Oklahoma driver's licenses go digital
August 19, 2019 4:33 AM Subscribe
Oklahoma driver's license, meet smartphone Oklahoman drivers will soon have access to their own digital identification cards. Beta testing for the first 1,000 people began last month through a smartphone app developed by Idemia, the same company that already manages much of the ID card infrastructure for Oklahoma and 34 other states. Meanwhile, Oklahoma will likely miss the October 2019 deadline for compliance with the REAL ID Act, which then will require additional identification for access to federal buildings, courthouses and military installations, and for commercial airline travel.
Oklahoma driver's license, meet smartphone, The Oklahoman, August 11, 2019
The first 1,000 people received an invite last month to download a smartphone app developed by Idemia, the same company that already manages much of the ID card infrastructure for Oklahoma and 34 other states. The app lets users link their current ID or driver's license to their mobile phone through existing records in the state database.
Oklahoma will likely be one of the first to let residents flash their smartphone instead of pulling a card from their wallet. It's not designed to completely replace a physical card, however. Just 81% of Americans own a smartphone, according to a 2018 study by the Pew Research Center. The same report showed only two-thirds of people over 50 own a device.
Idemia preparing for public rollout of Mobile ID in Oklahoma with beta program, Oklahoma's New 4, August 18, 2019
Idemia Senior VP of Identity Matt Thompson said while users are getting used to the Mobile ID, Idemia is also working to make sure people know that it is an acceptable form of identification.
"We're also in the process of educating local law enforcement, and meeting with local business owners," Thompson said. "To educate them on how to accept it and work with them to get their requirements before the public launch in October."
The app and service are free for one year, then it will cost less than $5 annually.
REAL ID Frequently Asked Questions for the Public, Oklahoma Dept. of Public Safety, last modified October 3, 2018
HB1845 was passed during the 2017 Legislative Session, allowing the Oklahoma Department of Public Safety (DPS) to come into compliance with the REAL ID Act of 2005. This is expected to be implemented in Spring of 2020. By missing the October 10, 2019 deadline, additional ID such as a U.S. passport will be needed to board commercial aircrafts, and at military installations, federal buildings, and courthouses.
The cost will be a $5 fee increase on ALL REAL ID-compliant and non-compliant DL/ID cards.
Oklahoma driver's license, meet smartphone, The Oklahoman, August 11, 2019
The first 1,000 people received an invite last month to download a smartphone app developed by Idemia, the same company that already manages much of the ID card infrastructure for Oklahoma and 34 other states. The app lets users link their current ID or driver's license to their mobile phone through existing records in the state database.
Oklahoma will likely be one of the first to let residents flash their smartphone instead of pulling a card from their wallet. It's not designed to completely replace a physical card, however. Just 81% of Americans own a smartphone, according to a 2018 study by the Pew Research Center. The same report showed only two-thirds of people over 50 own a device.
Idemia preparing for public rollout of Mobile ID in Oklahoma with beta program, Oklahoma's New 4, August 18, 2019
Idemia Senior VP of Identity Matt Thompson said while users are getting used to the Mobile ID, Idemia is also working to make sure people know that it is an acceptable form of identification.
"We're also in the process of educating local law enforcement, and meeting with local business owners," Thompson said. "To educate them on how to accept it and work with them to get their requirements before the public launch in October."
The app and service are free for one year, then it will cost less than $5 annually.
REAL ID Frequently Asked Questions for the Public, Oklahoma Dept. of Public Safety, last modified October 3, 2018
HB1845 was passed during the 2017 Legislative Session, allowing the Oklahoma Department of Public Safety (DPS) to come into compliance with the REAL ID Act of 2005. This is expected to be implemented in Spring of 2020. By missing the October 10, 2019 deadline, additional ID such as a U.S. passport will be needed to board commercial aircrafts, and at military installations, federal buildings, and courthouses.
The cost will be a $5 fee increase on ALL REAL ID-compliant and non-compliant DL/ID cards.
