Digital Travel Credentials (DTC) – the story so far
While domestic and international restrictions imposed to combat the spread of the COVID-19 virus have a tremendous impact on cross-border passenger volumes, and the longer-term picture remains unclear, it is no less important to continue to leverage the latest technologies to both strengthen borders and improve traveller experiences.
Over recent years, the technology has radically evolved in fields such as identity, security, biometrics and mobile applications to do exactly this. Technology has already transformed the world of border security and efficient processing of passengers, for example through secure ePassports (also known as electronic Machine Readable Travel Documents or eMRTD), automated eGates, biometrics used to assure visa regimes, and mobile boarding passes.
However, the story is far from complete. A newer generation of secure and efficient solutions are just beginning with the development of the Digital Travel Credential (DTC).
DTC is an entirely new concept, but builds further on the existing standards and comprises two parts:
• a physical component with cryptographic and communications capabilities such as an ePassport, mobile phone or smart watch. This will be carried by the traveller as a proof of possession to identify the passenger, but also points to…
• a corresponding virtual component. In other words, data that is held remotely that can be accessed securely by a designated authority.
Standards, technology and practice are being developed to make DTC a reality – with the first DTC standard expected to be released by the International Civil Aviation Organisation (ICAO) during 2020. This is expected to combine the existing eMRTD as specified in ICAO Doc 9303, as the Physical Component; and a new Virtual Component defined in a new DTC standard.
It is anticipated that the DTC will perhaps take a little longer to implement in full, as the industry, regulators and governments recover from the coronavirus crisis.
However, there is little doubt DTC will be at the centre of a new generation of border management systems that increase security while speeding the passenger journey through airports and across borders.
1. Driving a new era of seamless travel
In much the same way as today’s ePassports enable passengers to use automated border crossing (ABC) gates and bypass manual passport control, Digital Travel Credentials (DTC) are expected to play a similar role – just processing people faster, more efficiently and possibly in a more dynamic manner.
These will, in time, be combined with other technologies to enable passengers to arrive at the airport and make their way through check-in, bag drop, immigration, security and boarding without ever having to take their travel document out of their pocket – with the DTC wirelessly communicating with the various kiosks and gates along the way. The ePassport (chip-MRZ-VIZ) and the paper passport (MRZ-VIZ), however, will not disappear completely, as many countries, airports and travellers are still in the process of acquiring the respective technologies. Hence, a range of options will continue to be offered.
In the shorter-term, a low-risk traveller on certain routes will be able to instantly apply for (and receive) an entry visa, using their DTC to provide advanced passenger information, and then embark on their airport journey, all without having to show a physical travel document.
This vision of an automated, self-service and frictionless journey through the airport will not only offer a much-improved experience for travellers, and a major opportunity to speed up passenger processing at busy international transport hubs or borders, it will help ensure airlines and other travel providers meet their regulatory obligations.
This is not a new concept, of course. Digitalization has been a key driver in the travel industry for decades. Paperless boarding is now well established in many airports around the world. Similarly, new advanced technologies that leverage trusted national identities are used to complement today’s physical passports.
However, the DTC represents the next wave of digital innovation and will effectively balance a fast and convenient experience with ongoing security demands and the importance of assuring individual data privacy.
2. The need for change
There are two key issues at play that are driving the need for change – the rising tide of international (and domestic) air travel, and the particular pressures exerted by changing consumer tastes and behaviour.
From a volume perspective, projections of sustained growth are well-evidenced from long-term trends. The International Air Transport Association (IATA), for example, expects significant capacity pressures from emerging markets over the next two decades. Trips per person are set to rise by 4-8% per year in Russia, Brazil and Mexico, while there will be double-digit growth in China and India .
Of course, the severe travel restrictions as a result of the global coronavirus pandemic resulted in a sharp drop in passenger demand. Only time will tell what effect this will have in the medium and longer term as the industry recovers from this exceptional situation.
Should the upward trajectory of passenger numbers continue post-crisis, this will place even greater pressure on already stretched airport passenger processing and security operations. Certainly, action will be required to streamline and speed one of the biggest pinch-points – the verification and authentication of travellers at exit and entry. Indeed, the likely deployment of health scanning measures here will need careful planning to avoid adding to the bottleneck.
