Virtual Green Cards Offer Path for Digital Wallets’ Data Privacy

The US Homeland Security Department is seeking private sector partners to help build infrastructure for potentially deploying digital versions of immigration and travel credentials, a project that provides a novel, nationwide opportunity for advancements in virtual wallets.

Its late June invitation prioritizes preserving the privacy of the credential holders—a key concern for development and adoption of the technology. Users could include holders of green cards that grant non-US citizens permanent residence or of trusted traveler cards, which let pre-authorized passengers skip security lines at airports.

DHS officials haven’t finalized a plan yet for whether or when implementation of these ideas might begin, though some functions may see testing as soon as later this year or early next year.

The vision, if adopted, would roll out the first federally issued digital credentials of their kind as states across the US increasingly launch their own digital driver’s licenses. These credentials rely on virtual wallets for storage, either as standalone apps or those integrated in the Apple Inc. and Alphabet Inc. mobile operating systems.

Proponents of digital credentials tout their convenience and resistance to fraud compared to traditional versions. But privacy advocates worry that digital documentation could be used to track people in ways that paper or plastic counterparts can’t—by pinging the agency that issued the credential whenever someone presents it for verification. Avoiding this “phone home” problem has been a guiding principle for the DHS project, according to officials working on it.

“If you’re using a paper-based credential, the issuer has no knowledge of how it’s used,” said Anil John, director of the DHS’s Silicon Valley Innovation Program, which is shepherding the project. “We want digital to be the same.”

The program is offering up to $1.7 million in funding to each startup or small business that participates in the project.

‘Innovative’ Uses

The Homeland Security Department took its first step toward potential new digital credentials in 2018, with a similar request for involvement by private sector firms with technologies related to issuing the credentials. Now the agency is looking for partners to work on digital wallets for storing the credentials and verification technology for accepting them.

Officials say digital credentials would be offered as an option, not as a replacement to traditional cards. DHS has proposed a variety of potential purposes for digital credentials, such as showing citizenship, employment eligibility, or residency status.

“It is a pretty innovative set of use cases to explore,” said Jeremy Grant, a former National Institute of Standards and Technology official who’s now managing director of technology business strategy at Venable LLP.

Grant coordinates the Better Identity Coalition, which advocates for policies that improve the way Americans prove and safeguard their identities in a digital world. The coalition’s members include identity verification providers like IDEMIA and ID.me, in addition to financial institutions such as JPMorgan Chase & Co. and Mastercard Inc., whose business relies on customer authentication.

One of the pioneering aspects of the DHS project is a goal to design digital credentials in a way that allows their use online. Capabilities so far have largely concentrated on in-person identity checks, like using a mobile phone to present a digital driver’s license at airport security kiosks.

Any new digital credentials from the Homeland Security Department should be built to support online transactions, an official with the agency’s Citizenship and Immigration Services unit said. That could include letting an applicant for a California driver’s license, for example, prove their identity to the state’s Department of Motor Vehicles by sharing a digital copy of an immigration credential.

Adding App Functions

The digital wallets initiative is part of a broader plan to modernize previously paper-heavy agency functions, according to an official from US Customs and Border Protection. The DHS component has developed a mobile app called CBP One that’s become a hub for these efforts and could eventually include a way to hold credentials too.

The app started out as a route to digitize travel and trade tasks. Customs forms that foreign visitors to the US fill out upon arrival are now available electronically through the app. Cargo carriers arriving with perishable goods, like flowers or fish, can make inspection appointments on the app at participating ports of entry.

CBP One later grew to include a scheduling function that allows aspiring migrants or immigrants to request appointments to make their case for crossing into the US—its most controversial component so far. It has faced criticism from groups including the Migration Policy Institute for limits on its language options, technology breakdowns, and an inability to prioritize appointments for people with a pressing case for asylum in the US. DHS has responded to the prioritization issue by expanding the number of appointments available and allocating a percentage of daily slots to people who have been waiting the longest.

Shifting toward app-based systems like these risks leaving out people who lack resources for a smartphone or reliable cellular data. Still, giving people a way to keep a digital copy of important documents like a green card could be helpful, according to Colleen Putzel-Kavanaugh, an associate policy analyst with the Migration Policy Institute’s US team.

A digital copy would be safer to keep track of and easier to share electronically with an immigration lawyer, for example, she said.

“Some people are operating exclusively from phones anyway,” Putzel-Kavanaugh said. “So it would add a level of security and ease that currently doesn’t exist.”

Digital Architecture Issues

There are other technical challenges that come with digital credentials, though.

DHS officials say cybersecurity would be a focus for design considerations, since hackers may target virtual wallets that are already accumulating payment cards and passes. Adding credentials means these wallets would be responsible for storing sensitive personal data, such as citizenship status.

As a privacy protection, the agency’s invitation to industry envisions a scenario in which a digital credential could share only as much information as is necessary for a particular verification need. An immigrant who travels outside the US, for example, could share just enough details with a government official to prove they are authorized for re-entry.

Another goal of the Homeland Security Department’s project is to counter “lock-in” to a particular vendor or technology, according to its call for funding applicants. Officials are wary of dominant private sector platforms—like the Apple and Google wallets—becoming gatekeepers between government agencies that issue credentials and individual credential holders.

“We’re in a formative moment right now,” said Jay Stanley, senior policy analyst with the American Civil Liberties Union’s Speech, Privacy, and Technology Project who’s studied the implications of digital driver’s licenses. As a big player in the credentialing ecosystem, the federal government may have the power to affect the digital credentials architecture as it develops, he said.

“If we get locked in, it should be something that’s got maximum capability to protect privacy,” Stanley said.