This seems like a dumb, dumb, idea. If I think about it I can come up with some ways to prevent license spoofing on a mobile but it only takes me a few more minutes to come up with ways to defeat those measures. BTW, the actual real world deadline for REAL ID compliance keeps drifting further and further into the future.
posted by rdr at 4:57 AM on August 19, 2019
posted by rdr at 4:57 AM on August 19, 2019
Uhh....I'm pretty sure the Real ID deadline is October 1, 2020?
posted by kuanes at 4:58 AM on August 19, 2019 [2 favorites]
posted by kuanes at 4:58 AM on August 19, 2019 [2 favorites]
In a perfect world, states issuing their own drivers licenses and ID cards would be considered an act of secession.
If we could federalize the definition of a CDL, we should have done the same with all other DLs. Even the EU has a similar level of consistency between countries, nowadays, and theirs have to have the word "driver's license" written in like 15 languages.
posted by groda at 5:02 AM on August 19, 2019 [1 favorite]
If we could federalize the definition of a CDL, we should have done the same with all other DLs. Even the EU has a similar level of consistency between countries, nowadays, and theirs have to have the word "driver's license" written in like 15 languages.
posted by groda at 5:02 AM on August 19, 2019 [1 favorite]
> Uhh....I'm pretty sure the Real ID deadline is October 1, 2020?
According to the Washington Post FAQ you linked to, it depends on what you mean by "deadline".
States have various deadlines for compliance, the last of them terminating on Oct. 10, 2019.
People have until Oct. 1, 2020 to update their IDs for air travel.
posted by ardgedee at 5:41 AM on August 19, 2019 [3 favorites]
According to the Washington Post FAQ you linked to, it depends on what you mean by "deadline".
States have various deadlines for compliance, the last of them terminating on Oct. 10, 2019.
People have until Oct. 1, 2020 to update their IDs for air travel.
posted by ardgedee at 5:41 AM on August 19, 2019 [3 favorites]
For that matter, visitors to various government facilities needed Real ID starting in 2014. Which must've made life for a lot of people in North Carolina interesting, since it's host to Fort Bragg and Camp Lejeune but only began offering Real ID in late 2017.
posted by ardgedee at 5:49 AM on August 19, 2019
posted by ardgedee at 5:49 AM on August 19, 2019
I'd love to not have to carry a wallet everywhere, but this sounds like it is in addition to that, not a replacement for having to keep carrying a physical ID. So maybe a slight convenience in some situations (at the cost of the inevitable hacking sooner or later), but not even a minor game changer.
posted by Dip Flash at 6:07 AM on August 19, 2019
posted by Dip Flash at 6:07 AM on August 19, 2019
If I think about it I can come up with some ways to prevent license spoofing on a mobile but it only takes me a few more minutes to come up with ways to defeat those measures.
I mean, good fake IDs exist, too - is this really so much worse?
posted by mosst at 6:09 AM on August 19, 2019
I mean, good fake IDs exist, too - is this really so much worse?
posted by mosst at 6:09 AM on August 19, 2019
"Everybody freaked out about the potential, 'Oh it's on my phone, what if hackers get to it?'" Sweaney said.
Most people should have no problem handing their unlocked smartphone to law enforcement. Right? What could go wrong?
posted by baegucb at 6:36 AM on August 19, 2019 [10 favorites]
Most people should have no problem handing their unlocked smartphone to law enforcement. Right? What could go wrong?
posted by baegucb at 6:36 AM on August 19, 2019 [10 favorites]
In a perfect world, states issuing their own drivers licenses and ID cards would be considered an act of secession.
....what?
No, really. I don't understand this.
posted by Automocar at 6:37 AM on August 19, 2019 [3 favorites]
....what?
