Slashdot Mirror
Iowa Wants To Let You Carry Your Driver's License On Your Phone
An anonymous reader writes: The Iowa Department of Motor Vehicles is busily developing software that will allow users to store the information from their driver's license on their smartphone. It would also add features like a simple barcode to scan for information transfer, and two-factor authentication to access it. "At first thought, the idea seems rife with potential security and privacy issues. It is well known at this point that nothing is unhackable; and if a project is made on a government contracting schedule, the likelihood of a breach is only greater. ... Questions of security, however, must take into account context – and there, it can be argued that our current regimes of physical documents have been an enormous failure. Having every state choose their own approach for issuing IDs has led to patchwork regulations and glaring weak points in the system that criminals have repeatedly taken advantage of. Driver's licenses today are regularly forged, stolen, and compromised – it’s far from a secure situation."
I don't see this as any different than Apple pay at some point. If this would help officers obtain validity of the license faster, this might be a benefit.
I don't think this should be a requirement for Iowa drivers, but a perk of driving in Iowa.
The downside that I can think of is that in many areas of Iowa I don't care to carry a smartphone because the lack of coverage there kills batteries.
Place something witty here
I like this idea. Yes its prone to hacking. So are paper documents. Who hasn't forged an ID setting their age appropriately to get alcohol? :) And what happens when you lose your ID, in which most wallets or purses has absolutely no form of security?
I've always said English was my second language. Had Romeo and Juliet been written in C, I might have understood it.
Handing you phone to a cop grants them implicit rights to search the phone. Therefore, having your license on the phone is a backdoor way to grant them access to search your device.
"Hello, officer."
"ID please."
"Here you go." [unlocks phone and hands it to cop.]
"Thanks.
The cop now has, an unlocked-by-you, legal access to everything on your phone. You willing handed to him, and disabled the protective lock. Enjoy your reduced legal freedom, tech hippy.
.. I can't show you my license because my battery died..
This space for rent, inquire within.
Licence has a qrcode or similar onto the DMV website.
(proper verification apps ensure that the URL is actually the DMV website and ignore any other URL)
Who really thinks that handing your phone to a cop is a good idea?
What happens when you hand your phone to the cop? Do you know consent to a voluntary search?
This is rife with issues. A cop cannot search your phone without a warrant. Once you relinquish control and voluntary give up your phone what recourse do you have if they start searching it? Cops are known for not giving a damn about privacy rights.
This makes it easier to copy someone else's license, as you don't need a fancy plastic card. All you need is an app that can read people's phones and connect to the internet (like basically every app out there).
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Anything that involves me handing my unlocked phone to a police officer is a complete no-go... it would open any of the contents of that phone to their search.
Sorry, this idea should be shot dead.
I used to have a sig, but I set it free and it never came back.
The biggest problem I have with this and carrying your insurance on your phone is in order to produce it to authorities you have to unlock your phone. Coupled with some of the rulings we've seen about law enforcement being able to rifle through your phone without a warrant, this gives them instant access to everything beyond your license.
I'd rather just stick to handing them a single card that is solely for that purpose.
------
"And may your days be long upon the earth."
you beat me to it. this was the very first thing i thought of as well. while convenient, as it would make carrying a wallet unnecessary, it's a huge trap. you can't complain the cops have your phone, if you hand it to them. not to mention the camera you're probably using to document the stop is under their control.
and the overwhelming response was "NO". Why would it be any different now?
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
... it can be argued that our current regimes of physical documents have been an enormous failure.
Unless, by enormous failure, you mean, has been working for hundreds of years, then citation please. No one's stolen my driver's license or any other physical documents - ever - and they're pretty simple to use - no batteries or cell signal required. In addition, I don't have a smartphone.
It must have been something you assimilated. . . .
I love it! An image on a digital screen. What could possibly go wrong?
This is just a ploy to get you to hand over an unlocked phone without a warrant.
This is as good a place as any for me to jump on my favorite hobby horse: the US government should be issuing a standardized national ID; there should be a federal administration that handles identity of US persons.
Specifically, the government should issue 2-factor authenticators to all citizens which do absolutely nothing but verify identity to businesses, people, and other government agencies. The service should return no name, address, or other identifying data: just a hash ID code which is unique for every person, and unique for every agency or business which requests your ID. Thus, a bank can verify that you're the same person who set up your bank account, the state police can verify that you're the same person who applied for a driver's license, but that's all they can learn about you. This would makes it very difficult for anyone but the federal government to steal your identity, and tough for anyone but the feds to correlate your credit card data with your medical data with your Facebook profile.
