Digital Driver’s Licenses Could Become a Real Option in Some States

Digital driver's licenses may soon be a reality.

Digital driver's licenses may soon be a reality. RawPixel/Shutterstock

 

Connecting state and local government leaders

Several states have run pilots for digital driver’s licenses, which would allow residents to supplement plastic ID cards with smartphone apps. But as the technology becomes more of a reality, experts are worried about the privacy implications.

People with digital wallets on their smartphones, holding everything from credit cards to airline tickets, may soon be able to add a new feature: their driver’s licenses. 

While many lawmakers are excited about the potential of the technology to be used in a wide variety of situations, privacy experts are wary about potential data breaches.

Gemalto, a software vendor that has piloted this kind of technology with five states, designed their app to look like a digital replication of a physical driver’s license, but with different use cases to allow users to only share the information relevant to a particular scenario. Steve Purdy, the digital license project lead for Gemalto, explained that users can select from a menu of options, including law enforcement stops, TSA checkpoints, age confirmation for liquor and lottery ticket sales, and pharmacy identity confirmations.

“In each case, you only have to authorize the information necessary for the person checking your ID,” he said. “The biggest advantage to a digital license for the user is the privacy control.”

Purdy said that one of the clearest benefits to the state is the quickness with which law enforcement can verify someone’s ID at traffic stops. “Law enforcement is our biggest stakeholder,” he said. With that new process, police officers hand a card with a QR code to the driver, who scans it with their app, sending their information to a terminal in the squad car. 

Gemalto offers two different types of verification methods. With one, a 2D barcode is projected that can be scanned by another phone or a tablet. With the other, Near Field Communication is used, similar to what users display with Apple Pay, to establish an encrypted contactless information transfer. Gemalto piloted this technology over two years under the supervision of the National Institute of Standards and Technology, through partnerships with Washington D.C., Maryland, Colorado, Wyoming, and Idaho. 

Renée Krawiec, the driver services deputy program manager for the Wyoming Department of State, was both the project manager and a participant in the pilot in her state. Krawiec said the state is exploring a timeline for a full roll out, where digital licenses would be optional and supplemental to physical ones. “First, we definitely want to make sure that we’ve gotten feedback from legislators, and buy in from the rest of state government, so that when it is rolled out, the program is successful,” she said.

Legislators in Maryland have already approved electronic credentials as a valid form of identification, and Gemalto is in discussions with the state about production, making the state a likely candidate to be the first to debut the technology in the next year.

But Michele Gilman, a law professor at the University of Baltimore, questioned whether Maryland is ready to introduce a digital option when the state is still struggling to get all residents compliant with Real ID laws. “The DMV is not the bureaucracy that fuels the most comfort amongst the citizenry,” she said. “Just because digital licenses will be recognized as a valid credential doesn’t necessarily make it a reality on the ground. But one good thing with legislation is that it can always be refined and changed as we learn more.”

Gilman also worried that state legislators who are approving digital license technologies may not fully understand how they work. “The state often procures these services, and they not only contract out development and delivery, but also the knowledge of how they function,” she said. 

Jay Stanley, a senior policy analyst with the ACLU’s Speech, Privacy, and Technology Project, agreed that lawmakers need to lean on the expertise of independent, disinterested technological privacy experts who can ensure that vendor systems are being built in the proper way. “If a company’s product is becoming part of a core government function, that company’s insistence on proprietary trade secrets needs to go in favor of independent evaluation,” he said. 

Stanley said that location tracking is the main concern with digital licenses, but that there are different ways for a system to be set up to provide stronger user privacy. One would be to take a system offline, as Gemalto has done with theirs at the recommendation of NIST. When verifying a license offline, the app doesn’t connect to the back-end architecture, which disables the ability to track location. Another would be to use strong encryption, so that if an app pings the DMV for confirmation of the license’s authenticity, the DMV can certify the information without revealing who the license was issued to. “That type of ‘fancy math’ is here today and doable,” he said.  

Stanley said the best systems would publicly release their code. “With such an important application of technology, it’s crucial that it be public so people can verify that the code is working as advertised,” he said. “That way we can see that privacy is baked in, and don’t have to take anyone’s word for it.”

Krawiec, however, said she isn’t concerned with the safety of Gemalto’s app on the front-end, since she used it firsthand throughout the Wyoming pilot. The data is stored in secure element on a user’s phone, and the app requires an additional security measure, like a passcode or a fingerprint, to be opened.  “I’ve seen that the security of the digital credentials myself,” she said. “And feedback from users in the pilot was addressed, so there was a very high level of confidence in their personal security.”

Not all states in the pilot were as enthusiastic as Maryland and Wyoming, though. The Idaho DMV left Gemalto’s pilot program, choosing to focus instead on “keeping the current DMV system stable and working towards its modernization.” Jennifer Gonzalez, of the Idaho Department of Transportation, said that they are “closely monitoring other states that are piloting the program.” 

Other states that didn’t participate in the pilot are also moving into the space. Virginia, Iowa, and Louisiana are at varying stages of the legislative and piloting process. In addition, the American Association of Motor Vehicle Administrators is working on standards to ensure that disparate systems conform when people cross state lines with digital IDs. 

Purdy estimated that in 10 years, over 50% of the population would be using a digital ID, and one day, physical licenses may be obsolete. 

Stanley agreed that digital licenses are likely to become a widespread reality soon. “Overall, if something like this is done exactly right, it could be a good thing for privacy, as users could submit the minimum amount of information needed in a given situation,” he said, citing the example that a bartender doesn’t need to know someone’s organ donor status. “But if done poorly, this could be a disaster for privacy. That’s why it needs to be done right.”

Emma Coleman is the assistant editor for Route Fifty.

NEXT STORY: It Takes Years to Fully Recover from Big Storms Like Sandy

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.