No, really. I don't understand this.
posted by Automocar at 6:37 AM on August 19, 2019 [3 favorites]
It's not a full replacement, but that doesn't mean you can't leave your driver's license/wallet at home for the vast majority of situations most people are in on a daily basis. I lose track of my wallet about 10x more often than my phone so I'd use this.
posted by skewed at 6:43 AM on August 19, 2019 [1 favorite]
posted by skewed at 6:43 AM on August 19, 2019 [1 favorite]
Every time I see a state effort to change, enhance or affect ID law I wonder if it's part of an effort to disenfranchise voters or increase representation for others.
posted by BrotherCaine at 7:32 AM on August 19, 2019 [7 favorites]
posted by BrotherCaine at 7:32 AM on August 19, 2019 [7 favorites]
Coincidentally, over the weekend I got an email from my health insurer telling me that there was something I needed to take care of via their website.
For some reason, my webpage ID/password wasn't working. No problem, all I needed to do was give them my member ID (different from the webpage ID) and group number to reset my password. Well, those numbers between them are like 25 digits, and they're not numbers I have memorized, so I check my wallet for my card that has all that info... Oh, wait. They aren't sending out the cards anymore, because the smartphone app has all that information.
The smartphone app. Which requires me to log in.
posted by Etrigan at 7:51 AM on August 19, 2019 [10 favorites]
For some reason, my webpage ID/password wasn't working. No problem, all I needed to do was give them my member ID (different from the webpage ID) and group number to reset my password. Well, those numbers between them are like 25 digits, and they're not numbers I have memorized, so I check my wallet for my card that has all that info... Oh, wait. They aren't sending out the cards anymore, because the smartphone app has all that information.
The smartphone app. Which requires me to log in.
posted by Etrigan at 7:51 AM on August 19, 2019 [10 favorites]
I mean, good fake IDs exist, too - is this really so much worse?
A good fake ID requires more than an app on your phone, currently. They are difficult to produce well and typically require specialized equipment—at minimum a dye-sub card printer and special card blanks.
To do this right would require some sort of buy-in from the phone manufacturers, basically some easy, universal way to put the phone into an un-bypassable mode that shows a value burned into ROM, e.g. a hardware pubkey that you could then use to validate the "license" as belonging to that actual phone. (And not just a screenshot originating from some other device.) Then you could do offline verification of the document, but at the cost of giving up some control over your phone (it's basically a DRM-type system, relying on a hardware security module in the phone to secure it from its own user).
Otherwise, what you're stuck with is basically mobile airline tickets—it's trivial to forge, so you have to do online validation of it, every time. That's a fairly big departure from drivers licenses, which are often used as standalone identify verification documents, totally offline.
My guess is that they are trying to go this second route, requiring that the "license" be verified by scanning it each time, but are ignoring the vast number of times when that's typically not done. Maybe they figure they can get government users the capability of doing online verification at all places where a DL is required to be shown, but I'm curious how they are going to get that capability to, say, banks who use DLs for KYC compliance and to prevent fraudulent account openings.
posted by Kadin2048 at 7:59 AM on August 19, 2019 [4 favorites]
A good fake ID requires more than an app on your phone, currently. They are difficult to produce well and typically require specialized equipment—at minimum a dye-sub card printer and special card blanks.
To do this right would require some sort of buy-in from the phone manufacturers, basically some easy, universal way to put the phone into an un-bypassable mode that shows a value burned into ROM, e.g. a hardware pubkey that you could then use to validate the "license" as belonging to that actual phone. (And not just a screenshot originating from some other device.) Then you could do offline verification of the document, but at the cost of giving up some control over your phone (it's basically a DRM-type system, relying on a hardware security module in the phone to secure it from its own user).
Otherwise, what you're stuck with is basically mobile airline tickets—it's trivial to forge, so you have to do online validation of it, every time. That's a fairly big departure from drivers licenses, which are often used as standalone identify verification documents, totally offline.
My guess is that they are trying to go this second route, requiring that the "license" be verified by scanning it each time, but are ignoring the vast number of times when that's typically not done. Maybe they figure they can get government users the capability of doing online verification at all places where a DL is required to be shown, but I'm curious how they are going to get that capability to, say, banks who use DLs for KYC compliance and to prevent fraudulent account openings.
posted by Kadin2048 at 7:59 AM on August 19, 2019 [4 favorites]
Every time I see a state effort to change, enhance or affect ID law I wonder if it's part of an effort to disenfranchise voters or increase representation for others.
