Apple Imposing Strict Terms on U.S. States for Digital IDs in Wallet App

[msackey]

The question is, do we trust the the government with IT security implementations? How many government organizations have been infiltrated by randomware or other forms of cyber attacks? A certain government owned transit corporation in Canada was recently under ransomeware attack.

You will probably be better off with Apple setting stringent guidelines and knowing that your personal data will not leak into the Internet.

Oh let us not kid ourselves. Private companies have been hacked too, including well known companies such as Microsoft. Just do an internet search.

 

[hydropsyche]

Only an idiot would put an ID on the phone because once you show that to a cop they have legal rights to examine the phone later on.

 

[VJoshi]

Apple's agreement with U.S. states looking to add digital ID cards such as driver's licenses to the Wallet app includes strict terms and charges footed to the taxpayer, according to fintech consultant Jason Mikula and CNBC.

The ability to add a driver's license or ID to the Wallet app is a new feature in iOS 15. Customers will be able to tap the plus icon at the top of the Wallet app to add their ID, and then simply tap their iPhone or Apple Watch on an identity reader at a TSA checkpoint, without taking out their physical card.

Confidential documents seen by Mikula and CNBC purportedly reveal that Apple is imposing stringent terms and conditions on U.S. states looking to implement the new feature. The costs of meeting these requirements, such as hiring staff, project management, marketing, and funding, will be charged to the taxpayer with no financial support from Apple.

The company requires states to independently maintain the systems used to issue and service credentials, hire project managers to respond to Apple's inquiries, verify IDs, perform quality testing to ensure that digital IDs meet Apple's requirements, "prominently" market the feature, "proactively" offer digital IDs whenever a citizen gets a new or replacement card, and encourage state and federal government agencies to widely adopt digital IDs.

Apple has "sole discretion" for a number of the program's key aspects, including what devices will be compatible with digital IDs, how states report on the performance of the feature, and its launch date. Apple is also insisting upon the ability to review and approve all state marketing for the feature.

These terms were apparently included in a seven-page memorandum of agreement that was signed by Georgia, Arizona, Kentucky, and Oklahoma. According to CNBC, the agreement "mostly portrays Apple as having a high degree of control over the government agencies responsible for issuing identification cards."

Georgia and Arizona are set to be the first states to offer citizens the opportunity to add their driver's license to the Wallet app, but have yet to launch the program. CNBC noted that while it reviewed the contracts for these states, it has not seen the exact agreements for Connecticut, Iowa, Maryland, and Utah, the four other states that have signed up for Apple's digital ID program.

Article Link: Apple Imposing Strict Terms on U.S. States for Digital IDs in Wallet App

This is not new. And this isn't how this whole thing should had been done.

A similar app is already present in India, for years, called DigiLocker. This app is developed by the federal government of India and any documents (like driving license, graduation certificates, and a lot more) added to the app are authenticated and digitally signed by the government of India. All these documents that you add in the app are required to be treated as original by law.

I believe the federal government of any country, along with the states, should facilitate this project with a proper and secure framework that is embedded into the legal system and then provide API's to the third parties to implement this feature into their apps (like Apple wallet, etc).

 

[SouthPalito]

I fail to see what is the scandal? seems pretty normal. The states are always responsible for their ID systems. Apple is not in charge of maintaining or running a state‘s IT deparment.

 

[bgillander]

Oh for crying out loud. Of course the state’s licensing department is responsible for this. You know what would be worrisome? If Apple did offer to take all your data and provide the digital IDs for free. What was their old slogan? “If you’re not the customer, you’re the product”? It’s not like there isn’t already a cost to the state to produce the physical license, and I would assume that the long term thinking is that they hope to eventually reduce that cost. Oh, and Apple is forcing the bureaucracy to hire more people!! Sure, right. No other company has ever said, “Hey, maybe you should have some qualified people working on this project before you go live.” (Actually, that may be true, considering past experience, but that just proves that maybe someone needs to point that obvious fact out!)

That story is pretty much the usual “what about the children/taxpayers” click bait.

 

[amartinez1660]

This will perhaps be an unpopular perspective, but If you actually read the text carefully, and then propose to yourself what the opposite would be, you wouldn’t want the opposite. This isn’t Apple “setting a standard” (see below; Apple is using an ISO standard, not their own), and this isn’t Apple taking control over state infrastructure (which I imagine nobody would want).

Apple is, as someone pointed out above, making the wallet. They’re simply informing states of the work that goes into producing the actual ID that goes into the wallet, and making it clear Apple won’t help them in doing so. States are free to use the same digital ID on non-Apple devices (again, it’s an ISO standard), and they should do so only if they feel it benefits them and their taxpayers. If they don’t… fine.

