We live in an era where private information such as one’s age, home address, e-mail address, phone number and other data are increasingly being verified, collected, analyzed, used and sold.
Most of the processes involved with these practices happen behind the scenes and out of sight; the only time we see the results of this information invasion is when we receive junk mail or spam, or when we specifically seek it out through credit reports and background checks. Most Americans would probably agree that it’s acceptable to release some of this information to the federal government (in order to collect federal benefits such as Social Security and Medicare), and to the state in which they live (to obtain a driver’s license, business license or vehicle registration).
But does anyone want personal data such as a person’s name, address, photograph, age, physical characteristics, driving record and Social Security number in the hands of bar, restaurant and liquor store employees and owners? Such businesses across the United States are installing electronic devices that scan and verify state-issued driver’s licenses, specifically to determine if the potential patron is old enough to be sold alcohol. What they do with any data they collect is unclear.
How does it work?
As of this writing, there are two types of license scanning devices: those that merely decode and examine the data on a license’s magnetic stripe or two-dimensional barcode in isolation, and those that read this data and verify it against a remote database. Both kinds of devices are generally designed to record some kind of data, ostensibly so that businesses that sell alcohol can have an electronic record that shows its patrons’ ages were verified. But they potentially could serve as a way of keeping a detailed customer contact database for marketing purposes.
All currently issued U.S. driver’s licenses have magnetic strips that contain text information including, usually, a person’s name, address, physical characteristics, organ donor information, driving restrictions, Social Security number and date of birth. Many driver’s licenses also have a two-dimensional barcode, which resembles a rectangular strip of black square dots and lines. The 2-D barcode can generally hold up to 2 kilobytes of data, enough to store all of the previously mentioned text data and a small photograph.
Both storage methods are unencrypted and stored in open, highly documented data formats, so there is no secret or proprietary technology involved with reading them. Driver’s license scanners read your card’s data using one or both of these interface technologies.
You could foil license scanning by de-magnetizing your magnetic strip or taking a black marker to the 2-D barcode. However, such tactics generally violate state law and will more than likely invalidate your ID card. Many states require that drivers keep their license cards in good condition; if you do not, you’re subject to a fine. There does not appear to be any law against placing a sticker over the machine-readable portions of your driver’s license, however.
License Scanners and the People Who Make Them
There are few players in the driver’s license scanner market. The two companies at the heart of the hardware end of the industry are Intelli-Check Mobilisa and Scan Technology Inc. In addition to designing and selling business-grade license scanners for age verification, Intelli-Check Mobilisa also designs similar machines for the U.S. military and various state and federal government agencies. Its business-class products are designed to scan any state-issued ID that has a magnetic strip or two-dimensional bar code.
Both of these companies refused to participate in an interview for this article. STI did not respond before press time; Intelli-Check Mobilisa initially agreed, but when the CEO saw the following questions, he refused to answer them:
• How do your machines verify driver’s licenses?
• Who owns the driver’s license database?
• What information is accessed? What information is recorded?
• Where is your datacenter located?
• Is there any evidence that suggests that the introduction of license scanners has reduced underage drinking?
The answers to most of these questions involve examining the security of your personal data, which is held by at least one entity unknown to you, the scanned consumer. The final question asks whether or not scanning licenses is effective in the way that both legislators and store, bar and restaurant owners are led to believe.
How is This Legal? The Florida Example
State laws may vary, but most citizens would probably hope that their state prohibits releasing driver’s license and other personal information to third parties.
The state of Florida is very specific about what it does and does not allow with regard to driver’s license data. Your driving record, as it turns out, is public information — anyone can request that information. They cannot request your personal information, though, such as your driver ID number, name, address, medical disabilities, phone number, Social Security number (which, since the execution of the federal Intelligence Reform and Terrorism Prevention Act of 2004, cannot be printed on driver’s licenses issued after 2005), emergency contact information or any other information that can personally identify you.
Section 119.0712 of the Florida Statutes specifically lists exemptions to the personal information policy. In summary, it says that health care agencies, licensed private investigators, police, employers checking the validity of information submitted by employees, private businesses, but only to verify information an individual submits to them, and anyone who has your express written permission can access the personal information printed on your driver’s license, among other government agencies acting on official business.
