plume of dangerous chemicals billowing over East Palestine, Ohio, startling the town of nearly 5,000 residents and onlookers nationwide.
Now, a new report warns that more of these catastrophes may loom: At any given moment, more than an estimated 3 million people are unknowingly at risk, as toxic trains full of a highly combustible and carcinogenic chemical used to make plastic move between Texas and New Jersey.I don’t travel by train these days so I have no idea whether that has happened again.
I agree, which is why we should dismantle the TSA immediately. They provide negative value to this country.
...for now.