The Human Services Access Card – What are its Chances?

Just as the Canberra politicians were about to depart for the “long winter parliamentary break” the Minister responsible quietly tabled an exposure draft of the proposed legislation for public consultation until August 21, 2007

The bill is entitled the “Human Services (Enhanced Service Delivery) Bill 2007 No. , 2007 (Human Services) A Bill for an Act to enhance the provision of Commonwealth benefits, and for related purposes” The full text of the bill, some explanatory notes and some fact sheets.

All this can be found and downloaded from www.accesscard.gov.au.

For those so inclined comments can be made by email to: accesscard.bill@humanservices.gov.au.

What I wanted to briefly consider is what this new bill means for the future of the overall project. My overall take is that while some of the rough edges have been knocked off the total package the risk of the Access Card becoming a de-facto national ID card has not been reduced to an acceptable level.

The reason I say this is principally that the Government is still insisting that a human readable number and photograph will be on the front of the card.

On this topic the relevant fact sheet states:

“One of the biggest weaknesses of existing Commonwealth issued benefit cards is their vulnerability to fraud because of their lack of security features. The inclusion of a photograph, card number and signature on the surface of the access card are integral to the ability of the access card system to effectively reduce fraud, protect individual identity, and streamline access to government services.

THE PHOTOGRAPH

The photograph of the card holder taken during the registration process will be stored on the Register, in the card’s chip and will be displayed on the surface of the card.

Only the Office of Access Card and participating agencies will have the software capable of reading the photograph from the chip of the card. This restricted access means that in addition to the legislative provisions and encryption technology protecting the electronic version of the photograph, there will be a further layer of physical security to safeguard the photograph.

A photograph will be displayed on the face of the card to:

• reduce fraud and leakage against taxpayer funded benefits;
• significantly enhance the identity security elements of the card by protecting the card holder’s identity and reducing opportunities for identity fraud and theft;
• increase customer convenience by allowing people to simply and swiftly prove who they are when accessing Commonwealth benefit ts and services both through Government agencies and also through general practitioners and pharmacies;
• improve access to Australian Government relief in emergency and disaster situations by ensuring that there is no interruption to service delivery during periods where terminals are out of service or unavailable;
• secure access to services in a mobile environment such as in rural or remote areas where services may be delivered by a visiting health professional; and
• permit access card holders to use their access cards for such other lawful purposes as they choose.

International accounting firm KPMG has stated that the presence of a photograph on the surface of the card is critical to achieving savings from fraud concession and leakage amounting to some $3 billion over ten years.

This reflects international experience in countries such as France and Germany who, having issued health smartcards without a photograph on the surface of the card, found the card ineffective in combating fraudulent activity. Both countries have now moved to issue cards with photographs.

The five most recent investigations by the Identity Crime Taskforce involving the seizure of fake ID manufacturing equipment have all included templates for making Medicare cards along with thousands of blank plastic cards capable of being converted into Medicare or credit cards.

The absence of a photo on the surface of the card makes it more susceptible to fraudulent reproduction and could result, as occurs today, in a single card being used by multiple offenders to access services and benefits to which they are not entitled.

The Australian Federal Police Identity Crime Task Force’s operational experience has shown that fake Medicare cards feature prominently in 70 per cent of the more serious and organised identity crime investigations.

The use of facial biometric technology will also ensure that only one card is issued per person by identifying duplicate and fraudulent applications. (See fact sheet on Biometrics.)

CARD NUMBER

The access card number assigned to an individual during the registration process will be stored on the Register, in the card’s chip and will be displayed on the surface of the card.

The Agencies within the Department of Human Services, including Centrelink and Medicare, are estimated to deal with over 51 million telephone contacts, 281,000 email contacts and 74 million secured customer transactions each year. The majority of these transactions currently involve the customer quoting a number that is printed on the surface of their existing Medicare, Centrelink or Veterans’ cards.

Maintaining a number on the surface of the access card will mean that these services can continue to be delivered in a streamlined and convenient way. In absence of a number on the surface of the card, individuals would be required to remember their access card number which could be comprised by as many as 12 digits and will change each time a card is reissued.

Without the number on the face of the card, a customer would need to continue to identify themselves by another means, most likely by providing additional personal information which may be intrusive to their privacy.

SIGNATURE

The signature of an individual captured during the registration process will be stored on the Register and will be displayed on the surface of the card. Including the signature on the Register supports customer authentication for claiming benefits when the customer is not physically present when claiming a benefit, for example when a cardholder submits a claim for reimbursement of medical expenses to Medicare.

The signature on the surface of the card provides and additional layer of physical security for the cardholder be enabling a visual comparison of the signature to be conducted at the point of service if necessary.”

Frankly I see this as a lot of ingenuous nonsense. All that has to be done is that the smart card is issued with simply a number on it – and nothing else visible. Then all those who are meant to verify the card have readers which when a card is put in – will display the name, picture and signature for verification.

Indeed it is clear from another fact sheet the readers planned by the government will display the photograph – so just exactly why is it needed on the card as well?

The card cannot then be used by anyone who does not know the associated name and other details either in person or over the phone. By making the personal information strongly encrypted and only readable by a Government reader you create a genuine access key – and not a card that can also be used “for such other lawful purposes as they choose” – i.e. as an identity card. (Function creep if ever I saw it from the Government’s mouth!)

Frankly until the Access Card becomes just that – a access key that is not usable for other purposes I do not believe the Australian public will wear it.

Moreover the Government is being less than honest when it says there will not be a “mega-database”. The central register will contain – another fact sheet states – the following:

“The Register will contain only information that is needed for the card holder to access health benefits, veterans’ and social services. This includes, but is not limited to:

• name, sex, date of birth and address;
• photo and signature;
• registration status, access card number and expiry date;
• concession status and veterans’ information if applicable;
• contact information such as residential address, postal address if applicable, phone and/or e-mail address; and
• whether or not the card holder is a customer with any of the participating agencies.

Individual customer records will continue to be held separately by Centrelink, Medicare, the Department of Veterans’ Affairs and other participating agencies.

Only those people with a legitimate operational purpose will be given approval for access to the Register in line with the confidentiality provisions in the legislation. Access to the information contained in the Register will also be governed by the Information Privacy Principles of the Privacy Act 1988.”

That sounds like a pretty large database to me containing contact information which many different types of miscreants (from violent abusers to debt collectors) would love to be able to access. We know from other incidents such a huge data-base acts as a honey pot for such people and at least some officers will be happy to receive payment for disclosing such information.

All in all, until the Access Card becomes just that, I will continue to see it as a bad idea and continue to hope the legislation just doesn’t quite make it.

David.