Obviously, this means the federal government would be able to use your identity records to track you. But they can do that anyway, with a quick call to a credit card company and your internet service provider. This at least keeps everyone *else* from being able to do so.
What happens when you hand your phone to the cop? Do you know consent to a voluntary search?
YES, in exactly the same way that getting out of your car and not locking it grants them consent to search your car... at least, in some places.
And even if the answer is no, do you trust them to follow the law? If there's one thing you can count on, it's that cops will break the law if they feel it's the best way to "get" someone they think is a "bad guy".
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Cops break the law all the time. And as a nothing citizen, we are the ones that have to cough up the thousands of dollars in lawyer fees to take the cop to court and fight it - prove our innocence or enforce the law in a case like this.
So, a cop takes your phone, data rapes it and gives it back. Good luck proving it, coughing up the money for a lawyer to punish the cop and good luck filing a complaint about the cop - "uh, we have no record of that sir."
Cops can trample your rights and cost you a lot of money with impunity and if caught red handed - "You were resisting arrest!" or some other bogus charge.
We do not live in a free country, citizen. We are a police state.
Suck it up.
On the plus side, if your battery goes flat, all you have to do is commit a crime and wait for the police to recharge your phone so they can access your ID card.
"Could" sure, but nothing you state relates to what is being developed and proposed. "Could of", "should of", "would of" and all that...
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
It'll probably involve a minimal contactless reader and token-transfer like Apple Pay.
I assure you it will not. That is not how police play that game. Furthermore that requires your phone to be on and then the officer can search the phone because you just gave him access and probable cause. If they want to come up with a system whereby the officer has no physical way to search the phone (not just legal protections) then I might think this is a good idea. As the law stands right now there is no way in hell I would do this.
Some idiot judge apparently recently ruled that while you don't have to give your password you do have to give your fingerprint. How that doesn't violate the 5th amendment involves some mental gymnastics that I'm not really capable of.
Don't need to transfer all phone data. (really? you think cops are going to sit around to transfer 16-128GB? lol)
Don't know why you are laughing. It's not funny at all. Yes I absolutely think cops are going to sit around and transfer the entire contents. You'd be a fool to presume otherwise. He gets paid to be there no matter how long it takes.
So the government wants you to accept an application built by them, including giving it permissions to operate on your phone. You don't even need to hand your unlocked phone to a cop to have them looking around in your personal business. The app can do that all by itself any time it wants. Thanks but no thanks.
Because carrying around a small plastic card is such a burden.
This wasn't a good idea the first time someone proposed this. Or the second time. Or the 5th, 10th, whatever.
Having ID that I may need to hand to a city/state/federal official, that lives on my phone...is a complete non-starter.
You get the little plastic thing in my wallet. You do NOT get all of my contacts and other information as well.
How awesome for Iowa that they'll be able to clock your speed via GPS and connect that with driver's license data, and all by willing participants.
They want you to install an app. Yet pretty much a picture of the barcode is all that is needed. Considering the poor state of security on phones the rights are far to course grained. The app needs to connect to the DMV for authentication means it has access to data at all times. You quickly have a heavily encrypted app that can can expand it's scope of permissions with clueless users.
They will I assume want you to hand your phone to the cop unlocked. Maybe your smart and setup a secondary login with only the licence and insurances apps more probably you handed a cop access to your entire digital life. Is that enough protection to secure the phone from state overreach?
Expand it out will bouncers be able to validate the licence? In effect that means the state knows when you went to what club.
Will potential employers be able to use it? Now the state knows every place you ever applied for a job.
Will stores be able to use it to cash a check (I know how many people will use this that still use checks)
Are fake ID's really a problem primarily it's for buying booze and we along with a handful of other first world nations has the highest legal drinking age in the first world.
What does the phone app add over the existing ability for police to pull up a photo id via the barcode or just name and address on the in cruiser laptops.
How portable will this be one state must accept another's ID. Will they build in the same protections? If so how will they be required to do so and held accountable for failing to do so?
At this point a simple name and address should be all that is needed to pull up a picture ID.
No sir I dont like it.
Right now I can opt out of any identification requirements by simply not engaging in activities that require it. Don't want a drivers license? Don't drive. This will not be the case if any form of ID is created solely for the purpose of identifying individuals. Then you won't be able to 'opt out'. It will be a short step to requiring identification be carried at all times.
Have gnu, will travel.
The time has come to eliminate the laws that vary from state to state and make national laws that apply to all American citizens. The primary objective of states' rights was to keep slavery for the southern states.
