One of the big-ticket items for the federal government this year is the introduction of a digital identity scheme.
Late last year, two bills were introduced to Parliament and a snap inquiry launched that will pave the way for a system that is meant to make it easier for people to prove who they are online.
The idea of introducing a digital identity system evokes painful memories of previous failed schemes like the Australia Card and the predictable feverish response from the loud, conspiracy-minded parts of the community. But a proposal for a digital ID system is likely to be viewed in a different way by Australians in 2024.
A constant hum of data breach notifications from companies like Optus, Latitude and Medibank in 2024 has turned the issue of privacy and security into a mainstream issue for Australians, even if many have become fatalistic about protecting their identity in the digital age. Many of us are already using various digital identity schemes, even if we don’t realise it.
Since most Australians are increasingly having to hand over personal identifying information, particularly online, the calculus about whether to accept such a scheme by the government has changed.
The public debate has now moved from whether the introduction of an Australian digital identity system is worthwhile to the nitty-gritty of whether this federal government’s digital ID scheme is worth the risks.
What is the Digital ID system?
One of the core problems that institutions have is, how do they prove that people are who they say they are? Whether it’s applying for Centrelink online, applying for a bank loan or getting into a bar, everyday Australians frequently have to prove their identity.
At the moment, there’s a patchwork of commonly used identification systems. These range from government-run systems like driver’s licences and MyGovID to commercially run systems like credit cards, or even logging into third-party apps and websites with your Google account.
The federal government wants to replace some of these by creating a digital identity system that would make it easier for governments and third-party organisations to prove people’s identities while also protecting people against the harms that come from this process like identity theft and fraud.
The key to this concept is that government bodies and companies don’t actually need to know if you are a registered driver or if you have a bank account to access their services. All they want to know is that you are the person you say you are, and having a driver’s licence or a bank statement is a proxy — essentially showing that a Department of Transport or bank is vouching for your identity.
A digital identity system replaces these by creating a scheme that allows the government to “vouch” for you to whoever needs it. So, instead of every institution having to ask for various documents (like the dreaded 100 points of identification documents), they could instead just use this system. In layman’s terms: you provide information to the scheme to prove you are who you say you are and, once accepted, proving your identity to the myriad other services could be as easy as logging into your email.
The federal government’s current digital ID scheme would create a legislated, voluntary system that would be accessible to both public and private sectors. Additionally, a regulator would be created to police the scheme. The federal government has priced the scheme at nearly $800 million, and the project, first put forward by the previous Coalition government, has been in the works for years.
This is an expansion of an existing scheme, MyGovID, which already millions of Australians have used to access government services. The problem with MyGovID is that it isn’t legislated, doesn’t allow cross-government verification (so the federal government can’t use the state’s driver’s licence database to use facial recognition technology to confirm someone’s identity against their photograph); and the private sector can’t use it to verify people against government documents. It’s a limited but useful proof-of-concept.
What are the benefits of the Digital ID scheme?
The Minister for the Public Service, Senator Katy Gallagher, has promoted the scheme as being “secure, convenient, voluntary, and inclusive”.
The idea is that it should reduce a lot of the friction when it comes to proving your identity online. What if instead of scanning your passport and electricity bill so you can sign up for a phone plan, you could just tap in your username and password? This would make life easier for average people, as well as the bodies and companies who have to handle and check these documents. Some put the figure of economic benefits as high as 3% of GDP.
It’s also supposed to reduce some of the risks associated with proving your identity online at the moment. What if instead of giving personal identification to every real estate agent who represents places you’re applying to rent, you just gave it to the government once and had them vouch on your behalf? By reducing the amount of people who have this important information, you reduce the risk that one of them will mishandle or misuse it.
A great example is getting into a bar: at the moment, most people would hand over their driver’s licence which, on top of information about your age and your face, also tells the bouncer your address completely unnecessarily. Digital identification systems like the federal government’s digital ID scheme restrict redundant information.
What are the risks of the Digital ID scheme?
Naturally, there is opposition to the idea of such a scheme. To dispense with one of the loudest and most predictable arguments against it, there is a broad anti-government and, quite often, conspiratorial belief that such any digital identity system will increase or facilitate further surveillance. (Like The Spectator Australia’s reaction which lazily invokes 1984, the Great Reset and other conspiracy theory boogeymen).
