The Cybersecurity Implications of Digital Driver‘s Licenses
The humble driver‘s license is finally getting a digital upgrade. Many U.S. states are in the process of launching digital versions of state-issued IDs that reside in a smartphone app, promising convenience and security. But what are the cybersecurity and privacy implications of this transition to digital identity?
How Digital Driver‘s Licenses Work
A digital driver‘s license (DDL) is essentially an electronic copy of the physical ID card you currently carry in your wallet. But rather than just a static image, a DDL is a verified, secure digital credential.
The process starts by downloading your state‘s authorized DDL app and scanning your physical driver‘s license or ID card. You then take a selfie which is compared to the photo on file with the DMV using facial recognition algorithms. This biometric verification ties the digital ID to you and prevents someone from creating a DDL with a fake identity.
Once issued, the DDL displays your photo and the same information as your physical card like name, address, and date of birth. But these details are digitally signed by the state to certify their authenticity and prevent tampering.
When you need to present your digital ID, you unlock it with your phone‘s biometrics or passcode. The verifier can check the cryptographic signatures to validate it was issued by the state and hasn‘t been altered. If applicable, you could choose to only share certain details, like only your age when buying alcohol.
Securing Digital Identity
The main concern with putting IDs on phones is security – what if a hacker could steal your digital driver‘s license or make a fake one? DDL apps use multiple defenses to prevent this:
-
Encryption: All DDL data is encrypted both in storage and in transit using secure cryptographic algorithms like AES-256. This prevents attackers from intercepting or accessing the raw information.
-
Tokenization: Rather than transmitting your actual ID details when scanned, DDLs use a secure token system. The token only contains the minimum necessary information for that validation.
-
Blockchain: Some DDL implementations are exploring blockchain ledgers to create an immutable record of when and where an ID is presented, without storing the underlying personal data.[^1]
-
Secure hardware: DDLs can be stored in secure hardware partitions like Android‘s Titan M chip or Apple‘s Secure Enclave, which isolate sensitive data from the operating system.
-
Biometrics: Accessing a DDL requires strong authentication, typically with fingerprint, face recognition, or a PIN. This ensures only the owner can unlock and present their digital ID.
Several states have now published technical specifications for their DDL implementations following the ISO 18013-5 standard.[^2] This defines a common set of security and interoperability requirements for protecting the integrity of mobile driver‘s licenses.
[^2]: "Personal Identification — ISO-Compliant Driving License — Part 5: Mobile Driving License Application." International Organization for Standardization, 2021, https://www.iso.org/standard/69084.html.Digital ID Adoption and Usage
Digital driver‘s licenses first started rolling out in 2021, but adoption is rapidly accelerating. As of April 2023:
- 3 states have an active digital ID program (Arizona, Maryland, Oklahoma)
- 12 states have launched pilot programs or plan to deploy in 2024 (Utah, Louisiana, Colorado, Idaho, D.C., Florida, Iowa, Kentucky)
- 10 more states plan to launch DDLs by 2024 (California, Georgia, Hawaii, Mississippi, Ohio, Texas, Virginia, Washington and others)[^3]
Apple was first to market with an implementation of a mobile driver‘s license for iOS devices in partnership with selected states. The first two states, Arizona and Maryland, launched in March 2023. Google recently announced upcoming support for DDLs in its updated Google Wallet app for Android, with more details expected at the company‘s I/O conference in May 2023.
Internationally, digital identity programs are even further along. In Brazil, the national ID card has been available in a digital version via an app since 2017.[^4] As of 2022, over 100 million Brazilians had downloaded the digital ID app. Argentina, Columbia, and Peru have launched similar mobile national ID programs. In Europe, Germany, the Netherlands, and Estonia all have digital IDs tied to their national ID cards.[^5] [^4]: Mari, Angelica. "Brazil Leads the World in Digital ID Adoption." Forbes, 27 Jan. 2022, https://www.forbes.com/sites/angelicamarideoliveira/2022/01/27/brazil-leads-the-world-in-digital-id-adoption/.
[^5]: Garron, Olivier. "Europe‘s Digital Identity Wallet Is One Step Closer." NIST, 7 June 2022, https://www.nist.gov/blogs/cybersecurity-insights/europes-digital-identity-wallet-one-step-closer.A key test for DDL adoption will be acceptance by the TSA for air travel in place of physical IDs. The TSA has been running trials of its mDL Reader technology to electronically verify mobile driver‘s licenses at select airports since 2022.[^6] If the pilot is successful, TSA checkpoints could soon widely accept DDLs, further driving consumer adoption.
[^6]: Transportation Security Administration. "TSA to Accept Digital Driver‘s Licenses." Department of Homeland Security, 20 Apr. 2022, https://www.tsa.gov/news/press/releases/2022/04/20/tsa-accept-digital-drivers-licenses.According to a 2023 survey by identity verification company Thales, 70% of U.S. consumers would "gladly adopt mobile driver‘s licenses" if given the option.[^7] The top reasons cited were convenience (32%), security against loss/theft (28%), and contactless identity verification (23%). However, 45% expressed concern that a DDL could make it easier for authorities to track their activities and movements.
[^7]: Thales Group. "Digital Driver‘s License Adoption Research in the USA." Mar. 2023, https://www.thalesgroup.com/en/markets/digital-identity-and-security/government/identity/digital-identity-services/mobile-drivers-license/trends-report.Concerns and Risks
As with any major technological shift, the rise of digital driver‘s licenses and mobile IDs presents both opportunities and challenges from a cybersecurity and privacy perspective.
