Digital licences no threat to security: study

A CYBER security expert from Melbourne’s RMIT university said a recent study has shown digitised licences are a safer alternative than the physical alternative when it comes to protecting identity.

The reassuring news comes as Victorian motorists follow other states in accessing the advanced technology from this year. Victorian drivers will soon be offered the option to carry their licence on their phone following the successful trial of the technology in the regional city of Ballarat.

RMIT centre for cyber security, research, and innovation Dr Arathi Arakala says the digital licence is not only convenient, but far safer than the physical option.

“Victoria began a pilot roll-out of its digital driver’s licence in Ballarat in mid-2023 with more than 2500 local licence holders participating,” she said.

“The take up demonstrates that Victorians are eager to adopt the new ID technology where their licence is digitally accessible via the Victorian Government’s dedicated phone apps.

“Victims of identity theft and fraud have reported stolen or lost driver licence cards as the most common identity document used by perpetrators.

“In addition to enhancing user convenience, a digital licence has several security features that protects a user’s privacy and security against fraud, starting with the requirement to log-in to the app with a pin or face ID to access it.”

Dr Arakala said rigorous penetration testing of the service has shown some vulnerabilities, but that these so-called ‘common attack points’ will be studied and remediated prior to the full rollout of the service.

“The Victorian Government claims that the Service Victoria app and myVicRoads apps that will house the digital licences are going through rigorous penetration testing during the pilot phase,” she said.

“We hope common attack points will be studied and fixed before the full rollout this year.

“If the phone is lost or stolen a user can get the licence revoked and a new licence number can be applied for. These new credentials will reflect in real time on the Victorian Licensing Registry database.

“When a user presents their ID, data will be pulled from the Victorian Licensing Registry database that reflects information about licence revocation or suspension, address change and so on, updated in real time.”

Given screenshots of the licence are not eligible for verification, Dr Arakala said the theft of identification is harder for malicious entities to reproduce.

The app ensures a timed QR code provides authorities with the verification required, while preventing older credentials from being used for fraud.

“Information can be validated by the verifying authority using a timed QR code on the digital driver’s licence. The two-minute timer expiry ensures that data is valid and current, and prevents any old credentials being used for fraud,” she explained.

“Screenshots of the digital licence are not acceptable for verification. This makes identity theft using the digital driver’s licence hard for a malicious entity.

“The licence has three levels of information access allowing users to show only as much information as needed – age only; identity that includes photograph, full name, address and signature; or the full licence displaying the front and back of the card.

“Some of the challenges of having everything on a mobile phone extends to the digital ID too. For example, low battery, severely damaged phone screens and poor network connection could hamper the use of the digital licence. In those situations, a user can always fall back on the physical licence.

“The digital driver’s licence is a great step toward a more secure and convenient licence system,” she concluded.