Remember kids, if you're not paying for the service, YOU ARE THE PRODUCT THAT IS BEING SOLD.
Users must be able to provide officers with DL information, but officers must not be able to get any additional data.
Obligatory xkcd.
I don't see why you think that handing an officer your phone for one reason - viewing the on-screen ID, would appear to translate into "I grant you permission to close the ID app and browse/download my email and photos."
That is EXACTLY how it will be interpreted by the police until they are told very explicitly that doing so is a no-no. In fact odds are they will keep doing it anyway because the cost of fighting them on it is really steep, well beyond what is reasonable for most people. Justice may be done at the end of the day but that doesn't mean that you won't experience a whole bunch of severe inconvenience and civil rights violations along the way.
And how are you going to go about recording your stop when the police just took away your camera? What if they don't bring it back when they come back to your car, something serious comes up, and you have no evidence regarding what happened?
I thought you were holding it out for me to take...whoops...I'll bring it back to you in a few minutes.
My God can beat up your God. Just kidding...don't take offense. I know there's no God.
Hell will freeze over before I hand my phone to a police officer.
You haven't had much experience with cops, right? Besides, even if you're only getting a traffic ticket, they'll want to take it back to their car.
-- sudon't
Air-ride Equipped
See the USA in your Chevrolet... But bring a physical driver license.
...omphaloskepsis often...
You are not required to incriminate yourself.
Agreed.
This however does not mean you cannot be compelled to give physical items,or access to physical items (including fingerprints).
I disagree that I should have to (potentially) incriminate myself by giving access to data that the police would not otherwise have the ability to access if I were not present.
The cops have no right to demand you produce your passphrase.
Nor should they have any rights to my fingerprints except for taking ink copies for comparison should prints be relevant to a criminal investigation.
They have a right to demand the bit of paper they know you wrote the passphrase on.
That doesn't mean they should be able to physically force me to enter the passphrase into the device. They can do that bit of work themselves. Forcing you to enter your fingerprint is a functionally identical process to forcing you to enter a passphrase - the only difference is that one doesn't involve my memory. They can take my keys but I see no reason to insert them in the door for them. They can do that without me - or not.
"At first, I thought . Then, I realized ."
I guess we're supposed to complete the enthymeme, "Maybe I don't understand the technology well enough to realize it fixes all the hypothetical problems I imagined in my ramble. The people proposing it probably understand it better than I do, and that must be why they're proposing it, so I support the proposal." We need to start forcing people to say that part out loud so they can hear how ridiculous and irresponsible it sounds.
Not just no. Hell no.
So, driving without a phone will be a crime..
Actually, it's considerably less of a security concern than Apple pay.
Your Identify isn't secret, so all this really has to do is transmit your ID code on demand in any convinient method.
Then it's up to the cops to have a secure database of ID's and using your ID code look up the record which contains the photo, date of birth etc.
In order to compromise the system you have to compromise the government run database, rather than the easily forged ID card.
It's the same principle as running your plates.
If/when this becomes the standard and not just a perk, you could just use a secondary cheap phone with nothing but your ID on it. None of your contacts.
It'll probably involve a minimal contactless reader and token-transfer like Apple Pay.
I assure you it will not. That is not how police play that game.
You're probably right. It'll probably be a generated image of a physical ID.
Furthermore that requires your phone to be on and then the officer can search the phone because you just gave him access
True.
and probable cause.
False. Handing the officer your phone does *nothing* to give probable cause.
Unfortunately, simple access is (far too often) more than enough for many officers to make the search in the absence of either probable cause *or* reasonable articulable suspicion, even when the target of said search has expressly *denied* consent for said search.
Even more unfortunately, courts uphold those searches far too often.
If they want to come up with a system whereby the officer has no physical way to search the phone (not just legal protections) then I might think this is a good idea.
Maybe.
As the law stands right now there is no way in hell I would do this.
Some idiot judge apparently recently ruled that while you don't have to give your password you do have to give your fingerprint. How that doesn't violate the 5th amendment involves some mental gymnastics that I'm not really capable of.
Don't need to transfer all phone data. (really? you think cops are going to sit around to transfer 16-128GB? lol)
Don't know why you are laughing. It's not funny at all. Yes I absolutely think cops are going to sit around and transfer the entire contents. You'd be a fool to presume otherwise. He gets paid to be there no matter how long it takes.