Whatever the numbers, there remains a strong case for identity technology to continue to support, speed and secure border management in the future.
Turning to the experience issues, seamless travel has to be more than a question of managing volume. Passenger needs are changing, they are becoming ever-more demanding and the ability for airports and airlines to offer the ‘right’ experience matters more than ever.
Euromonitor International’s work on consumer trends is interesting here, and paints a complex and often contradictory picture of the individual.
When it comes to travel, consumers want frictionless mobility: they want choice, flexibility and the freedom to travel wherever and whenever they choose. Travellers also expect brands and service providers to offer personalized experiences.
But here’s the contradiction – citizens are also increasingly concerned by who has access to their data and how it is used. This concept of private personalisation is as relevant in the design and deployment of passenger processing and border security systems as it is in the way consumers engage with everyday brands.
These are all important considerations in the move to DTCs. Not only to ensure the acceptance and adoption of new solutions, but because, at the most fundamental level, the development of DTCs is as much about serving the citizen traveller as it is about providing secure controls at air (land and sea) borders.
3. A deeper dive – understanding DTCs
A replacement for the passport?
Working with the International Standard Organization (ISO), ICAO’s New Technologies Working Group (NTWG) is tasked with standardizing the DTC – first to add a digital companion to the ePassport, and then evolving to provide a substitute as passenger authentication and verification migrates to the mobile device.
Whether it will completely replace the eMRTD as a wider proof of identity is a point of debate since travel documents not only support the journey, they also act as proof of identity in foreign countries. However, as the situation develops, the DTC will provide a digital representation of the traveller’s identity, which in turn can be validated using the Travel Document Issuing Authority’s public key infrastructure.
As a means to catalyse and accelerate the development of the DTC, the NTWG simultaneously hosts two working groups – policy and technology, so that these two aspects remain in sync.
Built on the passport, owned by government
While the DTC will offer an effective virtual substitute, ICAO is very clear that the ePassport is to be held as the benchmark for development – with the DTC reflecting the secure, portable and verifiable attributes of its physical cousin. Crucially, the ICAO framework is particularly clear on the principle of ownership. The DTC will be owned by the Travel Document Issuing Authority, and the derived data is held by, and remains, the responsibility of sovereign governments.
Identifying DTC formats
There are three formats of DTC, based on a hybrid model. Each consists of the Virtual Component (DTC-VC), which is essentially a data file, and a physical component (DTC-PC), i.e. something you have, like an eMRTD or a smart device. The DTC-VC and DTC-PC are cryptographically linked, with all respective public keys contained in the DTC-VC. Here are the three formats:
eMRTD-bound
In this format the virtual component is ‘bound’ to the ePassport (i.e., it holds a partial copy of the biographic and facial biometric data held in the ePassport). This allows the traveller to be identified from the DTC-VC alone – although they have to carry their passport so they can present them if identification is not successful and they are required to prove possession.
eMRTD-PC-bound
In this format the virtual component (holding the identity data described above) sits on the physical component – the smartphone or wearable. Travellers use these devices if required to prove possession so they won’t have to carry their passports. While the VC can be stored on the physical component, this is not mandatory. The VC can also be used on its own to prove identity by being made available to travel stakeholders (airline, airport, border, etc.) ahead of travel.
PC-bound
Here the virtual component sits on the smart device and may have its own document characteristics – for example, passport number, validity period, digital signature, etc. It can be used by travellers without needing the ePassport, and citizens with this DTC can then freely share their virtual component with whomever they wish, to prove their identity.
4. Challenging issues
The development and adoption of DTCs will have significant impact across the travel ecosystem. We’ll see enhancements in identity validation and data quality, reductions in congestion at border control through pre-arrival screening and the ability to remove document and/or boarding pass presentation.
The traveller’s experience will significantly improve, while the increasing automation enabled by the DTC will allow airport, airline and border officer resources to be re-directed into areas of greater need.
