What do I need to know about mobile IDs’ security?

1. What kind of documents can I have in my phone?

From banking to flight boarding passes, many aspects of our lives have moved onto our phones. As mobile becomes the primary way for many to navigate and interact with the world, it’s only natural that personal identity documents are the latest to make this transition to digital. Many documents can be stored on a mobile device: driving licenses, digital IDs, eVisas, and even health passports are already finding their way onto our phones.¹ Any physical document could be replicated digitally; the challenge is to ensure that the digital versions meet at least the same security levels as physical documents.

3. Can I have my personal documents on my phone without worrying about security?

Governments are increasingly working to create mobile apps and portals that guarantee utmost security and convenience for users. Phones have the advantage of having several security features built into the device. The cameras on the phone can be used for face and liveness detection for additional biometric-based security.³ Similarly, the process used to verify the Kosovan digital driving licenses, mentioned before, uses a unique QR code, which can then be scanned. This means verification is consistent and always secure.

4. What happens if my phone is lost or stolen?

It’s important to keep your device secured. However there are a range of security features to help ensure your data is kept safe, even if your device is lost or stolen. In some instances, personal data can be kept in a secure vault in the cloud. The information stored here can then be secured through passwords and biometrics, to give the user confidence that only they can access it. If a phone is lost, no one who does not have your access credentials such as biometrics can access your documents.

There are also scenarios where offline access to this information is required. In these instances, the same security levels and measures are applied and implemented as for physical documents. Regulators also play a role in ensuring personal information is secured. The EU regulation on electronic identification – known as electronic IDentification, Authentication and trust Services or eIDAS – sets out security standards for electronic authentication and doesn’t specify where the data is stored.

5. Physical documents have advanced security features – how does this work digitally? How can I be sure that this is a real, official document?

It’s important that users have the same level of trust in digital documents as physical ones. While we may be more familiar with the holograms and watermarks used to verify physical documents, there are many innovative ways to secure electronic documents. For example, digital documents can generate unique and digitally signed barcodes or QR codes, which can be scanned with specific apps to verify that they are real.

Basically, the equivalent measures to physical security features in the electronic world are cryptographic methods. Compared to physical security features, which can only be checked by trained eyes and can still fail, the electronic verification guarantees 100% accurate verification.

Many digital documents need to be easy to verify, while simultaneously preventing people without authority from reading the information. E-passports for example, achieve this by using asymmetric cryptography – this means that a different key is required to decrypt information than the one used to encrypt, making it easier to authenticate data and check whether it has been modified.⁴

6. Will I be able to use my digital documents in other countries?

The goal is that digital IDs can be used in many different countries, just as our passports can be read anywhere in the world. The EU has already recognized the importance of interoperability of digital IDs in different EU countries and has set out standards for digital authentication with eIDAS. This makes it simpler for people to apply for a residence permit or for a new passport with a foreign mobile ID.

7. Will digital documents make processes simpler in the future?

The COVID-19 pandemic has clearly revealed the advantages of having digital infrastructures in place. This is particularly true for advances in digital documents. Digital documents make it easier to complete certain actions, which would have previously required a meeting in person to share physical documents, such as when purchasing a property or opening a bank account. It can also help to reduce fraud and forgeries.

Digital solutions also unlock efficiencies and promote inclusion. McKinsey estimates that countries implementing a digital ID could unlock value equivalent to 3% to 13% of GDP by 2030.⁵ This shows that creating a digital ecosystem around virtual documents will greatly enhance convenience for consumers, without compromising on security. While huge technological developments are already underway, larger mindset shifts and further advancements will still be needed before completely transitioning to a digital document world.

Published: 30/10/2020