Digital IDs for Securing Personal Information

Digital driver’s licenses can offer greater protection of personal information, and some states are already skipping the line at the DMV

From submitting personal information over email to scheduling telehealth appointments, safe and verifiable forms of personal identification are crucial. While physical driver’s licenses are standard, they can be stolen or forged. To improve security and ease of use, some states have developed digital driver’s license programs, and even the federal government has signaled its interest in digital IDs. The most common form of digital ID – a mobile driver’s license, or mDL – allows the license holder to authorize the sharing of only those personal details that are absolutely necessary for specific types of transactions. For example, when purchasing alcohol at a liquor store, a mDL could show only a person’s name and age, and hide other personal information, such as an address, and even an exact birth date. Furthermore, forging digital identification is more difficult than forging traditional ID because of public key cryptography, where virtual information, in this case a driver’s license, is encrypted, and can only be decrypted through a virtual verification system that authenticates the ID. This technology is more advanced than the barcodes used to verify identification on traditional driver’s licenses. These systems can help prevent forgery and reduce underage purchases of products such as alcohol and tobacco.

Beyond typical uses of physical driver’s licenses, mDLs could be helpful in the healthcare and finance sectors. Applying digital identification to patient records can increase the accuracy of electronic health records, and also make medical records more accessible to patients. A streamlined authentication process enabled by digital identification can improve banks’ fraud management and support their compliance with verification guidelines that foster financial companies’ abilities to identify their customers as potential money laundering risks. Deploying verified forms of digital identification can improve users’ experiences and modernize operations for institutions moving toward digital services.

Given the success of mDLs in states like Illinois, Oklahoma, and Louisiana, Congress is laying the groundwork for the widespread adoption of digital identification. In Louisiana, drivers can get a mDL by paying $5.99 to download the LA Wallet app, and since the app’s launch in 2018, it is being used by 670,000 residents – nearly 20% of all Louisiana drivers. Louisianans can also upload their COVID-19 vaccination status into the app, or verify their identities when registering for the Disaster Supplemental Nutritional Assistance Program in the wake of a hurricane. LA Wallet is the first mDL app legalized by a state government, and Louisiana has set the standard for how mDLs could operate nationally. In December 2020, Congress passed the REAL ID Modernization Act, which updated federal identification guidelines, authorized the use of electronic driver’s licenses, and established the beginnings of protections against unwarranted smartphone seizure by law enforcement when using a mobile identification app. The act gives states a deadline of October 1, 2021 for all Americans to be issued a REAL ID-compliant driver’s license, which can be switched to a REAL ID-compliant mDLs.

These proposed digital solutions for identification are not without their downsides. mDLs have been flagged by civil society groups, like the American Civil Liberties Union, that are raising concerns about surveillance risks. One such risk is unwarranted police access to non-ID content on phones when mobile driver’s licenses are presented to police officers during traffic stops. Another risk is that because the licenses would be linked to the Department of Motor Vehicles and an app developer, the issuer or verifier could use their direct access to personal information, such as where people are shopping or visiting, for unlawful purposes – like the federal government observing and prosecuting activity, such as purchasing marijuana, that is legal in a particular state. Additionally, if this technology becomes a legal requirement rather than an opt-in choice, it could further disadvantage people in vulnerable communities who do not own smartphones.

A mDL is just one option for more secure identification systems, and in order to make mDLs widely available, issues such as (i) having reliable internet access to use the app, (ii) the affordability of smartphones should mDLs become required, and (iii) the guarantee that user information is secure from unauthorized tracking must be addressed before a federalized system is put in place.

This CSPI Science and Technology Policy Snapshot expands upon a scientific exchange between Congressman Bill Foster (D, IL-11) and his new FAS-organized Science Council.