Authentication

Inside Colorado’s New State-Run Digital Driver’s License App

Digital driver’s licenses are currently being developed or implemented in several states, with Colorado the latest to jump on board in October. Yet, the implementation of digital government-issued IDs brings privacy and security challenges. In the latest Digital Identity Tracker, Russell Castagnaro, director of digital transformation at the Colorado Governor’s Office of Information Technology, tells PYMNTS how the state’s app team used sophisticated filtering tech to limit who sees personal information — and why.

State-issued driver’s licenses and ID cards are the most common forms of personal identification in the U.S., allowing citizens to prove their identities at airports, bars and in numerous other settings. Individuals must ensure that they have such credentials on them at all times, though, which gives them yet another thing about which to worry. What if they could instead easily access such identification methods on their smartphones, which they are likely to be carrying anyway?

This was the logic behind the development of myColorado, the official state mobile app that provides residents with digital copies of their driver’s licenses or state IDs. The app was developed in relative secrecy over the past year, and officially launched in October with an executive order from Governor Jared Polis.

PYMNTS recently spoke with Russell Castagnaro, director of digital transformation at the Colorado Governor’s Office of Information Technology, about the app’s development, and how it addresses Coloradans’ concerns regarding security and privacy.

How myColorado Works

The myColorado concept began as a one-stop shop for all state government-related interactions, starting with driver’s licenses and Department of Motor Vehicles (DMV) interactions, and expanding from there. Castagnaro said the project’s scope narrowed considerably during development, as smartphone screens proved too small to enable certain government services. The app’s central theory — that Coloradans wanted their phones to be their primary means of interacting with the world — remained, however.

“It’s called the ‘walk your dog test,’” Castagnaro explained. “They want to be able to go walk their dog without having to worry about bringing their purses or wallets, so they could stop and do everything they need to do with just their phones. In fact, 20 percent of Denverites pay for everything with their phones, which just blew me away.”

One of the key advantages to providing digital licenses through smartphones is that the information can be updated in real time, preventing residents from worrying about outdated details.

“The driver’s license is up to date as soon as you get it, and then after that, you have it for five years,” Castagnaro said. “Not only does your face change, but maybe your address changes three or four times during that period, especially in a place like Colorado, where people are moving in and out all the time.”

Coloradans are required to carry physical IDs for now, largely because law enforcement agencies are not yet allowed to accept the app as a form of ID. Castagnaro explained that this is mostly due to liability reasons, and concerns about police accessing personal data during routine interactions with the public.

“You’ve got issues of privacy, where text messages might come up that could be incriminating,” he said. “If they have physical access to the phone, does that mean they can go in and look around? We’re here to improve competence, not give more reason for suspicion.”

Keeping Residents’ Data Safe

Colorado works with third-party security partners to authenticate the myColorado app’s IDs, requiring scans of both the front and back of driver’s licenses. The partners then verify that the same person is shown in a user’s uploaded picture and driver’s license photo. The app also requires device, email and text verification steps to triple-check that each user is legitimate.

“[In this way], we can tie that trusted identity that is proven by the DMV to a device,” Castagnaro said. “That’s going a step further than most other providers can do because they don’t have that trust anchor of the DMV behind them.”

Privacy is another major concern, with many citizens unwilling to overshare personal information with businesses, services and even government entities that do not require it. Castagnaro claimed that myColorado is more effective in limiting access to private information than traditional physical cards.

“Right now, when you give someone your driver’s license, and they make a copy of it, they have access to all the information that’s on there,” he explained. “One thing that we have implemented on a digital ID within myColorado is a filter — I call it the vanity filter. You can hide your address or even your birthday if all you need to do is prove that you’re 21.”

What’s Coming Around The Mountain?

The project’s scope may have narrowed during its development, but Castagnaro said there are plenty of additional features on the way. Topping the list is an integration with healthcare providers that will allow Coloradans to electronically consent to sharing information. The app’s development team is also exploring additional DMV compatibility, enabling users to access vehicle registration renewals and other services.

Officials have long-term goals for the program, too. They hope to integrate the solution with other states’ digital ID programs, and enable its use on the federal level, such as at airport security checkpoints. The primary obstacle to these implementations is compatibility, however, which Castagnaro does not expect to come any time soon.

“As soon as mobile driver’s license standards get a little more firmed up, we’ll support those,” Castagnaro said. “And as soon as the TSA comes out with standards around how to share information with them electronically, we’ll support those, too. The one thing to keep in mind, however, is that the Real ID Act came out 14 years ago, and there are still two states that don’t support it. It’ll be a long road before mobile driver’s licenses are supported all over the U.S., but Colorado will be there.”

Other states with app-based driver’s license programs — including Delaware, Louisiana and Maryland — will likely be there as well, but they may be waiting for a while.

——————————–

Featured PYMNTS Study:

More than 63 percent of merchant service providers (MSPs) want to overhaul their core payment processing systems so they can up their value-added services (VAS) game. It’s tough, though, since many of these systems date back to the pre-digital era. In the January 2020 Optimizing Merchant Services Playbook, PYMNTS unpacks what 200 MSPs say is key to delivering the VAS agenda that is critical to their success.

TRENDING RIGHT NOW