Digital pilot certificates

Let'sgoflying!

Touchdown! Greaser!
Joined
Feb 23, 2005
Messages
21,872
Location
west Texas
Display Name
Dave Taylor
Home Airfield
KMRF
Think much will change?
Seems like it’s
Pt91 only
Still need physical photo ID & medical
Not all authorities are going to accept it


1769599593554.png
 
Although the regs require us to present our certificates for inspection by various law enforcement and investigative agencies, reality is that no one who might ask to see it is going to care if it’s digital except perhaps in a foreign country.

Even with digital drivers licenses where there is more chance of it being requested, it’s really just a matter of time before complete domestic acceptance.
 
Think much will change?
ICAO has been working on this for quite some time plus has a number of papers and presentations on the system they are developing for international acceptance. Eventually all/most certification documents will have a digital path within the ICAO member states.
 
I carry my various physical cards, DL, auto insurance, PPL, medical, heath insurance, and a couple others, but I also have photos, front and back, of them on my phone.
 
Full text here: https://www.congress.gov/bill/119th-congress/house-bill/2247/text

I don't see a limitation to Pt 91 only.

I don't see that it gives relief to have the certificate on you when you fly; the change is only for presentation to FAA, et al when requested.

They'll need to distinguish between digital images, which is what I think they intend, and digital certificates, which are different animals in the security world.
 
They'll need to distinguish between digital images, which is what I think they intend, and digital certificates, which are different animals in the security world.
They don't necessarily have to be images, just whatever the FAA decides is a "copy" of a certificate. And there won't be any confusion unless the FAA starts issuing SSL certs under 49 USC section 44703:

"An individual issued a certificate pursuant to this section . . ."
 
I still don't really understand the purpose of needing to carry the physical copies around - especially the medical. All anyone is going to do is verify its authenticity. This can be done the exact same way with a physical copy as an electronic copy. My logbook - which tracks certain legalities - can be in the cloud, but I have to carry my paper doctor's note around in order to commit aviation?

I also hold an amateur radio license. They don't even issue those in physical form anymore. Hams are required to produce proof of licensure much the same way as aviators, as well. In that case, you point the inquiring entity to the FCC database.
 
Some people have an odd fear of digital licenses. I assume some of that is fear of forgery which I guess is kind of legit but you could check digital certs against what's in the FAA's DB just as quickly if not faster. The other seems to be some fear of privacy invasion which I don't get at all- the same info is all in an official gov database so it's not like they're getting anything they don't already have. Really it's just making what the gov already has more available to YOU. I've had this same discussion over digital driver's licenses with people- I assume it's just lack of understanding of how these things work but IDK is there something I'm missing?

The idea of walking out of the house and going places with only my phone- or even just a smart watch and having all my credentials and means of payment for goods/services is something I find pretty appealing.
 
I still don't really understand the purpose of needing to carry the physical copies around - especially the medical.
Domestically, you would need the regulatory/legal framework to change to permit the use of digital copies which is what the bill above I believe starts the process of that change. Internationally, the issue was to have a single ID validation system which is what ICAO has been working on. And since there are about 6 countries that already use digital aviation certificates for domestic operations, I think it will become more mainline once ICAO finalizes the process acceptable to all ICAO members.
 
Some people have an odd fear of digital licenses.
I think the fear is the implication that it'd require apps and such that would create records directly with the gov.

That said, I'd gladly welcome adding a QR code or something commonly scannable. A fancy hash or such that validates an image of my certs and papers. I just worry that the FAA might incur tech debt by failing to quickly reissue digital certs and such when (when, not if) a crypto standard is cracked or something gets hacked.

I've yet to see a common crypto standard remain viable for hundreds of years they initially claim it could withstand brute force attacks.
 
I will say that the app thing is already driving me bonkers. I have at least 3 apps on my phone for verifying myself to different entities, including the government. I like the idea of the QR code. That's what we were using for the 'VID stick.
 
