IDENTITYIDENTITY && ACCESSACCESS Virtual Opportunity Congress IV Report Queensland Parliament House Brisbane • December 2006 Virtual Opportunity Congress IV “Identity and Access” Brisbane, Australia 30 November – 1 December 2006 For further information contact: Global Access Partners Pty Ltd 53 Balfour St, Chippendale, Sydney NSW Australia 2008 Phone +61 2 8383 2416 Fax +61 2 9319 5754 Website www.globalaccesspartners.org 1 Table of Contents Executive Summary 3 The Steering Committee 6 Partners & Sponsors 7 Keynote Speakers 8 Participating Organisations 17 Report of the Congress Proceedings 18 Appendices: Appendix 1 – Programme 36 Appendix 2 – Sponsors’ Profiles 38 Appendix 3 – List of Delegates 44 Appendix 4 – Welcome letter by the Hon. Philip Ruddock MP 49 Appendix 5 – Welcome letter by the Hon. Peter Beattie MP 50 2 Executive Summary Virtual Opportunity Congress IV on Identity The Congress spotlighted notable and Access, held at Queensland Parliament Government identity management initiatives House on 1 December 2006, brought and emphasised the importance of public- together key stakeholders from private partnerships in addressing online Government, Industry and Academia in a crime. The need for individuals to control national debate on identity security. access to their own data took centre-stage in the debate. The Congress, jointly hosted by Sydney- based policy network Global Access Partners Key points of the discussion included the (GAP) and the National Consultative following: Committee on Security and Risk (NCCSR), examined current progress in finding • Emerging information technologies have solutions to the fast growing problems of created exciting opportunities in commerce, identity theft and data security. Over 100 education and healthcare, but have also participants led by keynote speakers afforded new avenues for crime. Identity including Special Minister of State the Hon. theft is an “increasing and insidious crime” Gary Nairn MP, Queensland’s new Attorney- costing Australia an estimated $3.5 billion per General the Hon. Kerry Shine MP and annum. It tarnishes the reputations of its Minister for Police and Corrective Services victims, defrauds financial institutions and the Hon. Judy Spence MP, contributed to the undermines public confidence in purchasing discussion. Symantec’s Chief Technology goods and sharing personal information Officer Mark Bregman and Microsoft’s online. Worldwide Industry Technology Strategist Phil Stradling added their unique industry • Identity protocols established in the past perspective. are no longer applicable as centralised controls are overwhelmed by the viral, Virtual Opportunity IV focused on cross- unpredictable and anonymous challenges of sectoral responsibility in developing systems the internet. Citizens demand individually to curb cyber crime and fraud targeting tailored and user-friendly identity solutions passwords, pin numbers and computerised and the 'centre of gravity' will continue to tilt finances. Ten million Americans have their towards the individual user's demands, rather identity stolen every year1 and a growing than the provider's convenience. If individuals, number of Australians are falling prey to rather than banks or organisations, are asked fraudulent identity schemes. to bear the brunt of the costs of identity theft, people's willingness to transact business online Javelin Strategy & Research, 2006 Identity Fraud Survey will be greatly reduced. Report - www.privacyrights.org/ar/idtheftsurveys.htm 3 • Identity management and security and maintain high standards of privacy and projects have tended to be 'proprietary' in usability. The Card embodies the difference the past, with individual organisations between an identity card and an access developing their own incompatible schemes. card. It establishes the cardholder’s right to ‘Federated Identity Management’ and benefits, but is intended not to offer standards based approaches involving unnecessary information. Data held on partners working together to produce people can be limited to the 'roles' they common standards and protocols, may be play in specific situations. the way forward. • Individuals should be able to lodge and • A 'Trust Centre' would offer an control a variety of identity credentials with opportunity to develop a common, secure government and choose which they wish to and cost effective electronic identity use to access particular services. Citizens verification system by vouching for want to claim ownership of their own someone's identity to a third party without information, rather than such data being disclosing additional information about seen to be the property of the state. them. • The opaque nature of identity • The complex chain of identity protection technology