The emphasis in the previous list may be how liquor stores, bars and restaurants get away with scanning driver’s licenses — at least in Florida — but the argument that this practice is legal is thin at best because when you buy alcohol, you are not specifically submitting any personal information. The defense argument would no doubt be that buying alcohol and/or handing over your license to the clerk or waiter is an implied or actual submission of age information. Asking someone to present their license as proof of age is apparently perfectly legal in any setting; however, the government will not hand out information equivalent with what’s printed on your license unless it meets one of the specific exemptions listed in 119.0712.
The Florida state government also provides for companies like Choicepoint and others to access and retain personal information for the purpose of reselling it, as long as those agents or agencies follow the rules:
Personal information made confidential and exempt may be disclosed by the Department of Highway Safety and Motor Vehicles to an individual, firm, corporation or similar business entity whose primary business interest is to resell or redisclose the personal information to persons who are authorized to receive such information. Prior to the department’s disclosure of personal information, such individual, firm, corporation or similar business entity must first enter into a contract with the department regarding the care, custody and control of the personal information to ensure compliance with the federal Driver’s Privacy Protection Act of 1994 and applicable state laws.
Furthermore, the company selling access to the driver’s license data must maintain a record of every person or company that requests access to that data so that the state government can audit it at any time. Lastly, this statute is due to expire in 2012 if it is not specifically renewed before then.
Swipe: Exposing the Loophole
While accessing government-supplied driver’s license data can be illegal, the mere act of scanning a license is not. And while it may be illegal to record the information encoded on a license, it is not illegal to use some of that information to look up your personal details through other data collection services such as Experian, Acxiom or Choicepoint, to name a few. There is no shortage of agencies that collect and retain consumer personal information, records and metadata.
If you think this scenario is impossible or unlikely, the folks at Swipe are ready to prove you wrong.
Swipe is part protest, part performance art. The Swipe site provides a wealth of information about driver’s license scanners and the laws that pertain to them. The same people who provide the Web site also put on a show when requested for certain events; they bring a nice-looking, fully-stocked, portable bar with a license scanner and a hacked cash register. When a patron buys a drink, their license is scanned and after a few minutes the bartender completes the drink order and hands over a detailed receipt with all of the personal information that Swipe could collect based on what was scanned from the driver’s license.
If Swipe can do it, so can any private business that employs a license scanner, except instead of a detailed receipt, you may receive more junk mail. If there is, somewhere, a record of your alcohol purchases, it’s also possible that such records could be subpoenaed in a court of law for any kind of case, from a DUI to a divorce. Data collected in one context for a legal purpose may eventually be used for other reasons and with less ethical intentions.
Checking IDs
If everyone involved with scanning your license followed the rules and behaved ethically, you would be perfectly safe from privacy intrusions and unwanted marketing efforts.
Unfortunately, state laws are inconsistent, the federal laws have loopholes and there isn’t a great deal of specificity on the penalties for violating your privacy; doubtless they are not terrifically painful for multimillion-dollar corporations, even though the consequences for the individual consumer may be financially disastrous. This article only covers license scanner laws and practices as they apply in the state of Florida, but your state may have different laws and statutes. (Texas does not allow any private use of driver’s license information.)
Investigate your state’s laws to determine what license scanning companies and end-users might be able to do with your driver’s license information. In some cases, it could be extremely dangerous for driver’s license information to fall into the wrong hands. In Arizona in the recent past, Social Security numbers were used as driver’s ID numbers. SSNs are the key to identity theft.
Driver’s license scanners may be effective in weeding out cheap false driver’s licenses (which are illegal to make or possess in most states), but they can do little to impede underage drinking because the personal information required to truly verify that a license belongs to the person in possession of it cannot, by federal law, be released under those conditions.
You could hand over any valid driver’s license to a bouncer, clerk or waiter, and the burden of ensuring that the license belongs to the person who presented it is still on the human being; the machine only verifies that the data on the magnetic or, less commonly, the two-dimensional barcode, is in a valid format, not expired and that the recorded date of birth meets the age requirement. In many cases, those charged with age verification responsibilities are only looking for a quick yea-or-nay response from a machine that they trust to verify license data.
During this author’s testing of license scanner policy at a liquor store, a restaurant and a bar, none of the people who scanned licenses looked at the photograph, or verified the holographic image on the face of the ID card — for all they knew, the card could have been blank with a valid magnetic stripe on it.
Where license scanners were not in use, clerks, waiters and bouncers visually identified patrons by photograph and mentally verified age via the printed date of birth, proving once again that while machines may be secure, human beings are not.
