REAL ID is 'giant bullseye for every hacker in the world,' security expert warns

The May 7th deadline is finally here for the new "REAL ID" – a federally standardized identification designed to link your identity to facial recognition systems at US airports and federal facilities. But in “REAL” terms, how secure is it? Security experts weigh in.

Unless you’ve been in a coma recently, you’ll already know that starting Wednesday, US travelers must now present a pesky “REAL ID” if they want to board domestic flights and access certain federal facilities.

But, one security insider tell Cybernews that the now-required ID is really (no pun intended) a surveillance superweapon and a target for hackers worldwide.

“With REAL ID and TSA Touchless ID, travelers are entering a new era of biometric identity checks at airports,” explained Joshua McKenty, Co-Founder & CEO of Polyguard, a cybersecurity firm specializing in deepfake and AI-powered fraud protection.

“This isn’t just about faster lines or tighter security—it’s a real-time experiment in how facial recognition can either empower individuals or expose them to new risks,” he said.

McKenty’s concerns stem from the fact that the US government has just created “one national super-database” linked to all 50 state-level Department of Motor Vehicle (DMV) databases, connecting the REAL ID holders’ “biographic information with their biometric data.”

“Ergo, a giant bullseye for every hacker in the world, and an as-yet unused surveillance superweapon,” McKenty said.

The REAL ID requirement for domestic flights starts today. If you don’t have a state-issued REAL ID yet, remember that you can also use a passport to meet the requirement. Find the list of acceptable IDs at https://t.co/SxlrYayGtn. pic.twitter.com/tT3NsiLmgh

undefined Travel - State Dept (@TravelGov) May 7, 2025

"Most travelers don’t realize that opting out at the checkpoint does little to protect their privacy; their facial biometrics were already captured when they procured a passport, driver’s license, or REAL ID document,” McKenty points out, adding that deletion policies are inconsistent and increasingly opaque at best.

“As deepfakes and synthetic identities proliferate, the integrity of biometric systems is crucial – not just for personal privacy, but to prevent fraud, impersonation, and identity theft,” he said.

Convenience, surveillance, and security

Andrew Bud, founder and CEO of iProov, a biometric security solutions firm, believes that its crucial to understand how the REAL ID fundamentally benefits US citizens.

“REAL ID offers a higher integrity and more trusted form of identity evidence. This increased trust also makes it much easier when interacting with organizations across government, financial services, and healthcare companies, and significantly enhances protection against identity theft,” Bud explained.

Bud also said that the integration of the REAL ID “lays the foundation for future identity verification methods like mobile driver’s licenses (mDLs) and facial biometrics,” helping to build a “trust economy” within the US.

With the rise in cybercrime and the misuse of generative AI to create deepfakes and synthetic identities, Bud said “verifying that someone is who they claim to be, whether in person or online, is critical.”

Even so, McKenty, also a former Chief Cloud Architect at NASA, noted that "biometric systems – especially those combining ID cards and facial recognition – create a growing 'trust paradox' between convenience, surveillance, and security."

“The stakes are rising,” McKenty said. “Yet the debate remains stuck in a false binary between total surveillance and total anonymity, missing the opportunity to build systems that foster both trust and freedom.”

The CEO said the REAL ID rollout is far more than just about travel. “It’s about setting a new standard for digital trust in the age of AI-powered deception,” he said.

“As federal standards evolve and privacy concerns intensify, the future of biometrics will be defined by how much power we return to the individual," McKenty said, adding that organizations should also be adopting identity verification systems designed with consent, transparency, meaningful opt-out, and true portability.

This will allow individuals and organizations to “manage and benefit from their own data,” he added.

Information for travelers

Although the US Homeland Security chief Kristi Noem said on Tuesday that those traveling on May 7th without a REAL ID will still be able to fly on Wednesday with a passport or passport card, they should still expect additional security checks.

That's welcome news for the millions of Americans who spent hours on lines this week at REAL ID Supercenters and Departemnt of Motor Vehicles offices across the nation, scrambling to become 'REAL ID compliant.'

“Trust is at the heart of this shift, and importantly, consumers with valid driver’s licenses or passports can be confident that DMVs and state governments aren’t asking for any new personal information,” Bud said.

The US Transportation Security Administration (TSA) said those travelers without the REAL ID should plan to “show up early and be prepared for advanced screening to avoid causing delays.”

Here’s the nitty gritty of what the TSA wants the public to know for the May 7th deadline:

• A REAL ID does not replace your passport if you’re flying internationally.
• Children under 18 do not need a REAL ID if they’re flying domestically.
• If you have only have a regular state ID or driver’s license and no other acceptable form of ID, you may be directed to a separate area for additional screening.
• Any paper receipt given to you by the DMV does not count as a REAL ID, but you should bring that to the airport along with your non-REAL ID license to help speed up additional screening.

For more informtion on the REAL ID and an up-to-date explanation of requirements for US travelers, both domestic and international, you can visit the DOH website here.