I still don't really understand the purpose of needing to carry the physical copies around - especially the medical. All anyone is going to do is verify its authenticity.
How is a sheriff's deputy going to do that today other than tactilely? Maybe they can, but I doubt if most even know how. But they could certainly match the name to your DL and copy down the certificate number.
 
I will say that the app thing is already driving me bonkers. I have at least 3 apps on my phone for verifying myself to different entities, including the government. I like the idea of the QR code. That's what we were using for the 'VID stick.
Apple has their wallet app built into the iPhone for anything that supports it. I have all my insurance cards in it and I was actually able to add my tickets to Oshkosh to it as well. IDK if android has an equivalent but I believe it's an open standard anyone can implement- seems like the ideal solution. I don't want another account and app to manage either.
 
One concern about digitized government licenses and credentials is the potential for them all to be interconnected in a complex way, and by different people, long after they were set up independently with the consent of a population that had limited foresight into where digitization can lead.

For example you have a problem at the DMV with the Mickey Mouse vision test and you find your pilot certificate, including Sport Pilot privileges, is gone. Or an improper medical diagnosis is coded into your government or insurance industry maintained personal medical record, and your FAA Medical is gone. The onus is then on you to straighten out a problem that has occurred via automation, without human judgment being applied. Maintaining your credentials becomes an unpredictable and error prone IT game within a system set up by bureaucrats and their contractors.
 
Last edited:
How is a sheriff's deputy going to do that today other than tactilely? Maybe they can, but I doubt if most even know how. But they could certainly match the name to your DL and copy down the certificate number.
As a retired sheriff’s deputy, if I responded to a mishap and the pilot didn’t have his certificate, I wouldn’t be concerned about it. Just document the identity and leave it to the FAA to determine his status as a pilot. Hopefully there aren’t any LEOs doing ramp checks, as it’s an FAA matter.
 
Hopefully there aren’t any LEOs doing ramp checks, as it’s an FAA matter.
It actually matters what state you are in as a few have their own laws beyond the FARs which give the ability to request pilot certificates by LEOs and other specified individuals in the course of their duties.
 
As a retired sheriff’s deputy, if I responded to a mishap and the pilot didn’t have his certificate, I wouldn’t be concerned about it. Just document the identity and leave it to the FAA to determine his status as a pilot. Hopefully there aren’t any LEOs doing ramp checks, as it’s an FAA matter.
That's fine for you, but the FAA says I have to provide it if asked.
 
Last edited:
One concern about digitized government licenses and credentials is the potential for them all to be interconnected in a complex way, and by different people, long after they were set up independently with the consent of a population that had limited foresight into where digitization can lead.

For example you have a problem at the DMV with the Mickey Mouse vision test and you find your pilot certificate, including Sport Pilot privileges, is gone. Or an improper medical diagnosis is coded into your government or insurance industry maintained personal medical record, and your FAA Medical is gone. The onus is then on you to straighten out a problem that has occurred via automation, without human judgment being applied. Maintaining your credentials becomes an unpredictable and error prone IT game within a system set up by bureaucrats and their contractors.
The issue you raised comes from integrating databases, not digital credentials. The DMV and FAA could theoretically do that now, even though my driver's license and pilot certificate are both physical.
 
That's fine for you, but the FAA cuz I have to provide it if asked.
And it’s really nonsensical that we need hard copies for the FAA. It’s entirely reasonable that an FAA inspector has access in the field to their database to confirm a pilot’s certificate status. Even then, no reason why all of these IDs, licenses, and certificates shouldn’t be acceptable in digital form.
 
The idea of walking out of the house and going places with only my phone- or even just a smart watch and having all my credentials and means of payment for goods/services is something I find pretty appealing.
Me too. I move as many things into my phone Wallet as I can.
 
How is a sheriff's deputy going to do that today other than tactilely? Maybe they can, but I doubt if most even know how. But they could certainly match the name to your DL and copy down the certificate number.

Many of today’s IDs can be verified/validated as original in multiple ways, even from a photo.

