It’s a convenience, but one that needs safeguarding.

Californians can now keep a digital copy of their driver’s license in Google Wallet. I believe this is an important step in making identity easier to verify, and these tools might eventually be more accessible than the way we require carrying physical cards.

It is a technology I think will be useful, and I’m happy to see some babysteps towards improving the experience. It’s an important improvement over  carrying grocery store membership cards.

To be clear, it’s not an immediate shift where we can rely solely on a digital wallet. From Governor Newsom’s blog post:

“The mDL does not replace the requirement to carry a physical driver’s license while driving, but does give Californians another convenient option for identity verification and more control over how they share their information – offering the choice to display name and age information only when presenting for ID checks. Pilot participants still must carry their physical card, though acceptance and uses of the mDL will continue to evolve.”

Of course, Californians traveling to other areas of the planet where digital wallets are not employed, you’d also still want to carry a physical ID.

I genuinely believe this is a tech step in the right direction.

So what’s the problem?

It’s a step we’re not ready to take yet.

We do this thing with lifestyle tech, where we’re really good at coming up with a solution, and really bad at protecting that solution from the obvious abuses many folks might predict.

Putting your driver’s license in a phone is the natural evolution of digital wallets. We’ve been working towards this since we started processing payments from our phones. The act of putting that ID in your phone is still fraught with corporate and consumer concerns.

I’m concerned that I cant show you screenshots of that setup process. I’m concerned that I cant easily copy the text from the ridiculously long terms of service that we have to agree to. The user is expected to read through pages of agreement, with no easy way to copy or read that agreement on another display.

There’s an expectation that a digital ID can be used in place of a physical ID.

The first areas mentioned are things like TSA checkpoints, but signing up for the service, the user acknowledges that this digital card is a “valid document with the same restrictions as your ID or License”.

Where regulators like the FTC are working towards simplifying user agreements, the current process for Google Wallet is difficult to chew through.

Using these cards presents another issue however.

Increasingly, folks live their lives out of phones. All of our most important personal and professional information passes through our phones now. Our legal system is still undecided on where exactly to draw the line on unreasonable search and seizure.

Google is quick to trot reassuring words like “encrypted”. That’s good. All the data on your phone should be protected from bad actors and malware. We should be concerned about data security in a hacker sense, but the more likely threats will be far more mundane.

If folks are to trust they can leave the house without a physical wallet, what happens when you need to hand over a digital document to a police officer?

As far as I can determine, there is no “Cop Mode” for Google Wallet.

Google Wallet instructs on the initial setup that you should never have to hand over a phone. The process starts with scanning a QR code or using Bluetooth.

However, it’s not too difficult to imagine scenarios where a phone might need to leave someone’s possession.

It’s not difficult to imagine scenarios where a routine stop, or a subject under arrest, might need to comply with officers. There could be situations where a receiving computer just “doesn’t work” or doesn’t accept the Google Wallet handshake. There might be legitimate technical difficulties, or bogus situations from unscrupulous officers.

“The QR code didn’t work. We need you to unlock your phone to verify your information.”

If you hand over your phone unlocked, you’re technically waiving your rights to protecting any other data on your device. Are you consenting to a search? Can an officer swipe up and snoop through other content on your device?

Digital privacy is already a dicey legal topic. We appreciate the convenience of biometric security, which abbreviates the process of unlocking our devices.

Your biometric data isn’t always LEGALLY protected though. If you use fingerprint security, then everything you touch leaves a trace of your phone’s password. If you use face unlock, courts are still arguing whether that’s protected data.

A police officer can not compel you to give up a PIN or a Password, you have the right to remain silent. Should an officer be able to hold your phone up to your face to view the contents of your phone without your permission?

The era of Digital Wallets might be abused to circumvent those current biometric debates. Where an officer might request an ID, now someone might be compelled to hand over a phone in an open and ready state.

The obvious answer is:

“Well, these tech companies will eventually make a protected ‘Cop Mode’ to prevent this specific abuse”.

It seems like an immediately practical solution. It could function just like “Repair Mode”, displaying the ID on the screen, but preventing ANY other interaction until a password is used on that phone again.

If it’s so obvious, why haven’t tech companies worked with state governments to employ that solution at launch? Why can’t we get ahead of the obvious ground level potential for abuse? Why are we pretending like this situation is unforeseeable, when advocacy groups are warning about these possible vectors for mis-use?

Even if we make a “Cop Mode”, will we properly educate citizens on how to use it?

But don’t worry. Your ID is totes encrypted.

It’ll probably be fine…