As personal data security becomes an increasingly overwhelming issue for Americans, the state of Colorado said it’s figured out how to make personal identity more secure with digital IDs.
On Wednesday, the state officially added driver’s licenses to the myColorado mobile app. The app can be used to register to vote, renew a driver’s license and prove your identity at any state agency.
Well, almost any. The state agency that won’t accept it yet is the Colorado Department of Public Safety. State officials are still working on adoption by local law enforcement.
“It has even more advanced security features than a plastic card, which as you know or if you’ve talked to any 19-year-old, they’ll tell you, there have been forgeries,” Gov. Jared Polis said during a news conference Wednesday where he signed an executive order allowing digital IDs to take effect. “It has even more security features than that plastic card.”
But users should continue to carry their legal IDs in their wallets, he added.
Colorado became one of the first states to launch a digital driver’s license test, according to cybersecurity firm Gemalto, which worked with Colorado, Idaho, Maryland and Washington, D.C., on pilot programs since 2017.
Gemalto and competitor Idemia have worked with more than 35 states on digital driver’s licenses. Oklahoma’s mobile ID also launched this week in app stores, according to The Oklahoman, which reported that 4,000 people were using the beta version.
But Colorado decided to build its digital ID system on its own because it wanted more than an ID app, said Brandi Simmons, a spokeswoman for the state’s Office of Information Technology.
“Instead of each agency creating its own app where Coloradans have to go and download 20 different apps to get these services, this will be the central hub,” she said.
This means that down the road, Coloradans could use the app to register for a fishing or hunting license and store them on the app. Or they can use it to also store their vehicle registration and auto insurance.
The new Colorado digital driver’s license includes a holographic image that rotates as the phone rotates, the ability to press the ID and enlarge the text and a barcode that can be scanned. If a state employee or bartender is suspicious of the validity of the digital ID, they should ask the user to relaunch the app, state officials said.
To enroll, users must take a photo of their face that is matched to their driver’s license photo on record. Users also will need to use multifactor authentication to use the app or rely on the phone’s built-in technology.
“We utilized the best practices in how we encrypt and secure all of the transmissions in the application and how all the data is handled in the background,” said Casey Carlson, chief enterprise architect at the state’s Office of Information Technology.
The state worked with Denver-based Ping Identity and ProofID in Colorado Springs to support authentication technology. The service is using Amazon Web Services and search help from Google.
Ping built its business on using technology to verify the identity of users within and outside an organization. There’s been a rise in digital identity programs and the problem with that, said Richard Bird, Ping’s Chief Customer Information Officer, “we also run the risk of too many disparate programs operating independently of one another with no defined standard.”
But going digital is inevitable, Bird added.
“Whether all aspects of Colorado society and business, such as law enforcement, bars, dispensaries and other outlets adopt and accept the use of the digital form remains to be seen,” he said. “But this is because of the realities of process change and human behavior, not technology.”
Carlson said the concern by public safety agencies is that the agencies need “non-refutable” verification so officers have 100% assurance that a person is who they say they are. Carlson’s team is working with law enforcement to provide that assurance.
“It would be technology based, so we can provide them with software on their mobile devices to verify those identities,” Carlson said. “The data itself is not exchanged device to device, but there is a security mechanism exchange between the devices that then allows law enforcement to verify that person based on state authoritative servers.”
The Denver Police Department and Colorado State Patrol are monitoring the digital ID program. And it looks like that is coming along, according to Master Trooper Gary Cutler, with CSP’s public affairs.
“The Colorado State Patrol has been working hand in hand with the Governor’s office and many other stakeholders on the digital driver’s license project and is happy to see it become available to the public,” Cutler said in an email. “We believe this will be beneficial for the driving public as well as law enforcement.”
The state hopes law enforcement agencies will adopt the technology by the end of 2020.
All other Colorado state agencies will begin accepting the digital ID on Dec. 1, Polis said.
But Coloradans won’t be able to use smartphone-based driver’s licenses outside of the state, and certainly not at the airport with federal Transportation Security Administration officials.
“This will evolve over time as national standards are identified and adopted to allow free interstate usage and make it compliant with federal REAL ID,” Polis said.
The REAL ID is a federal standard passed by Congress in 2005 to create minimum security standards for state-issued driver’s licenses. All states must issue REAL ID-compliant licenses by Oct. 1, 2020.
While advances in technology have also meant an increase in identity theft and online security data breaches, smartphone use in America is at 81%, up from 35% in 2011, according to the Pew Research Center.
“This simply catches (the state) up to that state ID verification piece where transaction technology already is,” Polis said.
“The private sector has already moved there. You can use Venmo or PayPal or any number of different services where you can buy something with your iPhone. Security is there. Again, in many ways it’s more secure than this,” he said, holding up his United Airlines mileage credit card, “because this easily gets lost or stolen.”
Updated at 4:13 p.m. with comments from Ping Identity and Colorado State Patrol.