Passports are already digital; we used them digitally on our trip to/from Germany last month.


Separately, TSA accepts digital IDs from 11 states as RealID compliant.

 
How is a sheriff's deputy going to do that today other than tactilely? Maybe they can, but I doubt if most even know how. But they could certainly match the name to your DL and copy down the certificate number.
We talking Barney Fife? I guess that depends on how backward that sheriff department is, particularly in a state that uses digital licenses. Most of the sheriff cars I see are equipped with technology. I don’t know (maybe I’ll ask next time I see one), but chances are if I’m stopped for a traffic infraction, they have already run my plates as part of their due diligence.
 
We talking Barney Fife? I guess that depends on how backward that sheriff department is, particularly in a state that uses digital licenses. Most of the sheriff cars I see are equipped with technology.
To verify pilot certificates? Which departments?
 
We talking Barney Fife? I guess that depends on how backward that sheriff department is, particularly in a state that uses digital licenses. Most of the sheriff cars I see are equipped with technology. I don’t know (maybe I’ll ask next time I see one), but chances are if I’m stopped for a traffic infraction, they have already run my plates as part of their due diligence.

We got stopped once, and the cop said my wife's driver's license had expired. The car was registered in her name, but how did they know who was driving? May be they guessed, or may be they can also scan the back of your head and tell who is driving. The technology exists today to not have to carry anything, not even IDs. At TSA checkpoints, they scan my driver's license, but are they really relying on the information printed on the card, or are they using the information on it to look me up on a database and verify against my face? I think physical/digital ID's will eventually disappear and only serve as a backup when there is a problem with the overall system. I don't think digital ID's on a phone is a long term solution because it still carries the risk of a single point failure.
 
Last edited:
To verify pilot certificates? Which departments?
Sorry. I thought you were talking about drivers licenses. Pilot certificates? Although they can ask and we have to comply,

1. I doubt if they would ask.
2. I doubt if they'd understand what it says or its relevance to what they were investigating (heck, pilots have trouble understanding the difference between certificates and ratings). I'm trying to picture the deputy checking for your instrument rating since it's low overcast the day you crashed in the field.
3. They wouldn't know if the plastic we presented them it was valid or not since they have no way of validating it (and probably have never seen one before anyway).
4. The reg says we have to present out pilot certificate for inspection. If the pilot certificate we have is digital, that's all that 61.3 requires us to present.
5. Aren't you worried about BasicMed since your hypothetical deputy knows to ask for and absolutely wants to see the medical certificate you don't have?
 
I don't think digital ID's on a phone is a long term solution because it still carries the risk of a single point failure.
I agree with your overall post, but I don't understand the single point of failure. Why would a digital ID not be accessible in some way other than your phone.
 
The issue you raised comes from integrating databases, not digital credentials. The DMV and FAA could theoretically do that now, even though my driver's license and pilot certificate are both physical.
But it’s much, much easier if your credentials and records are digital and e.g. on your phone, particularly when no people are involved and control can thereby be efficient, and done without checks and balances.

Once it’s easy, regulators will to do it to promote administrative efficiency and maximize power (on their side) to the limit of the law, and it won’t be theoretical any more. A screw up in one element of the system that controls your life (or is your life from the regulatory and access point of view) can then make the rest fall down like domino stones in a chaotic automated process that varies from person to person. It will then be your problem to fix.

Change promotes more change, and the follow-on impacts are not always for the better in the long term. With that in mind I think digitization in a free country needs to be managed very carefully and in some cases resisted. I don’t personally want an app on my phone called ‘Licensing, Compliance and Government Services’ that contains my interacting digital credentials and has to be maintained and updated weekly or else be barred from access to some aspect of normal life. I had enough of (exactly) that during COVID in Europe, including QR codes and expiring online certificates to be on the street, enter public buildings etc.
 
Last edited:
I think the fear is the implication that it'd require apps and such that would create records directly with the gov.

