Australian visit - August 2002

The project team visited three government bodies and two private enterprise companies in Melbourne; seven government bodies including the Authentication team from NOIE (the National Office for the Information Economy [the EGU equivalent in the Australian Federal government]); and two government bodies and the Biometrics Institute in Sydney.

In addition, the team attended a NOIE organised seminar on authentication, the interoperability of Public Key Infrastructure (PKI) schemes and the general use of biometrics.

In summary, the following general conclusions have been drawn about the Australian approach to authentication:

• an Australian ID Card is not on the agenda in Australia. Such use is offset by concerns about national identity systems generally, issues around card readers (practicality, cost, robustness) and the lack of a compelling reason for its adoption;
• they are working on an approach that deals with concentrated groups - accountants, lawyers, land agents, businesses generally - rather than with members of the public directly;
• PKI (Public Key Infrastructure) has been chosen by a number of agencies as the method of securing transactions. 'Gatekeeper' is the name of the system and the philosophy behind the system is a 1997 development. There are 4 key challenges to PKI:
• the operation of the system across the Federal / State legislative boundaries (legality issues);
• the costs (estimated at A$300 upfront cost and $25 per annum) and practicalities of operation of the system, and
• the standards of operation of PKI - there is as yet no Crown Root Certificate.
• achieving interoperability with other PKI domains
• the ABN-DSC (Australian Business Number Digital Signature Certificate) is the link key for businesses to use the PKI system;
• the Privacy Commissioners have a key role to play in authentication. There is rigorous dialogue between the State and Commonwealth Privacy Commissioners and the way they deal with the various proposals;
• the use of biometrics will not solve identity fraud problems. Currently, segments of the population that cannot or will not use biometric systems;
• the use of authentication should be matched against the risk associated with the individual transaction;
• they are trialing face-recognition technology at Australian airports - QANTAS air-crew.
• welfare agencies do not think that the Gatekeeper approach will work with their clientele (complexity and expense issues) - they prefer a Password / PIN approach;
• there is a very clear need to split the Establish identity and Verify identity processes;
• the question of use of identity databases is still being addressed - Police, Immigration etc.;
• most agencies use a '100 point' system or similar to allow people to establish or prove their identity. Agency choice of documents t meet the 100 points requirements vary.

Link

NOIE