A specific point:



This is actually a good thing. Ever seen the TV shows where you get a “free $10000 renovation” and it‘s done slipshod? Having the states own the finances means the states have control over the implementation. They can implement it in a way that facilitates cross-platform compatibility, for example. Ultimately, this doesn’t “benefit Apple,” in that Apple sees no incremental revenue for this feature; it “benefits taxpayers,” who’ll need to foot the bill. If a given state’s taxpayers don’t want the bill or the benefit, cool, their state doesn’t need to do it.

This won’t stay an iOS-only feature; there’s zero chance any government who stands up this infrastructure won’t deploy it as widely as possible. Android may not offer something similar today, but what Apple’s doing is based on a set of open standards—Google can add this into Android anytime they want.



The actual text doesn’t preclude states from offering this to non-Apple devices; it says that Apple will determine which Apple devices Apple supports digital IDs on.



Again, you’d want this. You don’t want someone else doing it.



Again… I’d think this is how you’d want it. “Apple‘s requirements” being, in this case, the standards that Apple has adopted and is using. You surely wouldn’t want Apple verifying IDs Or doing QA on the systems.



Yeah, I mean, maybe this is a bit much, but I can’t imagine states spending the money and not marketing it. Nevada DMV launched a mobile phone reservation service (which works quite well) and they’ve probably spent more marketing it than they did developing it, to get people to use it.



I kind of assume you’d want this if you were going to invest in a digital ID program. Maybe instead of seeing this as “Apple being restrictive,” you can choose to see it as, “Apple saying, ‘hey, only do this if you’re going to be serious about it, otherwise don’t bother.’”

And from above…



Poland is a single country; the 50 US states are much like individual countries in this regard. You cannot view the US as a “country” in many aspects—the Federal government, in some regards (including IDs) acts more as an EU. For example, the Federal government has guidelines on IDs like driver’s licenses, which states can choose to follow or not. For example, in Nevada it is entirely possible to get a Federally approved “Real ID” as well as a non-Real ID. Coordinating ID activities across 50 states is a huge lift.

Also from above…



They did, in the US. It’s called “Real ID.” And it still hasn’t been fully adopted. The Federal government is abysmal at coming up with standards, let alone technological ones. Apple is building these off digital ID standards that Apple itself does not own (although it participates in the working groups):



”ISO” is the International Standards Organization; Apple is not creating the standard, here.

And finally..



Having worked on a number of Federal technology projects, I can pretty much assure you this is the very last thing you want. But again, the standard here is not Apple’s. It’s an open spec from ISO. Google has participated in that same standard, just as Apple has.

You might consider the perspective of, “Hey, Apple will make this possible for you, but if you and your taxpayers want it, you’re going to have to pay for it. If you’re going to use our trademarks in your marketing, we want to review that. If you’re going to do this, you might as well promise to market it. Apple’s going to invest something in this [otherwise we wouldn’t need to be sending you inquiries to help get it working] but we want you to own this.”

Legal terminology can sometimes make things seem more evil than they actually are. That’s because legalese isn’t pure English; it’s a set of phrases that have been honed over time to help ensure everyone understands what they’re agreeing to. So just maybe consider that what Apple’s set up is perhaps mostly in the taxpayers’ best interests. They’re using an open standard, they’re forcing states to own the infrastructure and ID data, and they’re not letting states dash this off quickly or without careful planning. I’m surprised anyone would want something different.

If MR ever implements sticky or highlight comments at the beginning this one would be it,
it would help stop the indignation/rage comments still spawning on.

Thanks for the thorough explanation

 

[Nuno Lopes]

Much ado about nothing. From the writing it seams pretty standard requirements for any project.

What is not standard is the gov to reach with this forms of agreements with just one platform maker. As it stands it seams that Android users are second hand citizens in these states.

In this context I would expect any government to be the ones setting the digital standard, both procedurally and technically that companies could than enlist themselves to be part of. Offering access to fix APIs and all for the purpose of integration with this purpose. Much like payment services do.

 

[svish]

Apple would definitely want to have control.

 

[TundraKing]

Another example why of many of the initiatives they undertake most only garner a tiny slice of the total pie....... Apple has a small but loyal base but for this to be worthwhile to most states they need to see a majority of their population desire it. After all politics and tax funds are involved which makes a volatile mix...

There is little chance of this becoming nationwide under the current terms. It's mostly a PR move for them at this point. If Android gets aggressive here Apple will likely quietly change its tune.....

 

[jweinraub]

Since I am an old fogey now I don't really see why anyone would want this and ditch the wallet concept. I prefer my watches analogue, my money paper/linen/whatever, and my wallets bifold. I like my slots for credit cards, cash, ID. Not everything has to or needs to be digital.