That said, I'd gladly welcome adding a QR code or something commonly scannable. A fancy hash or such that validates an image of my certs and papers. I just worry that the FAA might incur tech debt by failing to quickly reissue digital certs and such when (when, not if) a crypto standard is cracked or something gets hacked.

I've yet to see a common crypto standard remain viable for hundreds of years they initially claim it could withstand brute force attacks.
China already cracked a 24 bit RSA code using quantum computing. RSA comes in 1024, 2048 and 4096 bit codes. For non-computer people, modern computers are 64-bit systems, 64 bits in one computer word. It takes 8 bits to define a character on your keyboard. So you can think of the RSA 4096 key as 512 letters. The average number of letters in an English sentence is 14-15 words, for an average of 50 letters or so. So 512 letters means the encryption key is a sentence of 140-160 words. [updated my arithmetic]

AES 256 is the other secure method, used by the Feds. Actually, both are often used together. The AES 256 requires massive number crunching so it's many times stronger than the RSA 4196. AI aint gonna do it.

Microsoft's dropping RSA1024 and moving to RSA2048 and RSA4096 this year. When you log into a website that begins https, both RSA and AES are being used.

Stop by my CS Intro class in about 6 weeks when I go over the two algorithms. Not in detail, that requires graduate math in number theory, factoring huge prime numbers, and other ugly topics I never want to remember from my days in grad school which is why I used to write software for a living.
I do the 4th grade version.

Yes, I'm bored. Too windy to go flying the airplane or the drone.
 
Last edited:
2. I doubt if they'd understand what it says or its relevance to what they were investigating (heck, pilots have trouble understanding the difference between certificates and ratings).
I've found it depends on what state you are in as some states have rather robust "aeronautics" laws on the books and provide the training to enforce them. Unfortunately, have even seen that once the FSDO ASI concluded their work, those same individuals had to deal with the state level violations which tend to have their own penalties, etc. Can't post at the moment but can post some examples later or PM links if you like.

The reg says we have to present out pilot certificate for inspection. If the pilot certificate we have is digital, that's all that 61.3 requires us to present.
Its been my understanding the "physical possession" context noted in 61.3 and in other rules relates to the possession of a physical certificate in hand with copies or other reproductions not valid. Regardless, its also my understanding once the FAA finalizes their digital certificate process it will be addressed specifically by a new rule or a rule revision similar to the change from paper to plastic certificates. Plus the new certificates will meet the ICAO requirements for validation of digital certificates.
 
Its been my understanding the "physical possession" context noted in 61.3 and in other rules relates to the possession of a physical certificate in hand with copies or other reproductions not valid. R
The actual wording is, "Has in the person's physical possession or readily accessible in the aircraft...a pilot certificate issued under this part."

A reproduction, photocopy, etc of a certificate is not a "certificate issued under this part." At best it's a copy; at worst it a counterfeit. OTOH, if the FAA issues a digital certificate, it's "a pilot certificate issued under this part," no?
 
I've found it depends on what state you are in as some states have rather robust "aeronautics" laws on the books and provide the training to enforce them. Unfortunately, have even seen that once the FSDO ASI concluded their work, those same individuals had to deal with the state level violations which tend to have their own penalties, etc. Can't post at the moment but can post some examples later or PM links if you like.
A number of states have things like flying under the influence and reckless flying laws. And, after all, if you kill someone with an airplane, you might well be charged with a homicide offense. I used to have a signature block that listed "Aviation Regulation Fallacies and Half-Truths." One was, "The FAA is the only legal body that controls what we do in aircraft."

For a quick example, here's Virginia's

§ 5.1-13. Operation of aircraft while under influence of intoxicating liquors or drugs; reckless operation.​
Any person who shall operate any aircraft within the airspace over, above or upon the lands or waters of this Commonwealth, while under the influence of intoxicating liquor or of any narcotic or any habit-forming drugs shall be guilty of a felony and shall be confined in a state correctional facility not less than one nor more than five years, or, in the discretion of the court or jury trying the case, be confined in jail not exceeding twelve months and fined not exceeding $500, or both such fine and imprisonment.​
​
Any person who shall operate any aircraft within the airspace over, above or upon the lands or waters of this Commonwealth carelessly or heedlessly in willful or wanton disregard of the rights or safety of others, or without due caution and circumspection and in a manner so as to endanger any person or property, shall be guilty of a misdemeanor.​

But violation of either doesn't require a pilot certificate ;)
 
Some people have an odd fear of digital licenses.