The core concern is that as our most sensitive personal identifiers move to connected devices, it opens up new risks of that data being hacked, leaked, or abused. Some specific issues that privacy advocates have raised include:
-
Tracking and surveillance: Because DDLs are verified electronically, they could enable new forms of tracking – a central database logging each time you present your ID. Some fear this infrastructure could allow the government to trace your activities and movements in ways not possible with physical IDs that are not scanned.
-
Overexposure of data: For in-person ID checks today, a human only needs to briefly see your physical card. But transmitting ID data digitally to a scanner or another device could expose more details than necessary for that particular situation, or enable covert retention of that data.
-
Scope creep: Critics worry that once digital identity frameworks are established for driver‘s licenses, the infrastructure could easily expand to other credentials like health insurance cards, gun permits, school IDs, or even social credit scores, massively concentrating sensitive personal data.
-
Remote revocation: Just as DDLs can be issued digitally, they could also be remotely suspended or revoked by authorities without due process. Would the government be able to turn off a digital ID and instantly render someone unable to drive, travel, or access services?
-
Hacking and forgery: No software is unhackable. Attackers will undoubtedly seek to exploit any bugs in DDL systems to steal personal data, make unauthorized changes, or forge fake IDs. A compromised digital ID would be a goldmine for identity theft.
These risks are real but must be weighed against the security benefits of digital driver‘s licenses compared to physical IDs. A card in your wallet lacks any encryption, access controls, or real-time validation. If lost or stolen, fraudsters could easily use it for identity theft and you would have no way to revoke it.
DDL proponents argue that done properly, putting IDs behind biometrics and cryptography raises the bar significantly. Even if someone stole your phone, they couldn‘t unlock your digital ID without your face or fingerprint, much like how stolen smartphones are useless to thieves today. If your digital ID is compromised, you could remotely wipe it and reissue a new one within minutes.
The Path Forward for Securing Digital Identity
So how do we realize the benefits of mobile IDs while addressing these risks? It starts with baking in privacy and security controls from the beginning. Experts recommend several key principles:
-
Consent and control: Users should have granular options over which data they share for any given interaction. Just like app permissions, you should be able to select whether to disclose your full address or just your photo.
-
Decentralized architecture: Rather than one central database, digital identity systems should use decentralized identifiers (DIDs) and verifiable credentials (VCs) to let users store their own data locally and only share attestations when needed.[^8]
-
Zero-knowledge proofs: Cryptographic schemes like zero-knowledge proofs can enable verifying claims about identity attributes without revealing the underlying data, such as proving you‘re over 21 without disclosing your birthday.[^9]
-
Offline mode: To prevent tracking, some experts argue DDLs should be usable without an Internet connection and store no record of past usage. Data should only transmit locally between the user‘s device and verifier.
-
Open standards: For digital IDs to be widely accepted, they must be interoperable across jurisdictions and platforms. Open technical and regulatory standards are needed for consistent implementations.
The good news is that many of these best practices are already being incorporated into emerging standards for mobile IDs like the ISO 18013-5 specification and the EU‘s eIDAS framework.[^10] But realizing the vision will require ongoing collaboration between policymakers, technologists, and civil liberties advocates.
[^10]: Graux, Hans. "Progress and Plans for eIDAS 2.0 Toolbox." 4 Oct. 2022, https://ec.europa.eu/cefdigital/wiki/download/attachments/499238905/2_Slides_%20OIX_eIDAS%20Toolbox.pdf.The Future of You
Make no mistake, a profound shift is underway in how we prove who we are in the digital age. The smartphone is becoming the center of identity, not just a communication device but a repository for our most sensitive personal credentials.
Digital driver‘s licenses are a crucial step in this evolution, but ultimately just the beginning. With the infrastructure in place, expect to see digital health insurance cards, student IDs, professional licenses and more migrating to mobile wallets. Even passports could one day be primarily digital documents, enabling entirely touchless border crossings.
Further out, visionaries predict digital IDs will expand beyond simple authentication to power smart contracts and programmable identity.[^11] Imagine your DDL automatically launching a car insurance claim after an accident, or your digital health ID instantly verifying vaccine status to board a flight. As Web3 and the metaverse take shape, self-sovereign identity anchored in mobile devices will be key to securely navigate virtual worlds.
[^11]: "Decentralized Society: Finding Web3‘s Soul." E. Glen Weyl, Puja Ohlhaver, Vitalik Buterin, 11 May 2022, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4105763.None of this will happen without overcoming major obstacles – technical, legal, political, and cultural. An ID is perhaps the most personal data we have, and many will understandably resist connecting it to the Internet. Building public trust will require unprecedented transparency, user control, and limits on government power.
But while there are risks in racing ahead, there are also risks in standing still. Today we rely on physical ID cards and manual checks rife with security flaws. In a world rapidly digitizing in every other way, identity must evolve too. Putting IDs on our phones is not about creating a digital panopticon, but catching credentials up to how we actually live and interact.
The transition won‘t happen overnight, but the age of the mobile ID is coming. Digital driver‘s licenses are the first step in a paradigm shift toward decentralized, tokenized, and privacy-preserving identity for the 21st century. How well we navigate this shift will shape the very fabric of digital life. The future of you is in your pocket.