 

[msackey]

Only an idiot would put an ID on the phone because once you show that to a cop they have legal rights to examine the phone later on.

Hmm, interesting!

I’m curious to know about the legal ramifications of all of this.

 

[nt5672]

Sounds like this isn't going to be widely adopted then.

Yep, if I was a state, then I would expect a universal system, not getting locked into Apple's ecosystem. I hope this falls apart. We've had enough big brother.

 

[DeepIn2U]

I hope California says "NO thanks, NOT interested !"

Allowing for continued fraud.

in the USA very few states communicates Births/Deaths/(your version of our Canadian Social Insurance Card which is required for being paid by an employer ... I think US is social security). Great way if you're a Highlander and are immortal to continue impersonating someone and transferring unclaimed wealth, etc OR like Kevin Mitnick did to avoid the FBI for almost 2yrs travelling state to state.

unifying such data kicks states into gear to get their act together. This will force back-office record keeping to be done properly.

 

[SqB]

Since I am an old fogey now I don't really see why anyone would want this and ditch the wallet concept. I prefer my watches analogue, my money paper/linen/whatever, and my wallets bifold. I like my slots for credit cards, cash, ID. Not everything has to or needs to be digital.

I will be sure to stay off your lawn if you would just please stop yelling at that cloud.

 

[DeepIn2U]

Only an idiot would put an ID on the phone because once you show that to a cop they have legal rights to examine the phone later on.

Are you certain of this? is this legally true in some or all the USA?!
Links to support this? Just cause a cope sees you unlock the door to your home does NOT give them the legal rights to just enter or place surveillance on you. not without legal premise and a court order.

 

[lartola]

If Mexico is not a developed country, why are so many US citizens retiring there?

Well….not as developed as the US or the EU. They retire in Mexico because they want to enjoy the beautiful weather and places they couldn’t find in the US. They want to spend their last years without having to suffer freezing temperatures part of the year and 100ºF heat in other parts of the year. And it’s close to the US should they need to go back for any reason.

 

[lartola]

I don’t think the reason is because the government is clueless. Rather, American society pushes strongly towards privatization and corporate welfare, and meanwhile leaving the notion of general public to the wayside — or, one could argue robbing the general public of public wealth. It’s active corporate privatized takeover which is actively destroying government.

Not only that. Specifically with respect to the Covid vaccination card, the republicans/trumpists pushed very hard against having a national covid vaccination card in the US because they don’t want covid vaccination to be mandatory. They think a national covid vaccination card would make it easier for companies, government entities and other organizations to mandate covid vaccination for their employees/members.

 

[Philip_S]

I'm confused as to why Apple would be expected to foot the bill for any entity ( state or otherwise) to utilise functionality in an Apple product. The fact Apple have strict guidelines sounds eminently sensible otherwise no-one would accept or trust the digital IDs.
And the oversight on marketing sounds like a sensible idea to avoid anyone advertising in a way that would damage the digital ID concept for all states.

Saying “here’s the file format, here’s the supported signature methods, the rest is on you” is fine, provided there’s no patent encumbrances or the like and everything is properly documented, and it’s secure.

Requiring states to lobby on behalf of digital IDs is completely unacceptable, and ought to be outside the permitted provisions of a government contract (especially for every state other than California, since it is a California company). Requiring prominent and proactive marketing is also a bit much, though I’d have no objection to them saying it has to be advertised no less prominently than any competitors’ platform.

 

[Philip_S]

If MR ever implements sticky or highlight comments at the beginning this one would be it,
it would help stop the indignation/rage comments still spawning on.

Thanks for the thorough explanation

They do, but only if you go to the article page first and don’t just expand the story from the front page and then click the comments link.

 

[ifxf]

It would be nice if my state adopted this but it wouldn’t stop me from carrying a physical license since the US is worse then a 3rd world nation with respect to adopting a universal tech like this. We still have mag stripes on our cc. We have chip & sign instead instead of chip & pin because the cc companies think Americans would be “confused” with pins.

 

[lartola]

It would be nice if my state adopted this but it wouldn’t stop me from carrying a physical license since the US is worse then a 3rd world nation with respect to adopting a universal tech like this. We still have mag stripes on our cc. We have chip & sign instead instead of chip & pin because the cc companies think Americans would be “confused” with pins.

And your sit down restaurants still have to take the cc’s away from their owners as was done in the 90s because they prioritize their own ease and comfort in recording the payments over the security of the customers’ cards (because even the restaurants that upgraded to chip did so by buying wired pinpads, which still require to process payments away from the tables, instead of wireless terminals).