Mobile ID World

Identification Revolution

TSA Seeks mDL Exemption to REAL ID Rule

August 30, 2023

The Transportation Security Administration is seeking public comment on a “Notice of Proposed Rulemaking” that would allow the continued use of mobile driver’s licenses even after the Real ID requirement takes effect in May of 2025.

Nok Nok Labs has launched the latest version of its flagship S3 Authentication Suite, delivering four new capabilities for the platform. One of the new features is designed to help organizations adapt to the emergence of passkeys, an authentication innovation that essentially turns an end user's smartphone into a passcode vault for their various online accounts, and locks it behind their device's biometric sensors. The S3 Suite now enables organizations to configure authentication rules to detect when new devices are being used for passkey authentication and verify that the end user is the legitimate account holder. The platform also now enables organizations running e-commerce sites to let their customers easily sign in with a passkey, helping to reduce friction and prevent cart abandonment. Also of interest to online retailers will be a new payment verification mechanism that lets the customer confirm a transaction with their device's biometric systems. Support for this W3C Secure Payment Confirmation (SPC) has been added to the EMVCo 3D Secure specification, which is widely used for online card-based payments. Finally, the upgraded S3 Suite also features a system to let organizations track the physical security keys they have issued to their employees, enabling them to ensure that a given user is trying to log in with the key they were provided and not a third-party device. Nok Nok is positioning this capability as one that will be of particular interest to organizations in highly regulated industries such as healthcare and insurance. "We co-founded the FIDO Alliance to make it easier to implement strong, passwordless authentication solutions for consumers and enterprises," said Nok Nok CEO Phil Dunkelberger. "Now, we are expanding our offering to companies in key regulated sectors that need to be able to quickly and efficiently respond to the evolving regulations coming from the US and foreign governments." Beyond the commercial sector, Nok Nok has also indicated a growing interest in bringing its authentication and identity security solutions to the public sector. Toward the end of last year, the company established a strategic partnership with UberEther, a provider of identity and access management tools to the federal government, explaining at the time that it would deliver "innovative cybersecurity capabilities" to UberEther's AIM Advantage platform.

REAL ID is a federal ID standard that will be required from US travelers seeking to board domestic flights or access certain federal facilities. But with the TSA now experimenting with accepting mDLs such as Apple’s digital ID, the organization wants to make sure that such innovation isn’t stifled when REAL ID takes effect.

“TSA fully supports the integration of digital identity technology, including mobile driver’s licenses, as part of our transportation security framework,” explained TSA Administrator David Pekoske. “This incremental approach balances security and passenger experience, encourages digital identity innovation and investment and ensures that we honor the intent of the REAL ID Act.”

The mDLs approved for use in pilots by the TSA are compliant with the new CAT-2 terminals that the agency has been deployed at airports across the country. The terminals are equipped with face-scanning technology designed to match travelers to their physical IDs, but also feature the ability to read mobile IDs on travelers’ smartphones.

Biometric identity verification still comes into play in these transactions. Apple’s mDL, for example, involves an elaborate registration process asking the end user to undergo a selfie video involving certain head movements to verify liveness, with facial recognition matching the user to their physical ID. Once that process is complete, the user can then access their mDL with a biometric scan on their iPhone, and share its data with the TSA’s readers.

In its request for comment, the TSA noted that is has approved multiple mDLs for testing purposes: Apple mDLs issued in Arizona, Colorado, Georgia, and Maryland; GET Group’s mDL in Utah; Google’s mDL in Maryland, IDEMIA’s mDL in Iowa, and a Spruce-made solution that is now being piloted in California.

The TSA will accept comments until October 16, 2023.

Source: Transportation Security Administration

–

August 30, 2023 – by Alex Perala

Related News & Articles