invites public suspicion as to its is as strong as its weakest link and more efficacy and intention. IT allows a wide secure government documents - driver’s range of people to access data from licence, passports, birth certificates etc. – diverse locations but also facilitates the are required. Once stolen, digital identities tracking of exactly who accessed what can be forged in vast numbers compared to information and when. physical documentation. • The public's unwillingness to give • Australia has played a leading role in organisations information is based on their developing virtual technology, but new fatigue with unnecessary intrusion as much methods must be developed and adopted as the fear of criminal exploitation. much more quickly today. Such protocols Consumers are being asked to provide time must be simple to use and cost effective to consuming identity checks, which they will implement. Organised crime is not soon reject if they fail to benefit from them. hampered by the need to outline new policy People cannot provide physical proof of proposals or conduct post-operational identity such as driver’s licenses online, assessments and so is continually a step therefore the 'cyber world' requires new ahead of bureaucratic enforcement solutions, perhaps in the manner of the agencies. credit industry which relies on 'credit scores' compiled without specific interaction with • The Department of Health and Human the consumer. Services’ Access Card is a smart card designed to operate in a framework • Consumers demand security usability, agreed by state and federal governments certainty of website identity, the provision to assure compatibility with other systems of sufficient information to allow swift 4 decision making and a reasonable number of steps to navigate any particular transaction. People learn to use computers and the internet by 'playing' with them, rather than reading books or taking courses, and ID management requires a similar approach with safeguards reducing the risks of failure and offering user friendly restitution. • Co-operation between the public and private sectors, citizens and consumer protection bodies can create safe, reliable and trusted channels of communication. Clear contractual rules about who bears the risk when identities are misappropriated must be created. Governments must balance the competing needs of speed and efficiency with privacy and security, and victims of identity theft require better systems to re-establish their bone fides. DISCLAIMER: This Report represents a wide range of views and interests of the participating individuals and organisations. Statements made during discussions are the personal opinions of the speakers and do not necessarily reflect those of the organisers and sponsors of the Congress. (for the full Report of the Congress’ proceedings, see pages 18-35) 5 The Steering Committee The Steering Committee of Government and business executives worked over a few months on the Congress’ objectives, topics for discussion and a continuity strategy, to ensure outcomes are achieved beyond the event. The members of the Steering committee for Virtual Opportunity Congress IV on Identity and Access were (in alphabetical order): Mr Keith Besgrove Mr Chris Gration Chief General Manager Head of External Relations and Access & Consumer Division Compliance, Baycorp Advantage Department of Communications, Information Technology and the Arts, Ms Erica Hughes Australian Government General Manager, Baycorp Advantage Mr Patrick Callioni Mr Martin Kaldor Division Manager Vice Chair, Australian Information Australian Government Information Security Association Management Office, Department of Finance and Administration, Australian Ms Catherine Martsch Government Chief Executive Officer, Trust Centre Mr Malcolm Crompton Mr Matthew Osborne Managing Director Principal Policy Officer, Law and Justice Information Integrity Solutions Policy, Department of the Premier and Cabinet, Queensland Government Mr Michael Dupe Branch Manager, Investments and Enabling Mr Greg Stone Projects, Australian Government Information Regional Chief Technology Officer Management Office, Department of Finance Microsoft Australia and New Zealand and Administration, Australian Government Mr David Sykes Mr Peter Fritz AM Vice President & General Manager, Managing Director Pacific Region, Symantec Australia Global Access Partners (GAP) Mr Patrick Vidgen Mr Peter Ford Acting Deputy Director- General Chairman, National Consultative Governance, Department of the Premier Committee on Security and Risk and Cabinet, Queensland Government 6 Partners & Sponsors Virtual Opportunity Congress IV on Identity • Australian Government and Access was coordinated by Global Information Management Office Access Partners