I think it’s actually option c, a way for a private contractor to make money. 5$ a year is going to quickly add up to more than the current license fee. And that’s not counting what they charge businesses, the government, and anyone else who needs to actually verify identity; right now eyeballs work (somewhat) for that, but this app will require a scanner. Which costs money.
Capitalism gets into everything.
posted by nat at 8:30 AM on August 19, 2019 [6 favorites]
I think it’s actually option c, a way for a private contractor to make money. 5$ a year is going to quickly add up to more than the current license fee. And that’s not counting what they charge businesses, the government, and anyone else who needs to actually verify identity; right now eyeballs work (somewhat) for that, but this app will require a scanner. Which costs money.
Capitalism gets into everything.
posted by nat at 8:30 AM on August 19, 2019 [6 favorites]
Every time I see a state effort to change, enhance or affect ID law I wonder if it's part of an effort to disenfranchise voters or increase representation for others.
That is a good point. The requirements are pretty stringent in my state:
To get a REAL ID license or ID card will require an in-person visit to the DMV. People will need to present proof of identity, such as a social security card, a certified copy of a birth certificate or a passport. They will also need be proof of residency, like a driver's license or a utility or property tax bill.
It is going to be a lot of trouble for most people to jump through all those hoops. Take a day off to go the the Social Security Office, another day to go to the DMV. If you don't have a copy of your birth certificate, have to figure out how to get one.
posted by Bee'sWing at 9:04 AM on August 19, 2019
That is a good point. The requirements are pretty stringent in my state:
To get a REAL ID license or ID card will require an in-person visit to the DMV. People will need to present proof of identity, such as a social security card, a certified copy of a birth certificate or a passport. They will also need be proof of residency, like a driver's license or a utility or property tax bill.
It is going to be a lot of trouble for most people to jump through all those hoops. Take a day off to go the the Social Security Office, another day to go to the DMV. If you don't have a copy of your birth certificate, have to figure out how to get one.
posted by Bee'sWing at 9:04 AM on August 19, 2019
I'm trying to understand the mechanics of what happens when you have this smartphone license and you get stopped by a cop for speeding or running a stop sign. Do you need to give your phone to the cop, who then takes it back to their cruiser, and then has access to your whole phone? If so, no thanks.
posted by beagle at 9:11 AM on August 19, 2019 [2 favorites]
posted by beagle at 9:11 AM on August 19, 2019 [2 favorites]
A good fake ID requires more than an app on your phone, currently. They are difficult to produce well and typically require specialized equipment—at minimum a dye-sub card printer and special card blanks.
A good fake ID only requires that if the person checking it is doing more than a quick glance. (So: cops and airports, yes; bouncer at your local bar, maybe not.)
I can see people with the app doing a screencap of whatever the verification page is, and insisting they use it at places where there's no service. Using an app to check ID requires
* Smartphone
* Screen visibility (not bright sunlight), possibly
* Battery power
* Cell service (so, $5 year for the app... plus $20-60 per month for service...)
* App servers to be running properly
Solution to the last two is "screencap the verification page!" ... which leads to "edit that image to provide info that the app doesn't."
In my part of California, there's almost nowhere out of cell service range. I suspect that Oklahoma has a lot more territory where there's no signal. What does the app do in those cases? Use the most-recently-uploaded information?
And if hackers do find a way to access ID information, it's pretty much the same data that was lost with hacks at Equifax, Capital One and inside the federal government's Office of Personnel Management, he said.
Oh, that's so reassuring. Not.
posted by ErisLordFreedom at 10:52 AM on August 19, 2019 [2 favorites]
A good fake ID only requires that if the person checking it is doing more than a quick glance. (So: cops and airports, yes; bouncer at your local bar, maybe not.)
I can see people with the app doing a screencap of whatever the verification page is, and insisting they use it at places where there's no service. Using an app to check ID requires
* Smartphone
* Screen visibility (not bright sunlight), possibly
* Battery power
* Cell service (so, $5 year for the app... plus $20-60 per month for service...)
