2 Overseas Government experiences

2.1 Hong Kong

7. Hong Kong's certification authority, Hongkong Post has only sold 110,000 e-Certs since it was introduced in 2000. It is taking another shot at popularising e-Cert, its digital signature service, by offering every smart ID card holder an option to embed an e-Cert in the card's memory chip for one year at no charge. From July, Hong Kong identity card holders will be issued smart ID cards to replace existing ID cards. The process will take four years.

8. [Copyright (c) 2003 South China Morning Post, 25th March 2003, SMART IDS PLAN GIVES A LIFELINE TO E-CERT HONGKONG POST PUSHES ITS ELECTRONIC SIGNATURE PRODUCT BY OFFERING IT FREE TO USERS OF THE NEW HK IDENTITY CARD]

2.2 Finland

9. Finland's Population Registration Centre started issuing chip-based ID cards to citizens over two years ago. For only 10 euros more, the government offered to load a digital certificate onto the cards for citizens. Only 10% or fewer have decided the money was worth it.

10. [Copyright 2003 Thomson Media Inc, 5th March 2003, DIGITAL SIGNATURE CARDS: FOR PROFESSIONALS ONLY?]

2.3 Germany

11. The country's two largest commercial banks, Deutsche Bank and HypoVereinsbank, launched tests last spring, loading certificates and keys onto consumer smart cards. HypoVereinsbank has issued far fewer cards for the test than it had originally planned (approx 150). The bank last spring had planned to issue 10,000 cards for the test, but decided it had an insufficient business case for this.

12. In 2001, organizers of a German government-funded Internet security project ordered 10,000 chip-based digital signature cards for the 15,000-plus student body of the University of Bremen, lawyers in the community and the city of Bremen in general. The project received an 8.7 million-euro grant from the federal government. The result: Fewer than 1% of the university students have requested the cards and associated card readers, despite heavily subsidized prices. While the students and other ordinary citizens conducted a combined 300 transactions per month with the digital signature cards in the last six months, the lawyers did 10 times as many during the same period - with only a combined 20 to 30 cards.

13. One of the country's four trust centers, organizations that issue digital certificates, has already effectively shut down. That centre, run by Deutsche Post, could not find enough business to meet expenses and stays open now only to maintain its existing certificate, sources say.

14. So, while early tests indicate signature cards hold some promise in the hands of professionals, large rollouts are unlikely for years to come. The expense and complexity of PKI, make prospects for anything more than scattered trials of signature cards look remote for the next few years, even in PKI-friendly Germany.

15. [Copyright 2003 Thomson Media Inc, 5th March 2003, DIGITAL SIGNATURE CARDS: FOR PROFESSIONALS ONLY?]

2.4 US

16. The United States General Accounting Office has just finished a report - "GAO-03-144: Progress in Promoting Adoption of Smart Card Technology". The report found there had been significant steps forward in the creation of a standard smart card ID that all U.S. government employees could use to enter buildings, for travel-related purposes and to make small payments. According to the report, 18 agencies had launched 62 smart card projects as of November 2002.

17. It found that the full cost of a smart card system can be greater than originally anticipated because of the costs of related technologies, such as PKI.

18. In July 2002, the Department of the Treasury announced plans to launch a pilot project to assess the use of smart cards for multiple purposes, including both physical and logical access. Treasury plans to distribute smart cards equipped with biometrics and PKI capabilities to approximately 7,200 employees during its pilot test. Treasury's project manager estimates the overall cost for the department wide effort at between US$50 and US$60 million.

19. A Department of Transportation smart card pilot project aims to distribute smart cards to approximately 10,000 FAA employees and contractor personnel for access to the department's facilities; costs for the FAA pilot project, which have not yet been fully determined, are likely to exceed US$2.5 million.

20. At least US$4.2 million was required to design, develop, and implement the WGA Health Passport Project (HPP) in Nevada, North Dakota, and Wyoming and to service up to 30,000 clients. A report on that project acknowledged that it was complicated and costly to manage card issuance activities. The states encountered problems when trying to integrate legacy systems with the smart cards and had difficulty establishing accountability among different organizations for data stored on and transferred from the cards. The report further indicated that help-desk services were difficult to manage because of the number of organizations and outside retailers, as well as different systems and hardware, involved in the project; costs for this service likely would be about US$200,000 annually. WGA officials said they expect costs to decrease as more clients are provided with smart cards and the technology becomes more familiar to users; they also believe smart card benefits will exceed costs over the long term.

21. The US Department of Defence initially budgeted about $78 million for the Common Access Card (CAC) program in 2000 and 2001 and expected to provide the device to about 4 million military, civilian, and contract employees by 2003. It now expects to expend over US$250 million by 2003—more than double the original estimate. Many of the increases in CAC program costs were attributed by DOD officials to underestimating the costs of upgrading and managing legacy systems and processes for card issuance. Card issuance costs likely will exceed US$75 million out of the over US $250 million now provided for CAC through 2003,based on information provided by DOD. These costs are for installing workstations, upgrading legacy systems, and distributing cards to personnel.

22. According to DOD program officials, the department will likely expend over US$1 billion for its smart cards and PKI capabilities by 2005. In addition to the costs mentioned above, the military services and defense agencies were required to fund the purchase of over 2.5 million card readers and the middleware to make them work with existing computer applications, at a cost likely to exceed US$93 million by 2003. The military services and defense agencies are also expected to provide funding to enable applications to interoperate with the PKI certificates loaded on the cards. DOD provided about US$712 million to issue certificates to cardholders as part of the PKI program but provided no additional funding to enable applications.

23. The Veterans Administration, which three years ago projected issuing 4.6 million smart cards so military veterans could access the agency via the Internet, now no longer expects its pilot to lead to a full-scale rollout. "Executive-level priorities had changed and support for a wide-scale smart card project had not been sustained," the report states.

2.5 Australia

24. A parliamentary inquiry into the Management and Integrity of Electronic Information by the Joint Committee of Public Accounts and Audit has been told the Gatekeeper standard is too expensive and difficult to implement.

25. The ATO paid more than A$1.75 million for implementation, licences and maintenance of its PKI system in the past 12 months. The only other agency ready to implement Gatekeeper in the near future is Australian Customs, which will use PKI to identify parties communicating through its new Customs Connect Facility gateway and assure the integrity of messages.

26. National Office for the Information Economy said there was no indication Gatekeeper should be scrapped, but assumptions made three years ago about the growth of PKI in both government and non-government sectors had proved incorrect.

27. [© AUSTRALIAN 22nd April 2003, GATEKEEPER GOES MISSING]