I am not fond of increasing the the amount of information about myself available electronically. Anything digital I already assume has been compromised and is available to the highest bidder on the dark web. I assume the only reason my identity hasn't been stolen and used against me is just sheer volume and odds, I am one of 8 billion people on this planet.

I had a coworker, older guy, that was proud of the fact that he had almost zero digital presence. His phone was an old flip phone, no social media, didn't even use email. 5 minutes with me and an internet browser changed his outlook on life. Nothing is private or safe anymore.
 
I am not fond of increasing the the amount of information about myself available electronically. Anything digital I already assume has been compromised and is available to the highest bidder on the dark web. I assume the only reason my identity hasn't been stolen and used against me is just sheer volume and odds, I am one of 8 billion people on this planet.

I had a coworker, older guy, that was proud of the fact that he had almost zero digital presence. His phone was an old flip phone, no social media, didn't even use email. 5 minutes with me and an internet browser changed his outlook on life. Nothing is private or safe anymore.
I still don't get it. Our pilot certificates and associated info are already in a publicly searchable database. What additional information is getting out by letting me have an electronic copy of that same publicly searchable certificate on my phone?
 
I still don't get it. Our pilot certificates and associated info are already in a publicly searchable database. What additional information is getting out by letting me have an electronic copy of that same publicly searchable certificate on my phone?

Maybe my post wasn't entirely clear, I wasn't talking about the pilot certificates specifically but about digital ID and digital information as a whole. So much of it is out there, often put out there by government entities and other third parties. You can't even begin to control the information that is available.
 
Maybe my post wasn't entirely clear, I wasn't talking about the pilot certificates specifically but about digital ID and digital information as a whole. So much of it is out there, often put out there by government entities and other third parties. You can't even begin to control the information that is available.
I guess I'm still not sure what additional information having a digital copy of say my driver's license or insurance cards makes available. Seems to me they already have all that anyway and this is just letting me use it. I mean the police already have technology that scans license plates automatically and they can bring up the owner and their driving record/any warrants from just that. They already have your info without digital ID, what I'm not seeing is how the digital ID gives them anything new/puts anything else out there.

And just to be clear I don't love our information being out there either- just saying I don't think this makes that situation any different.
 
AES 256 is the other secure method, used by the Feds. Actually, both are often used together. The AES 256 requires massive number crunching so it's many times stronger than the RSA 4196. AI aint gonna do it.
I was actually thinking more mundane but impactful tech debt. Stuff like HeartBleed leaking arbitrary data, and over looked configuration allowing SQL injections, or various exploits that will occur from time to time. Stuff that massive companies spend many thousands of man-hours securing against.

I guess, I just don't know if I trust the FAA to promptly patch or revoke certs and so forth quickly. Keep in mind, through the early 00s our pilot certs were paper. Something I could have recreated with a consumer grade printer and a few hours.
 
But it’s much, much easier if your credentials and records are digital and e.g. on your phone, particularly when no people are involved and control can thereby be efficient, and done without checks and balances.
The records are already digital. The databases could be combined today if desired. Putting the data on my phone doesn't make it easier for some third party to combine the info, since the backend is already not accessible than my phone.
 
The actual wording is, "Has in the person's physical possession or readily accessible in the aircraft...a pilot certificate issued under this part."
I took your #4 comment to be in the same context as the three prior ones that a local LEO would not know a digital version was invalid. Regardless, the rest of that comment stands.

A number of states have things like flying under the influence and reckless flying laws.
Except these are the types of rules I was referring to. No flying required.

1769732267781.png

1769732352875.png
 
Back
Top