* App servers to be running properly
Solution to the last two is "screencap the verification page!" ... which leads to "edit that image to provide info that the app doesn't."
In my part of California, there's almost nowhere out of cell service range. I suspect that Oklahoma has a lot more territory where there's no signal. What does the app do in those cases? Use the most-recently-uploaded information?
And if hackers do find a way to access ID information, it's pretty much the same data that was lost with hacks at Equifax, Capital One and inside the federal government's Office of Personnel Management, he said.
Oh, that's so reassuring. Not.
posted by ErisLordFreedom at 10:52 AM on August 19, 2019 [2 favorites]
The residency proof requirement is from the REAL ID act, not state regulations (well, the state regulations have to implement the REAL ID act, so technically its the latter but driven by the former).
From the wiki on the REAL ID act: "DHS rule, Section 37.11(c), mandates that the Real ID license applicants be required to present at least two documents documenting the address of their primary residence."
Of course, given that Republicans controlled the Presidency, Senate, and House when this was passed, I'm fairly sure it was intended to have a chilling effect on people. The states are kind of SOL now even if they wanted to be less strict, however (California's non-REAL ID is much more lax, for example).
posted by thefoxgod at 1:11 PM on August 19, 2019 [1 favorite]
From the wiki on the REAL ID act: "DHS rule, Section 37.11(c), mandates that the Real ID license applicants be required to present at least two documents documenting the address of their primary residence."
Of course, given that Republicans controlled the Presidency, Senate, and House when this was passed, I'm fairly sure it was intended to have a chilling effect on people. The states are kind of SOL now even if they wanted to be less strict, however (California's non-REAL ID is much more lax, for example).
posted by thefoxgod at 1:11 PM on August 19, 2019 [1 favorite]
what you're stuck with is basically mobile airline tickets—it's trivial to forge, so you have to do online validation of it, every time.
I believe you have just hit on (one of) the underlying motive(s) behind this. Tracking motion of people.
posted by Xyanthilous P. Harrierstick at 1:57 PM on August 19, 2019
I believe you have just hit on (one of) the underlying motive(s) behind this. Tracking motion of people.
posted by Xyanthilous P. Harrierstick at 1:57 PM on August 19, 2019
Real ID has forced CA DMV bookings out so far that when I got my license renewal notice and immediately hopped online to make an appointment I had to make it 3-4 months in advance.
posted by BrotherCaine at 5:05 PM on August 19, 2019 [2 favorites]
posted by BrotherCaine at 5:05 PM on August 19, 2019 [2 favorites]
Who remembers when a razor blade, skinny pen and glue could get you in the bar.
The risk was the bouncer.
Now, algorithm squad updates you.
posted by clavdivs at 7:01 PM on August 19, 2019
The risk was the bouncer.
Now, algorithm squad updates you.
posted by clavdivs at 7:01 PM on August 19, 2019
Just for reference: my new driver’s license is a RealID. And I also just renewed my passport, and applied for a passport for my son for the very first time.
Guess which one required the most proof of identity.
(I did amuse myself by growing my beard out to a ridiculous length for the drivers license photo, then trimming it back for the passport...)
posted by caution live frogs at 4:33 AM on August 20, 2019 [1 favorite]
Guess which one required the most proof of identity.
(I did amuse myself by growing my beard out to a ridiculous length for the drivers license photo, then trimming it back for the passport...)
posted by caution live frogs at 4:33 AM on August 20, 2019 [1 favorite]
Using an app to check ID requires
* Smartphone
* Screen visibility (not bright sunlight), possibly
* Battery power
* Cell service (so, $5 year for the app... plus $20-60 per month for service...)
