BY RHODA WILSON ON APRIL 20, 2024

The use of mobile driving licences (“mDLs”) continues to expand globally, with countries such as Australia, South Korea and Paraguay following the path of early adopters like Mexico.

The US is also seeing a spike in uptake, with six states already offering a digital identity credential as a valid mobile driving licence.  According to a release from the Secure Technology Alliance, more are coming with 26 other states already in the process of introducing mDLs.

Two years ago, The Last American Vagabond outlined how the push for digital identity programmes is a scam disguised as a human right.  In an article published in August 2023, the independent Canadian outlet exposed who is behind the push for digital driving licences in the US and Mexico, which we don’t delve into in our article.  You can read The Last American Vagabond’s article HERE.

Mexico

Thales, in cooperation with local partner Cosmocolor, implemented the first Mexican smart card driving licence, in Nuevo León State, in 2007.

The technology has now been expanded to the states of Jalisco, México, Veracruz and Sonora.

As The Last American Vagabond detailed, Thales is one of the driving forces behind the expansion of mobile or digital driving licences.

Australia

In 2017, South Australia became the first state to launch digital licences.  In 2021 hackers accessed more than 2,600 mySA GOV accounts after obtaining passwords in a cyber attack on a separate, unrelated website.

Oddly, in January 2024, an academic observed how digital IDs have by and large won popular acceptance in Australian states in no small measure due to having security procedures that assuage most public concerns, according to Biometric Update.

In April 2024, Victoria adopted mDLs as a valid form of digital ID.  Last year, the state began rolling out digital driving licences in stages. The trial in Ballarat saw more than 15,000 people access their digital licence since it began in July 2023. The state government called the trial “successful” despite a rough start involving email invitations with incorrect surnames being sent to 57,000 Ballarat residents, prompting security concerns.

South Australia and Victoria were not the only states in Australia to have experienced privacy and security issues.

In 2020, Queensland passed a law to distribute digital driving licences from Thales and in May 2022, the state of Queensland piloted a mDL app in the city of Townsville with plans to roll it out across the entire state in 2023.

While Queensland was launching its pilot, the New South Wales’ mDL was reported to still be vulnerable to attacks and significant design flaws despite warnings from almost three years ago.

In November 2019, the New South Wales government introduced the digital driving licence (“DDL”)  as a means to make it easy for people to access a digital version of their driving licence.

In a blog post last year, Australian digital security company Dvlun said security researchers pointed to security flaws in the release of the New South Wales government’s DDL, such as the ability to manipulate data and create fraudulent identities. Despite the warning, Dvlun says there was no formal response from the government and its own analysis of the app on iOS showed the possibility of generating fraudulent DDLs without needing modifications or repackaging of the app itself.

The security problems with digital driving licences persist across the country. This week, ABC News reported that most of Australia’s digital driving licences have a problem with data security. ABC News quoted cybersecurity experts who say the mDLs don’t meet international security standards, leaving holders open to biometric ID theft and identity fraud.

Jamieson O’Reilly, director at Dvuln,  says mDLs “should reduce things like fraud, misuse, and identity theft – but that relies on a secure implementation, which as we’ve seen, hasn’t been happening.”

O’Reilly wants governments to ensure digital licences are built to ISO 18013-5 specifications. At present, Queensland’s digital licence is the only ISO-compliant app in Australia.

Note: The organisation that is known today as ISO began in 1926 as the International Federation of the National Standardising Associations (“ISA”).  ISA was suspended in 1942. Shortly after the United Nations Standards Coordinating Committee (“UNSCC”) was formed, it approached ISA with a proposal to form a new global standards body. In 1946, ISA and UNSCC agreed to join forces and create the International Organisation for Standardisation, or ISO.

Should anyone be in any doubt that mDLs are merging into digital IDs, ABC News spells it out.  “Victoria is about to become the fourth Australian state or territory to launch the new digital ID, with millions of fully licenced drivers and motorcyclists able to access their licences via myVicRoads and Service Victoria apps starting next month,” the news outlet said.