And we could go further. Just as passports are universally used to prove the identity of the individual in a host of everyday contexts, such as opening a bank account or proving age, so the DTC could be used to do the same throughout the travel lifecycle: from remote flight check-in, through security and on-airport retail experiences to authenticating identity for car rental and hotel check-in at the destination.
As with so much else in today’s fast-evolving world, both regulation and wider perceptions of ‘trust’ from travellers are yet to catch up with what technology makes possible.
We can see clear parallels between this idea of paperless, frictionless travel and frictionless payment offered by contactless capabilities on today’s generation of smart payment cards.
When the ‘tap-and-go’ payment technology was first introduced in 2003 by Mastercard, adoption was understandably low. Considerable investments in banking and point of sale infrastructures, and in education campaigns, were all necessary to address security fears and to normalize use. More than 15 years on, hundreds of millions of people use contactless as a natural and convenient way to pay.
There is also another interesting point of comparison with payment innovations – mobile wallets. Apple, Google, Samsung and others all enable wireless payments from smartphones. Like the virtual component of the DTC, these digital services are also linked to a physical token (in this case, the bank card). Consumers can pay with either – with the card typically backing up the mobile payment should it fail at the point of sale.
The key point here is that while millions use their ‘virtual’ wallets to pay, billions use their ‘physical’ cards to do so. There are a number of reasons why – familiarity, security concerns, availability of wallet payment infrastructures and so on. But with some 3.5 billion smartphone users across the world , more people could be using their digital options but are choosing not to. This continuing preference for the physical (principally illustrated by the eMRTD in the identity world) should be an important consideration in the evolution and adoption plans for DTC.
Today, we are in a new world. Consumers want frictionless experiences, more personalization, more control over their identities, and many retain a preference for the physical. They want their solutions to add value, to be ‘better’ than those they use today – and they want the freedom to choose. We already see the enthusiastic adoption of self-check-in and app-based paperless travel through airports – particularly for regular passengers. DTC can extend this notion of seamless travel and offer choice.
But, just as with payment options, security, standardization, policy adoption and amendments to the legal framework will be critical for accelerating adoption across the travel ecosystem. This is no simple task, of course, and there remains a good deal still to work out. For example, which organizations can ask for the virtual component in advance, whether they can retain it after the passenger enters (or leaves) the country, and how it will be appropriately secured. Standards alone will not address the raft of technical, business process and interoperability requirements. These are all issues that demand a cross-industry approach.
5. Secure Identity Alliance’s Perspective
The development of DTCs certainly represents a fundamental shift in how citizens will choose to share their identities to authenticate travel. It will enable a freer and faster movement of people, and offer opportunities for airports, airlines and governments to come together, deliver new experiences for citizens and boost security. But it offers challenges too. And we have touched on these in this paper.
The vision of a secure and uninterrupted flow of passengers is certainly compelling, the solutions needed to deliver it are here, and there’s certainly evidence of significant collective will to drive implementation.
The first step are the standards and the technology specifications. Of course, developing a credential that will be embraced by governments, industry and citizens, and accepted throughout the world, is an inherently complex undertaking that takes time. But, with work continuing at pace, it won’t be long before vision becomes reality. With the recent coronavirus experience, travel documents might need to incorporate health certificates and this must be kept in mind in the development of the DTC.
Crucially, the globally accepted eMRTD is a key part of solving this puzzle. It’s the travel credential we all leverage today, and its importance and use will (and must) continue within the context of any digital future.
With legal, trusted identity the cornerstone of not only rights protection and social inclusion but global economic development, the evolution of new and more frictionless approaches to travel are to be warmly welcomed. Indeed, Secure Identity Alliance workgroups – most notably our Border program – are partnering with governments, NGOs and private sector players to help drive best practices for the establishment and evolution of integrated border strategies.
Similarly, Secure Identity Alliance members are already actively engaged with both ICAO and ISO in helping to support and drive the development of DTC. Just as they are in the development of the One Identity program, the Known Traveller Digital Identity (KTDI) initiative and countless others across the globe. All to make tomorrow’s identity-based seamless travel initiatives a success.
