Identity Crisis: how many solutions are too many?

By Victoria Draudins

Monday February 19, 2018

Global business, big data

The Commonwealth may have clamped down on its agencies competing for digital identity dominance, but Australia’s state governments are playing a different game. Global trends might soon make all these efforts moot.

In United Nations project ID2020, Microsoft is partnering with Accenture to create identities for over some of the world’s poorest people without a documented identity. The system will use Blockchain to connect existing records and manage fingerprint, iris and other biometric data. The underlying system is currently being used by the United Nations to enrol 1.3 million refugees and is expected to support 7 million refugees by 2020.

Australia certainly has its own issues with digital identity, after all, our government has been thrown into crisis by a small number of our parliamentarians who can’t properly prove where they come from. But despite a great deal of work and money being thrown by government and industry to deliver identity solutions over the years, our digital identity landscape still seems confused and increasingly cluttered. There is also the risk that like Queensland’s smart driver licence, the landscape may have moved on by the time we rollout a solution.

And unlike the very real problems being solved by the UN’s ID2020, as Queensland Privacy Commissioner Philip Green has told The Mandarin, in some ways government efforts are “a solution in search of a problem”.

Where we come from

As is often the case, fast-paced technology changes are driving new developments in digital identity. The rise in biometrics is due to a few dominant factors; scanners have become so accurate and affordable and the technology is more palatable to people than it used to be. Such a trend will only continue as more products incorporate scanning technology hit the market, like Microsoft Windows Hello facial recognition login launched back in 2016 and more recently Apple’s new iPhone X.

Facial recognition technology is also being rolled out in Australia’s airports over the next two years. This means we are reaching a ‘contactless’ stage where passengers can self-process without having to scan their passports.

The developments prove exciting opportunities for the various government agencies and private enterprises trying to get a slice of the digital identity space. But this is quickly becoming a crowded market.

Australia has a divisive history with its identity

As government increasingly moved online, it necessitated better online identification.

While some countries have stepped in and created a single government-issued digital identity such as New Zealand, Australians have a complex relationship with official identities.

When examining identity-related systems like the Australia Card and myHealth Records, the government has struggled to win over the public and (wisely) gave up on trying to implement a single identifier. But as a natural consequence, the lack of a uniform identity means that we now have a plethora of government identity accounts spanning federal, state and probably some local governments. The challenge now is to make sure that these different systems can work together well in future, and that governments resist creating expensive bespoke systems that merely replicate what’s already out there.

Back in 2014, the Financial System Inquiry handed down a damning evaluation of Australia’s identity system, calling it “fragmented, consisting of a largely uncoordinated network of identity credentials”. It also stated that, “The system has developed organically, driven by different standards, policies and legislative requirements. Australia has no clear strategic vision for digital identity management and, consequently, little coordination and limited ability to attain potential network benefits that would lower costs and reduce duplicative processes.”

Multiple government initiatives are on foot

The since-formed Digital Transformation Agency has made great strides since the inquiry, though not without controversy. The Trusted Digital Identity Framework, currently open for consultation, will govern the rules and standards for the government’s digital identity program, Govpass. And while the decentralised model means that a number of private providers and state governments may link up to Govpass, it has been reported that DHS will be the only accredited federal agency.

Relatedly, the federal government is trying to link up identification artifacts like drivers’ licenses and passports into a hub. Although there are ongoing battles as to whether the federal government will be given access to state driving licence photos to conduct 1:1 matching. There’s a ways to go as this would necessitate legislative changes given the sensitive nature of the photos. But once this is sorted out, whichever parties, private or public, that gain access will gain great advantage over others.

Govpass aims to provide identity management when accessing government services. But as Commissioner Green states, Govpass “hasn’t been given the official keys to the biometrics database” and while it seems to claim it will be the trusted provider, it has no track record of earning that trust.

State governments are also getting in on the game to various degrees. NSW made the decision to build its own state-based identity system through MyServiceNSW to access the State’s services online. South Australia is in the early stages of something similar. Their app, mySA GOV, offers online access to driving-related services with plans to add more services in time. The system’s identity varication capabilities is boosted by allowing digital licences to be tied to the account. State Premier Jay Weatherill enthusiastically spruiked it at launch, stating: “This app takes us one step closer to creating a single sign-on account for all government services and is an important step in our digital transformation journey.”

Not all states are charging ahead. Victoria is a little more muddled but has chosen, to a limited extent, to plug into myGov. One service, the Victorian Housing Register Application, is accessible on the myGov portal. However, a range of other services from VicRoads, Victoria Police, WorkSafe and Department of Justice have their own portals and logins, with no foreseeable plans to consolidate them.

So while government is often heard propounding the benefits of seamless and as UI-focused experiences, the numerous systems suggests the opposite may occur. And even if government does design a simple system that can link up services fluidly, numerous government IT failures of past times indicates how difficult this is to achieve. It’s also important to note that multiple systems can create new points of weakness from a security perspective.

Not just a public affair

It’s not just government that have tried and failed in the identity space. In 2006, a number of banks tried and failed to establish the Trust Centre, in an effort to establish a model that has worked very successfully in a number of European countries like Denmark. Probably burned from past experience, the major banks don’t seem to be interested in renewing past attempts to verify online identities. Although MyGov has suggested they could become future verifiers of customers’ identities.

Notably, Australia Post has recently expanded aggressively into both identity verification and management through the launch of Digital iD,which aims to both verify and manage identities, as the enterprise searches for new revenue streams as the mail business moves towards extinction.

ID2020, mentioned above, puts Microsoft in a strong position should it wish to expand more aggressively into other forms of managing identity verification.

More informally, online accounts like Facebook, Linkedin and even Gmail already provide lower forms of identity verification, and already sell users’ data for marketing purposes. It’s not difficult to imagine how easily they could set up more formal identity account management. No doubt they’d be able to deliver great user experiences, but an important question to consider is how much we would want our identity management to be in the control of some of these companies.

Only time will tell how all of these complimentary and competing identity verification and identity management solutions will work together, which will become dominant and which will be passed over. But while we are swiftly moving to a point where we won’t need any artefact other than our face to prove who we are, at least for now we still have to go through a number of pain-points of proving our identities through multiple accounts. We’ll have to end up registering for multiple accounts to say … access tax services, renew our driver’s licence and pay our council rates.

About the author
Inline Feedbacks
View all comments

The essential resource for effective
public sector professionals