Shutterstock
In 2018-19, id crime instantly and not directly price Australia an estimated A$3.1 billion.
To deal with such prices, the federal authorities is proposing a nationwide digital id scheme that may let folks show their id with out having to share paperwork equivalent to their passport, drivers licence or Medicare card.
Finance Minister Katy Gallagher opened consultations for the draft invoice final week, with plans to introduce the laws to parliament by the tip of the yr.
Let’s have a look at what it proposes, and what it may imply for you.
What would change?
The digital ID scheme would initially be regulated by the Australian Competitors and Shopper Fee and the Australian Info Commissioner, with a view to ultimately set up a brand new governing physique.
The draft invoice bundle consists of sturdy updates to safety necessities for the way organisations retailer folks’s IDs, in addition to the reporting of information breaches and suspected id fraud.
In her speech to the Australian Info Business Affiliation, Gallagher outlined a four-phase rollout.
Part one: establishing the laws and accreditation of personal and public suppliers.
Part two: including state- and territory-issued IDs to the scheme to be used with federal authorities companies.
Part three: bringing recognition of the digital ID into the personal sector. This may, as an illustration, mean you can use your digital ID to use for a financial institution mortgage with out having to offer your id paperwork or copies.
Part 4: permitting accredited personal sector digital IDs to assist confirm you when accessing sure authorities companies.
How would it not work?
For most people, the voluntary scheme would come within the type of a smartphone app, requiring biometric info (equivalent to a face print) to be unlocked.
To show your id to a taking part organisation, you’ll log into the organisation’s web site and choose MyGovID as your verification methodology.
You’ll then log into your MyGovID app and provides consent in your id to be verified with that organisation. On this approach, you could possibly confirm your id to the organisation with no need to share your drivers licence, passport or related.
Gone would be the days of 100 factors of ID and copies of paperwork saved all around the web.
The upside of the proposal
The Medibank, Optus and Latitude knowledge breaches of 2022-23 have demonstrated the shortage of regulation and enforcement of id safety laws in Australia.
A welcome a part of the draft invoice is the elevated energy given to the Australian Info Commissioner, in addition to restrictions on how organisations request, retailer and disclose folks’s private figuring out info.
The invoice additionally outlines minimal cybersecurity requirements, and requires common assessment of organisations coping with id knowledge.
Unresolved MyGovID safety flaws
In releasing the draft invoice, the federal government has highlighted a voluntary nationwide digital id – the MyGovID – which is already being utilized by greater than 6 million Australians and 1.3 million companies.
MyGovID is a government-issued authenticator app which verifies your id utilizing one in all three components: one thing you recognize (equivalent to a password), one thing you might be (equivalent to a biometric scan), or one thing you have got (equivalent to a verified cellphone quantity, the place you’ll be able to obtain one-time codes). Including extra components makes verification safer.
In 2020, safety researchers warned the general public towards utilizing MyGovID attributable to safety flaws in its design. It’s unclear if these have been addressed. The Australian Tax Workplace declined to repair the difficulty when raised.
Governments in Australia even have a poor observe report of securing our info.
In accordance with Webber Insurance coverage, 14 of the 44 recorded knowledge breaches between January to June this yr have been reported by authorities authorities. These included the Division of Dwelling Affairs, and the Northern Territory, Tasmania, ACT and NSW governments.
That is on high of information breaches involving the Australian Tax Workplace, Nationwide Incapacity Insurance coverage Scheme and MyGov, as reported by the ABC final yr.
Extra worryingly, the privateness act has a loophole which permits state and authorities authorities to stay exempt from obligatory knowledge breach reporting. As such, we don’t know simply what number of authorities knowledge breaches have occurred.
The draft invoice explicitly maintains these loopholes, stating entities are exempt from knowledge reporting if “the entity is a division or authority of a State or Territory”.
Learn extra:
The federal government needs to increase the ‘digital id’ system that lets Australians entry companies. There are various potential pitfalls
A honey entice for hackers
Even when the federal government carries out its finish of the discount securely, the proposed scheme would nonetheless solely be as safe as your cellphone. Having a weak password, shedding your cellphone, or having your cellphone hacked may result in knowledge being compromised.
Additionally, streamlining distributed identification techniques on this approach will create an irresistible goal for hackers. In cybersecurity that is known as a honeypot, or honey entice.
Simply as honey is irresistible to bears, these knowledge lures are irresistible to hackers. Failure to safe the information would make it a one-stop-shop for id theft and extortion.
Maybe most regarding is how carefully the proposed scheme resembles authorities surveillance. By linking all our private identification knowledge throughout federal and state jurisdictions, in addition to personal entities, we might be giving the federal authorities full oversight of our lives.
Small adjustments to the legislation, equivalent to these quietly made within the Surveillance Laws Modification (Establish and Distrupt) Act in 2021, may imply our places could possibly be tracked, and all our interactions with private and non-private organisations recorded.
What are you able to do?
It’s clear the draft invoice has various points. That stated, all hope isn’t misplaced.
The federal government has dedicated to real session on its proposal. Nevertheless, you don’t have a lot time to have your say: public submissions are being sought till October 10.
This extraordinarily brief session interval doesn’t present a lot confidence a fit-for-purpose answer will likely be created.
Whereas defending our digital identities is a welcome and well-overdue a part of this proposed invoice, getting it flawed may result in hurt at an excellent bigger scale.
Learn extra:
Australia’s Nationwide Digital ID is right here, however the authorities’s not speaking about it
Erica Mealy is member of the Australian Pc Society, the Australian Info Safety Affiliation, and the Worldwide Affiliation for Public participation (IAP2). Erica isn’t a member of nor affiliated with any political organisations.