Such a critique overblows the significance of this system while underestimating or ignoring the real, creeping issue of surveillance that’s happening. To put it bluntly: we’re already being tracked by governments and companies in many different ways. Other governments around the world already have these schemes and they haven’t turned into technocrat-run dictatorships. The question is whether this government’s scheme’s benefits are worth the potential risks to people.
There are, however, real good-faith concerns about how the federal government will allow this information to be used. University of the Sunshine Coast’s Erica Mealy wrote in The Conversation about how the system would be a “honey pot” — tech slang for an attractive target — to hackers who know that it contains a wealth of valuable data. She also noted that governments are subject to data breaches, whether by accident or from a malicious actor, like others.
Then there’s the consideration of whether the system will be used as intended. Questions about who has access to the data and which parts will continue to be fought over. As The Mandarin’s Julian Bajkowski writes: “It was still a little ambiguous as to what the extent of authorised access from other parts of government may be, with the threshold being legal proceedings underway, the intent being law enforcement, usually criminal, proceedings; but the old chestnut questions of local council inspectors digging around had yet again slipped through.”
The devil is in the details here. Australians shouldn’t and won’t accept a system that they believe could make their information less safe or their lives harder. But the question of whether there’s public acceptance for this scheme is still unsettled. As Gallagher noted in September, most Australians still have no idea that this is even happening.
Hmmm.
As secure as that!? What could possibly go wrong?
Yes, handing over a driver’s licence reveals your address, for no good reason. But why should using a government ID instead be any less revealing? What exactly would it reveal?
Just so. The proposed government scheme would replace all that with one central universal scheme. The great thing about having many schemes is that while some of them get hacked or otherwise compromised, the others are unaffected. This diversity gives resiliance. It is very bad news for Telstra customers when Telstra’s data is stolen, but not so much for anyone else. Replace all that with a single government scheme and we create the exciting possibility that in one attack everybody‘s ID data will be hacked and simultaneously everybody will be unable to prove their identity. Or do we believe the government is so expert and competent that it will build a system that is and will remain invulnerable to malicious actions?
Related to this is we really need to understand the motivations of the hackers.
Some are just criminals, but a lot of it is being backed by Russia and China who are using hacks to spread chaos and destabilise democracies.
The reason they want to destabilise democracies is because they want to show that democracies don’t work and lead to chaos.
This is what the New Cold War is about.
So this centralised scheme gives our adversaries the exact means to destabilise democracies.
Does anyone ASIO actually know what’s going on in the world?
Fair enough, in at least some cases ‘state’ and ‘criminal’ is a distinction without a difference, and while spreading chaos the destabilisation is the aim of their propaganda work, much of the rest is principally undertaken for profit by theft and extortion. (For example the BBC World Service podcast ‘The Lazarus Heist’ a few years ago took a close look at North Korea’s very determined efforts in that field.)
“The government” is doubly inexpert in that the job will be explicitly or implicitly contracted out to what’s called the private sector. It’s not called “private” because of privacy competence, obviously.
But seriously I’m having to weigh up whether I trust Musk and Zuckerberg more.
That is so. Contractors, for the usual fees, will be falling over themselves to advise the government and help to build and operate its ID system, in much the same way PwC (and the rest of the ghastly Big Four not far behind) was so helpful in advising the Tax Office on reforming corporate tax laws.
Agreed, SSR.
Ladies and gentlemen of the jury, may I draw your attention to Exhibit A?
Robodebt?
Or Exhibit B. MyGovID.
Your Honour, the Prosecution rests.
Hello! All great points, especially because this was just a quick overview of where we’re at. Just to clarify a few things that weren’t clear from me.
Not as secure as logging into your email, as easy. Bill Shorten said that the scheme could use biometrics like your Apple FaceID to confirm your log in, or there are other ways to be more secure than email (like two factor authentication). I compared it to email because it would be like logging into an account rather than having to upload all these documents every time you try to access a service.
The point of it would be that it’s custom for each use. Think about when you install an app on your phone — you’ll be prompted with a message “this app wants to access your messages/location/etc”. This system can be similar to this i.e. if you’re applying for Centrelink benefits it’ll ask to get more details that you provided than if you’re applying for a phone plan. The flexibility could stop the unnecessary sharing of details.