* App servers to be running properly
If you use digital signing and something like TOTP you can have a challenge-response scheme that will allow you to generate a unique 2D barcode or NFC token and quickly verify an ID offline. Phones regularly pick up time over the cell network and won't deviate too much even after a few days offline and the readers can sync up to GPS or pull from WWVB or a GPS rebroadcast when they're inside. Phones like the iPhone have Express Transit which could be adapted to have a low power NFC ID mode if need be.
posted by Your Childhood Pet Rock at 5:17 AM on August 20, 2019
* Smartphone
* Screen visibility (not bright sunlight), possibly
* Battery power
* Cell service (so, $5 year for the app... plus $20-60 per month for service...)
* App servers to be running properly
If you use digital signing and something like TOTP you can have a challenge-response scheme that will allow you to generate a unique 2D barcode or NFC token and quickly verify an ID offline. Phones regularly pick up time over the cell network and won't deviate too much even after a few days offline and the readers can sync up to GPS or pull from WWVB or a GPS rebroadcast when they're inside. Phones like the iPhone have Express Transit which could be adapted to have a low power NFC ID mode if need be.
posted by Your Childhood Pet Rock at 5:17 AM on August 20, 2019
Louisiana launched this earlier this year. I have the app because they were waiving the fee for the month after launch but I hadn't really looked at it until now. The app can show a normal image of your license, which seems to at least sometimes be cached if you have it offline, and "refresh" data from the state on a push of the button.
You can also scan a QR code from someone else's app to verify their name and that they're of age. Looks like you can log in with a password or fingerprint/face. The QR code has shifting lit up pixels and is overlaid on an image of your face, so presumably hard to fake.
I'm not sure it solves the using-somebody-else's-ID problem, because you could just install the app on your underage relative's phone or whatever and carry around your traditional license, or vice versa. But if it's done right, the QR code verification thing would make it hard to create a totally fake ID or alter your ID to say you're older than you are.
I've never actually used the app as ID, so I don't know how amenable cops are to login issues. I doubt they'd be thrilled if you had to reset your password or you were in a low-signal zone and couldn't present your license during a traffic stop. Also not sure how well it would work outside the state.
It's legal to use at bars and liquor stores, but I'm not sure they all want to deal with it and, again, I'd hate to hold up the line at a bar or the grocery store because of connectivity issues. I'd also be shocked if there aren't some rural, cash only bars in Oklahoma and Louisiana that don't have any internet connection or cell service, so I'm not sure how they would do the QR code check in that situation.
posted by smelendez at 6:09 PM on August 20, 2019 [1 favorite]
You can also scan a QR code from someone else's app to verify their name and that they're of age. Looks like you can log in with a password or fingerprint/face. The QR code has shifting lit up pixels and is overlaid on an image of your face, so presumably hard to fake.
I'm not sure it solves the using-somebody-else's-ID problem, because you could just install the app on your underage relative's phone or whatever and carry around your traditional license, or vice versa. But if it's done right, the QR code verification thing would make it hard to create a totally fake ID or alter your ID to say you're older than you are.
I've never actually used the app as ID, so I don't know how amenable cops are to login issues. I doubt they'd be thrilled if you had to reset your password or you were in a low-signal zone and couldn't present your license during a traffic stop. Also not sure how well it would work outside the state.
It's legal to use at bars and liquor stores, but I'm not sure they all want to deal with it and, again, I'd hate to hold up the line at a bar or the grocery store because of connectivity issues. I'd also be shocked if there aren't some rural, cash only bars in Oklahoma and Louisiana that don't have any internet connection or cell service, so I'm not sure how they would do the QR code check in that situation.
posted by smelendez at 6:09 PM on August 20, 2019 [1 favorite]
Looking forward to the day a cop (or gate agent) tells me they don’t need to see my ID because they already pulled up my info by scanning my face with their phone.
posted by D.C. at 11:30 PM on August 20, 2019 [1 favorite]
posted by D.C. at 11:30 PM on August 20, 2019 [1 favorite]
« Older "This Hugo[...] belongs to all of us." | Quillette, "Archie Carter" and the working class... Newer »
This thread has been archived and is closed to new comments
posted by ocschwar at 4:53 AM on August 19, 2019 [5 favorites]