Since the rollout of digital driver's licences was announced, some have been apprehensive about how much access the Government and corporations will have to their data. But should Kiwis be worried?
Motorists will be able to access their licence on their phones by the end of the year, if everything goes as planned.
The Government is currently considering public feedback on the scheme, and the technology is being tested overseas.
1News spoke to Christopher Goh, an Australian-based digital identity consultant, who has worked with the Department of Internal Affairs on the project. He was also part of the technology's rollout in Queensland.
He said the technology is doing well in testing, and could be "leading" when it finally arrives.
Read More: How will digital driver's licences work?
What stops the Government from tracking my data?
Goh explained that several factors prevented bodies like the Government and corporations from tracking people with digital licences. First was the law itself.
Digital licences must meet the Privacy Act's requirements, while the NZ Verify app – one of the places digital licences will be stored – is held to the standards of the Digital Identity Services Trust Framework, which does not allow the tracking of credential holders.
"Even if the technology were to do that, you would be in breach of your legislation and regulation."
Digital licences will be entirely optional, meaning people can continue using their card as usual.
The technology also prevents tracking.
Goh explained that the system uses what's called "device retrieval", where information is held within the phone and encrypted – similar to credit cards.
This differs from how other types of data are stored. Many other apps and services pull information from a central server and deliver it to a device.
Here, data will be stored directly in "protected memory" on a specific device, not on a centralised server. This essentially means data stays locked inside your phone, and using digital ID will be an entirely offline process.
"There's no back-and-forth between the wallet when you directly interact with a verifier or relying party," Goh said.
The relying party – like police officers, bartenders, and retailers – will only be able to access the data required and won't be able to see its history.
"So there is no tracking that's available from the wallet, and it's again stored to the point that even the wallet can't scrape the data.
"If you try to mirror it on a screen, it just shows up blank. Even if it's implemented well, you can't snapshot it because the phone will deny you the ability to take a screenshot."
The licences will also utilise biometric and device binding to stop cloning.
Are they safe from hackers?
As technology evolves, cybersecurity has increasingly become front of mind for many in New Zealand.
Goh described the cryptography used in the system as "military-grade", and said it was endorsed by NATO, the European Commission, and US Homeland Security.
"The cryptography is actually much stronger than your credit card in some ways as well," he said.
"They wouldn't adopt this unless it's gone through a whole bunch of security testing, and particularly around the standards. So it is pretty strong."
Because the data is stored on a specific device, those looking to break in would have a hard time.
"A person has to make a lot of effort to crack one phone, and cracking one phone and getting that data doesn't mean you can get the rest of them.
"This minimises what we call the surface attack area for bad actors."
Building trust critical
Building public trust in the system will be the biggest challenge, Goh said.
"There's obviously fear of government and what they can do with the data," he said.
"Especially with AI and everything else, people fear that they'll leave a digital footprint that can cause problems."
He explained that education is the best way to keep people aware of how the new technology works.
"What we've done previously is we go directly to those communities that have issues and directly make them advocates.
"In Queensland, we did a prize where kids did videos and promoted what they understood, and the winner of that was training their grandmother on how to use the app."
The change in habits is something Kiwis will have to get used to.
"I think the hard part for this whole thing is people being used to having physical credentials and flashing that stuff. And in this one, we're actually looking for that verification. That takes a while to train individuals on how to make sure the verification infrastructure works.
"So it is a training component. It's customer awareness to show them how it can be done, and also just in relation to good practice around the biometric matching and making sure that their phone is protected."
SHARE ME