I’m not sure it gives resilience because, well, some people are still being affected! Also the size of some of these hacks (like Optus’ millions of customers) means that it’s not orders of magnitude different to accessing everyone’s details anyway.
Like I mentioned in the article, there is definitely a risk from creating a honeypot for hackers. The theory is that a government-run service can be designed bottom up to be secure and, unlike companies, there’s no commercial limits to how much they can spend on protecting it. (Obviously this is taking them at their word but if you had to guess, who’s going to have better security: local real estate agents that millions of Australians are giving a lot of info to or the federal government?).
To be clear, I’m not advocating for system and I intend to do more research but I do think the context of the many different people Australians give their personal identifying information to all the time, their varying ability to protect it and the prominence of hacks has changed the political calculus for people’s support for a scheme like this.
Thanks for replying with helpful clarifications on those points.
The argument between the merits of putting this responsibility in the hands of a variety of commerical organisations or else the government is not easy to resolve. Neither is ever going to be perfect.
Perhaps the question should be resolved by asking which are more likely to be held to account if it stuffs up – commercial organisations or a government department and its minister? Although it is difficult to make the former answer, it is near enough impossible to do anything about the latter except complain bitterly, as we see all the time – Crikey keeps reporting examples.
Hmm an ID card and no bill of rights….
My thoughts exactly.
Is it what is presently called a “driver’s licence”?
No because a drivers licence is tied to driving.
But this is a country where people accept that cameras can take photos inside people’s cars to see if they’re using mobile phones. And it’s a country where Peter Dutton could be the next PM.
People are – broadly speaking – OK with red light cameras, speed traps, and police vehicles scanning number plates in real time looking for stolen plates/cars and expired registrations, etc, so this seems… unsurprising.
Especially given it’s legal for anyone to take photos of you for no reason whatsoever through the windows of your own house (so long as they aren’t trespassing to do so), taking a photo of a car’s occupants in a public place to enforce the law seems a bit mundane, really.
Nor a robust EU like GDPR General Data Protection Regulation with penalties for companies etc. being non compliant e.g. not securing people’s data, rubbish security/data breaches, selling/giving data away e.g. mobile phone lists for pollsters and parties.
However, on the other hand, most EU citizens have a national card for ID linked to health, social security, drivers, licence etc.; online like MyGov and equivalent of shop fronts aka CentreLink which can issue new passports, driver licences etc.; good for across the EU.
The latter is the issue locally due to state vs. national functions; why we need state separate driver licences and road rules……?
Also Australian Privacy Laws (including the proposed updated ones) exclude government….
And plus Australia has Peter Dutton as a possible next Prime Minister.
My God! Is there any sane person in this world who would trust any government department, particularly an Australian government department, to run a scheme like this securely? And efficiently?
MyGov and associated websites are a disaster to try and use. And now they want to introduce another one.
I for one will not be using it. I’ll stick to identifying myself when I think it’s appropriate to do so in a manner that I consider appropriate.
Good luck. The difficulty with that approach might, in time anyway, resemble the consequences that arise if one chooses not to participate in the passport system, which is of course a free choice open to any citizen who prefers not to have a passport. In similar vein I know someone who never drives and does not own any motor vehicle, but they still for general administrative convenience keep renewing their driving licence. And nobody is obliged to reveal their tax file number to any financial institution where they have an account, but exercising that freedom does come at some cost.
While I lean towards the risks here outweighing the benefits, the larger problem is that the Rupertarian media will make it impossible for any sort of sensible discussion to occur about same.
Unfortunately the most likely outcome is that it will be badly modified legislatively, and the next LNP Government will under/defund the relevant department and systems so that it ends up poorly maintained, barely functional and vulnerable to attack.
The brilliant way the Coalition went forward with Labor’s nbn scheme is a wonderful illustration of the possibilities.
And let’s not forget the floating wreckage currently known as the NDIS.
My health was a disaster with incorrect files attached to the wrong name holder, my gov & my gov ID likewise. all breached privacy laws & expectations some continuing to do so.
Hope they use the best available software providers for this if proceeding, not the cheapest rip off
Security of myhealth relied on the integrity of untold numbers of doctors and their receptionists. Zero security when insurance companies, for example, are ready to pay for your info.
My Doctor refused to use the My Health scheme because they didn’t think it appropriate that all the other Doctors, some who were friends or otherwise, could access their health record. Simple.