Biometric Update linked Australia’s mDLs and digital IDs more directly: “A successful six-month trial of mobile driving licences in the city of Ballarat [ ] will mean that more than 4.5 million of Victoria’s drivers can switch from physical ID cards to digital licences … The digital cards can serve as proof of identity [for] a wide spectrum of entities that require photo ID, from restaurants to police to Australia Post.”

South Korea

Since debuting in 2022, the Government of South Korea’s mobile driving licence and ID card programme has issued more than 2.22 million digital identification cards through the Interior Ministry.

The South Korean Interior Ministry signed a memorandum of understanding with Samsung Electronics in October 2023 to introduce mobile ID cards to the private sector.

Samsung Wallet is the first privately-run mobile app to introduce the South Korean government’s mobile ID cards, including mDLs and the national veteran’s registration card. Samsung Wallet has up to 17 million users in South Korea alone. As a direct launch pad for issuing mobile ID cards, it means users do not have to download the ministry’s app.

Paraguay

Digital IDs derived from Paraguay’s national identity card and driving licences are now accepted as their legal equivalents, but a civil society group is warning that in the absence of proper regulation, the system could undermine personal privacy and other human rights.

Paraguay-based digital rights advocacy the Association of Technology, Education, Development, Research, Communication (“TEDIC”) issued the report on the risks of and recommendations for the national digital ID system.

The starting point of the analysis is made clear in an initial section on the global context, in which mass privacy violations are attributed to India’s digital ID system, Aadhaar. The data protection inadequacies of select digital ID implementations in countries around the world are then reviewed before TEDIC moves on to a section highlighting risks and concerns associated with biometrics use.

Paraguay’s digital ID law is not yet accompanied by adequate regulations, according to TEDIC. An e-government platform established in 2018 for online access to public services, for example, has not updated its privacy policy to address the use of digital IDs. The group says that limitations on the collection of biometrics are needed, along with protections against unauthorised access, processes to correct or delete personal data and other safeguards.

TEDIC also sees the necessity and proportionality of the system as unproven, and its transparency as limited.

Perhaps most troubling is the lack of a legal data protection framework in Paraguay. The state has also acknowledged sharing digital ID data with Google Analytics.

United States

Many US states are launching and expanding mDLs to eventually be equivalent to their physical counterparts. Eventually, these digital ID credentials are likely to be stored in and shared via digital wallets, Intellicheck CEO Bryan Lewis told PYMNTS.

“Eventually digital wallets will be how we all do everything,” Lewis said. What America needs now to unite its fragmented digital ID landscape, he argued, is a storage format for mDLs that is secure against hacking.

New York is preparing to launch a pilot, while New Jersey passed legislation for the creation and issuing of mDLs. Illinois has proposed a bill that would allow for those to display licences on their smartphones alongside, not in place of, their physical counterparts. In Colorado, mDLs can be used as a valid form of identification for some law enforcement agencies, including the city of Denver.

As many as 26 states are taking steps toward implementing mDLs, and 66 million people are using mDLs in the 6 states where they are fully available, according to the Secure Technology Alliance.

“State-issued identity credentials should always be perceived as a public good,” said Eric Jorgensen, director of the Arizona Department of Transportation’s Motor Vehicle Division in a keynote address at the Identity and Access Forum Spring Member Meeting.

A public good? Really?

With an anti-hacking storage format digital identities might “unite a fragmented ID landscape” but because mDLs have biometric authentication, encryption and verification capabilities, civil liberties organisations have voiced concerns about whether or not the systems are actually secure.

The Electronic Frontier Foundation (“EFF”) shared security concerns regarding the California DMV Wallet app in a recent article. The app, which is currently being used by roughly 325 Californians, began a pilot last year.

The state contracted digital credential provider Spruce ID for the creation of a wallet app instead of Google Wallet, which accepts mDLs from Georgia, or the Samsung Wallet, in partnership with Idemia, which accepts IDs in Iowa and Arizona.

Related: Nigeria’s digital prison has been built and the gates are closing

Protections need to be put in place to limit the information law enforcement can gather both by mDLs and from the smartphone presenting the ID as established in proposed legislation in Illinois. Digital identity apps are not and should never be mandatory, the EFF says.

Sources for this article include: