Indiana BMV to offer digital driver’s licenses, but when?

More than three years after Indiana lawmakers passed legislation to authorize the Bureau of Motor Vehicles to issue digital driver’s licenses, the effort to bring mobile credentials to Hoosiers appears stuck in neutral.

In May 2019, Gov. Eric Holcomb signed into law House Bill 1506, which included several measures designed to improve efficiency at the BMV. It also authorized the agency to develop and implement a system to issue mobile credentials.

At the time, BMV officials told local media outlets that Hoosiers could expect to use a digital driver’s license by July 2021.

But there’s no longer a timetable or even a cost projection for the program. BMV officials say they still plan to offer digital driver’s licenses, but they did not answer questions about why the project has been delayed.

“Indiana is actively researching opportunities to bring a mobile driver’s license and ID card to Indiana, which includes cost projections and options for bringing this service to market,” said BMV spokesperson Melissa Hook.

One of the major benefits of a digital driver’s license, or mDL, is convenience. Drivers can simply carry their license on their phone, rather than having to carry a physical version in their wallet.

Another advantage is that the service gives the license holder more control over how much information on the license to share. Hook noted that drivers could “show age verification without revealing more personal information such as address, birth date, height or weight.”

While that might be appealing to some, civil liberties groups worry the program could have the opposite effect.

The American Civil Liberties Union issued a report last year, “Identity Crisis: What Digital Driver’s Licenses Could Mean for Privacy, Equity and Freedom,” that raised concerns that law enforcement could use digital licenses as a pretext to search people’s devices, state agencies could instantly remotely revoke digital driver’s licenses or sell drivers’ personal information, and hackers could gain access to sensitive user data.

“Digital driver’s licenses raise a number of privacy and equity concerns and should be adopted only if they incorporate available privacy-protecting technologies and steps are taken to ensure that they are not made mandatory and do not lead to a society of ubiquitous ID checks,” the ACLU concluded in its report.

Selling your data

Other advocates fear the information could be sold to marketers or other third parties. Sheila Dunn, spokesperson for the National Motorists’ Association, an organization that “supports efforts to retain motorists’ freedoms and rights,” cited a 2019 case in Florida where the Department of Motor Vehicles was found to be selling information to more than 30 private companies, including bill collectors, insurance companies, data brokers and marketing firms.

“I don’t think people are aware that information is being sold by our states,” Dunn said.

State motor vehicle agencies, including the Indiana BMV, routinely provide personal information to different entities, though there are often restrictions on who can access the data and what information can be released.

Last year, WTTV-TV Channel 4 in Indianapolis obtained documents showing the BMV was selling personal information to more than 1,400 businesses, including tow companies, car dealerships, law enforcement agencies and security firms. The state collected more than $10.6 million by selling the information in 2021.

In response, the BMV said the agency is permitted under state law to release that information to entities “who qualify under Indiana statutory standards.”

According to Indiana law, the BMV can disclose certain personal information to entities if the information is limited to certain uses, including bulk distribution for surveys, marketing or solicitations—as long as the bureau has obtained the written consent of the person to whom the personal information pertains.

Other privacy advocates worry that a digital license would give institutions a new tool to track the movements of people who use it.

“The ultimate aim is to control you, in a way,” Dunn said.

HB 1506 did implement certain safeguards to protect Hoosier privacy. For example, similar to the Louisiana statute governing digital driver’s licenses, the Indiana law does not give a police officer the authority to “search, view, or access any data or application on the telecommunications device other than the mobile credential,” unless the officer obtains a search warrant or believes the phone has been used in the commission of a crime.

In other states, a police officer, bouncer or liquor store clerk must use a gadget to scan a digital license, meaning the phone never has to leave your hands. In Colorado, state troopers say they’re trained to avoid handling people’s phones.

Dunn said drivers should still be wary of handing their phone over to a police officer.

An Indiana State Police spokesperson declined to comment on the implications for police officers if digital driver’s licenses are offered, noting that the system has not yet been implemented.

How we got here

Rep. Ed Soliday, R-Valparaiso, who sponsored HB 1506, said several states have implemented digital driver’s licenses without compromising user privacy.

“Anything can be hacked, including the BMV,” Soliday said. “Show me some data, and let’s look at the risks.”

In 2018, someone created a webpage that looked like the BMV page and carried out a “search engine optimization attack” that caused the fake page to show up at the top of Google search results when users searched for the Indiana BMV, according to news reports at the time. The Indiana Office of Technology said none of the state’s web pages was affected or compromised.

Other states have experienced more severe threats to personal privacy. In February 2021, the California Department of Motor Vehicles warned of a potential data breach after a contractor was hit with a ransomware attack.

Former Sen. Jim Merritt, a co-sponsor of the bill, said many of its measures were part of an ongoing effort to modernize services at the agency. The BMV has closed several branches in recent years and encouraged more Hoosiers to perform certain transactions online or at remote kiosks.

“With the voluntary nature of this bill, I don’t have any problems with the security of it,” Merritt said. “We’re using credit cards on Amazon, and our information is out there, and if you don’t want to do it, you don’t have to do it.”

The BMV has declined to provide a timeline for when mobile driver’s licenses will be offered, but Soliday said high turnover at the agency could be the reason the program has been delayed.

Other states have already implemented their own programs. In Kentucky, Iowa, Maryland, and a host of other states, residents can store their state IDs as digital replicas in their iPhones’ Wallet app or on their Android device.

The main allure for a digital ID is convenience, but privacy advocates like Dunn worry that it will come at the expense of user safety and security.

“There’s the convenience of doing it online, but what is the trade-off? That’s what we really don’t think about as individuals and as a collective.”•