IP: Finding Pay Dirt in Scannable Driver's Licenses

[David Farber <dfarber () earthlink net>]

-----Original Message-----
From: Hal DeVore <haldevore () acm org>
Date: Thu, 21 Mar 2002 10:32:58 
To: farber () cis upenn edu
Subject: Finding Pay Dirt in Scannable Driver's Licenses


Something for the IP list.

--Hal


http://www.nytimes.com/2002/03/21/technology/circuits/21DRIV.html?pagewanted=print&position=bottom

  March 21, 2002
Finding Pay Dirt in Scannable Driver's Licenses

By JENNIFER 8. LEE

BOSTON -- ABOUT 10,000 people a week go to The Rack, a bar in
Boston favored by sports stars, including members of the New
England Patriots. One by one, they hand over their driver's
licenses to a doorman, who swipes them through a sleek black
machine. If a license is valid and its holder is over 21, a red
light blinks and the patron is waved through.

But most of the customers are not aware that it also pulls up
the name, address, birth date and other personal details from a
data strip on the back of the license. Even height, eye color and
sometimes Social Security number are registered.

"You swipe the license, and all of a sudden someone's whole life
as we know it pops up in front of you," said Paul Barclay, the
bar's owner. "It's almost voyeuristic."

Mr. Barclay bought the machine to keep out underage drinkers who
use fake ID's. But he soon found that he could build a database
of personal information, providing an intimate perspective on his
clientele that can be useful in marketing. "It's not just an ID
check," he said. "It's a tool."

Now, for any given night or hour, he can break down his clientele
by sex, age, ZIP code or other characteristics. If he wanted to,
he could find out how many blond women named Karen over 5 feet
2 inches came in over a weekend, or how many of his customers
have the middle initial M. More practically, he can build mailing
lists based on all that data ? and keep track of who comes back.

Bar codes and other tracking mechanisms have become one of
the most powerful forces in automating and analyzing product
inventory and sales over the last three decades. Now, in a trend
that alarms privacy advocates, the approach is being applied to
people through the simple driver's license, carried by more than
90 percent of American adults.

Already, about 40 states issue driver's licenses with bar codes
or magnetic stripes that carry standardized data, and most of the
others plan to issue them within the next few years.

Scanners that can read the licenses are slowly proliferating
across the country. So far the machines have been most popular
with bars and convenience stores, which use them to thwart
underage purchasers of alcohol and cigarettes.

In response to the terrorist attacks last year, scanners are now
also being installed as security devices in airports, hospitals
and government buildings. Many other businesses ? drugstores and
other stores, car- rental agencies and casinos among them ? are
expressing interest in the technology.

The devices have already proved useful for law
enforcement. Police departments have called bars to see if
certain names and Social Security numbers show up on their
customer lists.

The electronic trails created by scanning driver's licenses are
raising concerns among privacy advocates. Standards and scanning,
they say, are a dangerous combination that essentially creates a
de facto national identity card or internal passport that can be
registered in many databases.

"Function creep is a primary rule of databases and identifiers,"
said Barry Steinhardt, associate director of the American
Civil Liberties Union, citing how the Social Security number,
originally meant for old-age benefits, has become a universal
identifier for financial and other transactions. "History teaches
us that even if protections are incorporated in the first place,
they don't stay in place for long."

But companies that market the scanning technology argue that it
poses no threat to privacy.

"It's the same information as the front of the license," said
Frank Mandelbaum, chairman and chief executive of Intelli- Check,
a manufacturer of license-scanning equipment based in Woodbury,
N.Y. "If I were to go into a bar and they had a photocopier, they
could photocopy the license or they could write it down. They are
not giving us any information that violates privacy."

Machine-readable driver's licenses have been introduced over
the last decade under standards set by the American Association
of Motor Vehicle Administrators, an umbrella group of state
officials.

Under current standards, the magnetic stripe and bar codes
essentially contain the same information that is on the front of
the driver's licenses. In addition to name, address and birth
date, the machine-readable data includes physical attributes like
sex, height, weight, hair color, eye color and whether corrective
lenses are required. Some states that put the driver's Social
Security number on the license also store it on the data strip.

The scanning systems present a challenge to efforts by state and
federal governments to limit the amount of information that can
be released by departments of motor vehicles. In 1994, Congress
passed the Driver's Privacy Protection Act, largely in response
to the murder of Rebecca Schaeffer, an actress who was killed in
1989 by an obsessed fan who had found her unlisted address by
using California motor vehicle records.

Before the law was adopted, states were selling driver's license
information to direct marketing companies, charities and
political campaigns. Businesses selling, for example, fitness
products and plus-size clothing were able to focus on customers
within a given range of height or weight.

While the privacy act staunched the flow of information from
state motor vehicle departments, there are only spotty controls
over how businesses can create such databases on their own. In
Texas, the driver's licenses can be electronically scanned for
age verification, but the information cannot be downloaded from
the machine. In New York, businesses are only allowed to store
name, birth date, driver's license ID number and expiration
date for the purpose of age verification. Many states require
people to give consent to be on marketing lists, but businesses
generally interpret consent to mean not actively removing their
names from a list.

When Mr. Barclay, the bar owner, saw a demonstration of
Intelli-Check (news/quote)'s driver's license scanner at a trade
show in 1999, he was surprised. "It had never dawned me that that
strip had information on it," he said.





For archives see:
http://www.interesting-people.org/archives/interesting-people/