In “Getting Started with Digital ID: A Look Inside California’s Mobile Driver’s License Program,” a webinar Dec. 13 from Government Technology* and DMV partner SpruceID, public- and private-sector tech leaders discussed their work and what we may see next.
The pilot, which involves the California DMV wallet app — built by the DMV with assistance from SpruceID — and the mDL inside, expanded in September to include more than 1 million Californians. Currently, select convenience stores and three airports in the state accept the mDL. But Department of Motor Vehicles Chief Digital Transformation Officer Ajay Gupta said during the webinar that the department is also partnering on mDL with the National Association of Convenience Stores, a nonprofit with 156,000 store partnerships. DMV is working with credit unions, banks and payment processors too, to start accepting mDL as an identity verification mechanism some time in the next year; and it’s collaborating with the California Highway Patrol and a few local law enforcement agencies to enable them to use it. In conversation with moderator Russ Nichols, senior fellow at the Center for Digital Government*, Gupta and SpruceID founder and CEO Wayne Chang offered additional takeaways of interest to the private sector:
- Trust is vital in a changing landscape. Both the commercially available options for digital ID and the standards that govern it continue to evolve amid a “tactical market,” Gupta said. At DMV, officials have focused on preserving residents’ privacy via the strictest standards in the nation and have been concerned about how digital ID would be perceived. They created, he said, a “native wallet landscape” in which third parties could participate as a wallet provider around mobile driver’s licenses — but in an open-source ecosystem, addressing privacy concerns by ensuring the mDL left no digital trail and had no “phone-home” connection from the phone upon use.
“We are going to be different and we are on the side of the holder, privacy protecting, open source so you can see, and transparent,” Gupta said. “But also supporting multiple standards so we can open up a larger landscape of verifiers and consumers who can actually use this particular product.” - Excitement should build around the mDL pilot. Officials at SpruceID connected with many state agencies on use cases, both inside and outside California. Chang said: “I think there’s a lot of excitement about this cohesion that’s possible, because if we do have something that is signed off by the DMV, there’s a lot of ambition to accept this in all places, especially for secure access to government e-services.” Once the mDL is issued, he added, it is less expensive than a third-party verification service and it could ultimately be stronger than the physical credential because there’s no deterioration.
“I think that at a certain point, it’s within a national security interest to have a strong industry for digital identity, because there are a lot of different vendors to pick from, and expertise built in,” Chang said. - Security upgrades are likely for the physical driver’s license. Asked by Nichols whether the state is contemplating adding a chip to the state’s physical ID, or moving directly to an all-mobile driver’s license, Gupta said the physical card remains very much in play. California, he said, is looking at various technologies to make physical cards more secure, like digital signatures.
“I’ll leave it at that at [this] point in time, but it’s actually [a] way less expensive and way better cryptographically speaking solution than, let’s say, putting a chip in,” Gupta said, noting the state’s mDL pilot is still accepting applicants as it hasn’t yet reached 1.5 million-1.7 million capacity. - Cybersecurity needs will only increase as digital ID takes hold. The systems holding residents’ data, Chang said, are mission-critical, and in order to improve and refine privacy and security capabilities by adding needed system components, entities will have to start thinking about managing cryptographic keys and the security behind that.
“That’s something that organizations will need to start getting smart on if they want to do well in the world of digital credentials,” he said. “Those are a lot of the considerations that add complexities.”
*The Center for Digital Government and Government Technology are part of e.Republic, parent company of Industry Insider — California.