Actually, as long as the flash memory on our phones stay slower than maximum USB 2.0 speeds. It will get progressively *less* reasonable for the officers to make you sit and wait for such a procedure. A 128GB phone that is completely full would currently take over 36 minutes if the transfer managed the full 480Mbps (60MBps) available over USB 2.0. (Hint: the flash memory in your phone is slower than that.) Likewise, a *full* 64GB phone would take a touch over 18 minutes, which is inside the range of time courts have allowed officers to hold someone to bring in a drug-sniffing dog, but not by much. For 32 GB it would take a bit over 9 minutes. For 16GB, it would take less than 5 minutes. You probably wouldn't even notice the difference between that and the time it *normally* takes them to run your license, etc.
Like I said, phones are currently much slower than USB 2.0's theoretical maximum transfer rate, so double those numbers for a better comparison. Absent an arrest, holding someone for an hour to image their 128GB phone would almost certainly be deemed an unreasonable search. As would half an hour for a 64GB phone. The 18 minutes for a 32GB phone would be pushing things, but it might take some time for people to realize that's what was happening and get a suit through the court system. The 9 minutes for a 16GB phone would probably escape notice for a *long* time.
Just another reason to get the most storage capacity you can afford, I suppose.
APK's spam script only harasses its target for 5 days or so. If you wish to get re-added, simply make a new post, use HOSTS suck and so does APK, or something similarly embarrassing, and he'll pop right in. His script does not scrape normal comments, so he won't see your shout out. It does apparently scan subject lines though. I've already started one for ya. You're welcome.
Police are supposed to ask you to remove it from your wallet and hand it over. That whole pesky 4th amendment thing about illegal seizure, not mention preventing being accused of stealing any money that might be in it.
Seriously, every stop I have been a part of, as driver or passenger, the office has said to remove it from the wallet, even if its in one of those little clear-plastic faced slots.
Your identities are already digitized in DMV databases, police databases, and federal intelligence community systems, so is it really that much more hacker friendly? This is just your ID and picture, too, shouldn't anyone be able to look it up to confirm who you are? Say, type in your name, without you needing to carry an ID care, and look you up to see that your picture/etc matches?
obamasweapon.com
But seriously, not ever, ever, ever on your smartphone.
A whole lot of information is on there, and the second you hand it over, you have just given consent for it to be searched.
And in a day and age where officers can somehow legally confiscate your cash, I can't help but wonder what happens when they have access to your credit card.
Note this is not just the never ending bitching about "popo" but just noting that giving up your phone to anyone isn't a good idea. Ever.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Imagine what that coward Alabama cop who paralyzed a helpless innocent Indian grandad in yesterday's news would've done with his phone if this was the norm in Alabama too.
and we still need phones
given that it's not that hard to make a fake drivers license,
presumably somewhat harder to fake whatever the phone will cough up as a drivers license
and virtually impossible to fabricate whatever database entry the cop pulls up when he takes your license back into the car to check it, there is no reason for you to carry anything of the type on you, other than your face and your name. (fingerprint would make it pretty foolproof but the privacy!!! guys will never like that; maybe then can be left to carry a card around with them that "proves" their identity)
"the harassment stopped the instant I began calling him out." - by swillden (191260) on Saturday February 14, 2015 @01:55AM (#49053517) Homepage
swillden = "Run, Forrest: RUN!!!" 7x http://slashdot.org/comments.p... vs. myself... & WHO started up with me 1st? Swillden -> http://yro.slashdot.org/commen...
* Care to tell us WHY Google removed hosts files in ANDROID KitKat or better, Mr. WANNABE "security engineer"? Your security in ANDROID blows in case you haven't noticed... must be YOUR "fine handiwork"!
Hahahahahaha!
(If you'd quit trolling others, like myself as shown in the 2nd link above, then, MAYBE, you'd have the time to do ANDROID security right vs. the mess you have now, eh? LOL... & removing hosts didn't help, now did it?? Nope! Hosts aid security if anything (+ speed, & reliability online also)).
APK
P.S.=> If you're indicative of the WEASELS Google's hiring (allegedly in your case, somehow I DOUBT you have a B.S. or better in Comp. Sci. & Math as you claim)? They're in DEEP shit... apk
I actually have a driving license (about a 50% probability for a random person in this country), and only in the last couple of months down-graded to a photographic one. Naturally, I don't carry it with me, except when I'm going to hire a car. Otherwise, it's simply not necessary, and there is no way that I am going to let our local police get into the habit of thinking "you must carry THIS piece of ID with you at all times".
But then, it seems that Iowans obviously have got into the habit of valuing convenience (for the police) over the liberty of the individual.
Didn't some guy called Frank Benjamin say something about that once?
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"