This article was reprinted with permission from Virginia Mercury.
In some states, smartphones can do more than help you pay for services, capture memorable moments, or instantly access your choice of media.
In approximately half of the country, people can also store and share personal credentials on their devices, including state identification cards or driver’s licenses. Virginia has been working with experts to develop technology to make the same thing possible here.
According to Jillian Cowherd, a spokeswoman with Virginia DMV, the agency has partnered with CBN Secure Technologies on its Virginia Mobile ID (mID) program. While the agency continues to work with businesses and organizations to accept the mID, Cowherd said the agency is working to “make it easier” and “more secure for customers to manage their credentials” while addressing privacy concerns about the potential for personal data to be released without approval. State lawmakers are also closely monitoring the process.
“We always want to make things easier for folks (and) we can do that with the use of technology … but that’s always tempered with making sure that the privacy of individuals is paramount,” said House Technology Committee Chair Cliff Hayes, D-Chesapeake.
Currently the app is available for download and is being used by a portion of Virginia’s nearly 126,000 state employees. mID can be used at select TSA checkpoints including Richmond International Airport and Ronald Reagan Washington National Airport, and state workers are providing feedback to the agency.
Cowherd said the team is working to make mID available to the public in Google, Apple, and Samsung wallets and is in discussions with public and private entities to ensure it will be accepted at businesses and by organizations when launched. She said that once its fully rolled out,, Virginians should be able to use their mobile ID to board planes, show proof of identity at DMV offices, engage with law enforcement and emergency services, and eventually show proof of age at retail establishments and restaurants.
“DMV has continued to work with CBN Secure Technologies, our secure credential vendor partner, to develop an app, conduct extensive testing, gather customer feedback and ensure it has seamless functionality and robust security,” said Cowherd in a statement. “However, building a program that is widely accepted and highly secure takes time.”
The pilot program, legislation
In 2017, the General Assembly passed legislation creating the standards for issuing, reviewing, and displaying electronic credentials after the agency conducted a year-long pilot research program to assess “customer value, market demand and the ability to meet stakeholder needs,” Cowherd said.
According to the program’s list of frequently asked questions, there is no cost associated for Virginians to add the mID to their device or to use it.
In 2017, lawmakers discussed charging for each individual-issued electronic credential. State law allows the agency to charge users up to $10 per year.
According to an earlier fiscal statement from the Department of Planning and Budget, at the fixed rate of $10, Virginia would have collected $1.7 million in revenue per year if 3% of the state’s approximately 5.6 million licensed drivers signed up. If 5% of licensed drivers were to buy an electronic credential, Virginia could receive approximately $2.8 million per year.
Privacy Concerns
Del. Karrie Delaney, D-Fairfax, chair of the House Transportation committee, said having technology to store your identification card on your smartphone is convenient for a lot of people, but privacy is paramount to many Virginians.
“Having the security factors is an essential part of making sure that this program is trustworthy for the public,” Delaney said. “We are responsible for making sure that those guardrails are in place. But, at the end of the day, it is also going to be a choice for people.”
Sen. Dave Marsden, D-Fairfax, said he believes the 2017 bill that created the mobile ID standards didn’t “raise any alarm bells” for the legislature, but believes lawmakers would be open to making any necessary changes if needed to address privacy or security worries.
State governments and authorities known as “issuing authorities” seeking to use mobile ID technology have partnered with the American Association of Motor Vehicle Administrators, a nonprofit organization dedicated to developing model programs for motor vehicle administration, law enforcement and highway safety, for guidance.
According to guidelines provided by the AAMVA, the issuing authorities, in this case Virginia, should take care to ensure mobile ID data stored on peoples’ phones is “adequately protected.”
“As standards in this respect are still under development, each Issuing Authority should take great care to ensure that the design of its solution supports this requirement,” the guidelines read.
AAMVA’s guidelines also advise authorities to encrypt mobile ID information and protect key material in a security module.
The organization also provides guidance on access.
While law enforcement and emergency services have legal access to a person’s physical credentials in Virginia, the association has suggested that mobile driver’s license apps allow similar access in case of justifiable need.
However, the association said that because such an option could be misused, the app must not allow anyone other than the mobile ID holder to access the mobile ID information.Virginia’s mobile ID app follows suit.
“Your information is not accessible without your consent. You control what information from your mID you’d like to share,” the DMV’s mobile ID FAQ page states. “When you enroll, your information is stored on your personal device. Only those with access to your personal device and the ability to unlock and access the app would have access to view it.”
Cowherd confirmed that user security is at the forefront of the project. She said the customer will control the information shared on the app, which presents the information needed for the interaction. The customer can also review and authorize the requested information before it is shared.
“Virginia DMV provides the highest level of security in credential storage, data transmission and verification,” she said.
Additionally, she said mobile IDs are presented digitally through encrypted communication directly between a user’s device and a verifying business or organization.
“The device never needs to be handed to anyone or leave the customer’s possession.,” she said.
Cowherd said the agency hopes to fully release the app early next year, but this depends on final testing and proven use cases.
