Communications of the ACM
Digital IDs Make Their Mark
More than 70 countries now have some form of digital identification in place, most involving some form of national identity card, according to Thales.
Credit: ID123 Inc.
Despite remarkable advances in digital technology, one thing has remained steadfastly analog: personal identification documents. Most of us carry a physical driver license, identity card, or passport wherever we go. Although these paper and plastic documents continue to function effectively, at times they are inconvenient and rife with security concerns.
As a result, governments are adopting electronic IDs (eIDs). Placing a person's encrypted identification data on a smartcard or inside a phone can deliver significant benefits while boosting security, they argue. Yet, at the same time, digital IDs introduce concerns about privacy and the potential for abuse of private information by law enforcement and governments.
"The concept is gaining traction," says Sam Tang, managing director and Chief Identity Architect of Ernst & Young's Cybersecurity Practice. The list of countries that have adopted some form of digital ID now includes Australia, Estonia, Finland, Italy, Kuwait, Mongolia, Qatar, Sweden, and Uruguay.
What's more, interest in touchless ID systems is growing as the pandemic continues.
A Matter of Identity
Digital identification is not a new concept. After the terrorist attacks on New York City's World Trade Center and the Pentagon in Washington D.C. in 2001, governments around the world began looking for ways to make identity documents more secure.
For example, Estonia launched an e-identity system using chip-based electronic identification cards (eIC) in 2007. Today, those cards are used for voting, taxes, and digital signatures. When the pandemic arrived in early 2020, the government issued benefits to furloughed workers immediately and automatically—without lines or paperwork.
Yet "Over the last five or so years, there has been a real push for knowledge of what a digital driver's license or identity card would mean," says Steve Purdy, vice president of the Identity and Verification business line at Thales Digital Identity & Security, which consults and builds electronic ID systems.
According to Thales, more than 70 countries now have some form of digital ID in place, mostly revolving around national identity cards. Acuity Market Intelligence reports that 3.6 billion people will carry a national eID by 2021. As smartphones have become ubiquitous, digital identity programs have begun to migrate from smartcards to apps.
In Uruguay, citizens already use an eID and biometrics to e-sign documents, access government services, and obtain private services. Germany has announced that national ID cards will go mobile by permitting digital IDs to work on Samsung Galaxy smartphones. In Australia, the state of New South Wales is transitioning to digital driver's licenses. Meanwhile, in the U.S., Florida recently announced it would become the first state to support a mobile driver's license accessible on a variety of devices, including smartphones and tablets. A touchless Mobile Passport app now allows U.S. and Canadian passport holders to cross the border between the two countries using a mobile device that contains their passport data.
The appeal of eIDs revolves mostly around convenience, trust, and safety, Tang says. An electronic version of a national identity card, passport, or driver license can't be lost; they also make counterfeiting, fraud, and other forms of theft more difficult, while introducing contactless verification, a feature that has garnered interest during the pandemic.
Electronic systems also provide security features that aren't possible with physical artifacts. "If you need to show your ID to verify your age or identity, an app won't display your name, age, gender or address," Purdy says. "So, you can step into a bar," Purdy says, and on your smartphone "there's simply a photo and verification that you're old enough to drink. No one can use the information to find you or stalk you."
Big Brother or Big Helper?
An inevitable question about digital eIDs is: what happens if a phone battery dies or a person leaves a device at home? Purdy says this isn't a problem: "People already leave their physical driver's licenses at home. Law enforcement has mechanisms in place for handling these situations."
At present, the biggest barrier to widespread adoption is a lack of technical and practical standards—along with concerns about privacy, including misuse of information by governments and officials. "There's a risk that the technology could serve as a gateway to a central national database," says Alexis Hancock, staff technologist for the Electronic Frontier Foundation (EFF).
While consolidating data storage generally improves security, it also can serve as a single point of failure. Hancock believes robust standards and national privacy laws are needed to prevent agencies from adding new and different types of data to digital ID systems. They also are necessary to prevent private companies from storing digital ID data. "Digital identification should always be an option and not a requirement," she says.
Nonetheless, everyone acknowledges that the question isn't if, but rather when, digital IDs will arrive. What's more, a digital framework could deliver far-reaching benefits, Tang says. For example, a single digital ID and token-based authentication could eliminate the need for Web and app passwords. Along with Blockchain, a digital ID could simplify tasks like verifying prescriptions, authenticating real estate transactions, and even applying for a fishing license.
Says Tang, “There is and will always be some form of risk with any system. Digital IDs are no exception. But these systems can greatly simplify and improve many tasks and processes.”
Samuel Greengard is an author and journalist based in West Linn, OR, USA.
No entries found