Adam Gifford: One password will open many doors

In the carpark of the Avondale market last Sunday I spotted a red plastic wallet in the dust, probably stolen, its contents stripped apart from the owner's community services card.

The card allows access to a narrow and specific range of government services. It's not much use to anyone except the cardholder - there is no black market in those cards.

Work being co-ordinated by the State Services Commission's e-government unit could soon give us all an electronic equivalent of a community services card, but one which should be far more useful.

The unit selected systems integrator Datacom to pull together the bits of the $14.8 million all-of-government authentication programme, using technology from US vendor RSA Security.

The idea is that you will only need one logon to access any online government service.

That should encourage more agencies to take their services online, because a crucial and expensive part of the plumbing will be taken care of for them - they can just send a message to the central authentication server and get back a yea or nay.

No other personal information needs to be disclosed to the agency.

Unit head Laurence Millar won't go into the details of what Datacom is building until the contract is agreed, but RSA offers a range of solutions, including tokens which generate a one-time password, smartcards, USB keys, biometric devices and simple passwords.

There are huge privacy and security questions to be answered before it can happen, if it happens at all.

Indeed, InternetNZ is advocating the creation of a New Zealand digital certification authority, so we aren't reliant on US behemoths like RSA which may be less than responsive to the needs and concerns of tiny customers like the New Zealand Government and its citizens.

There are also basic usability issues.

Inland Revenue had an expensive tumble the first time it tried electronic identification, imposing on users a complex system of digital certificates which were hard to install and meant they had to use a designated machine every time they wanted to communicate with the department. The banks, too, are struggling with ways to prevent phishing and other forms of identification theft, and some are considering adding more layers of complexity to the sign-on process.

If government goes down the track of using more onerous security procedures such as a one-time password, smart cards or sending a text message with an access code to a cellphone, there could be slower uptake of online services than it wants.

The e-government unit says use of a single logon will remain optional, and people can choose to have a separate logon for each service they use, or to continue using paper forms or other service channels.

However, the more people it can encourage to use such a system, the better, because shared logons will lower the overall cost to the government.

The Ministry of Economic Development will pilot the development of the Shared Logon business processes and software components.

A small number of other service agencies will be included in the initial implementation, which will be completed by December this year and be reviewed before further deployment by other government agencies is decided upon.

The new system will be piloted at the Department of Internal Affairs, home of the passports section, the births, deaths and marriages registries, community and lotteries grants, the Local Government Commission and other assorted pieces of public machinery.

That means it already has a lot of personal information about citizens' identities - which is why issues of privacy become so critical.

Millar rightly rates the trust and security issue as one of the most important his unit faces, as people won't transact online if they feel unsafe.

"If the public lose confidence in security and trust on the internet, it will damage our overarching goals of driving uptake, putting more services online and using research to inform what services we put online," he says.

That is a way of explaining why the existence of the e-government unit doesn't seem to have galvanised departments into experimenting with online services.

There are also the monetary concerns - this Government is wary of spending on technology, and no additional funding is being offered for going online, apart from infrastructure projects like the authentication programme.

While it is recognised that the cost of electronic self-service is cheaper per transaction, the Government wants to avoid mistakes made by early adopters overseas, including complex and costly implementations, limited take-up because services were offered for which there was no demand or users were required to have specific hardware and software, high support costs and little interoperability between agencies.

"I don't believe the benefits from e-government come from instructions from the centre. People will use shared services and infrastructure because it makes sense for them," he says.

Still, the pace is too slow, particularly given how the the e-government unit was hyped when it was launched. Rather than evangelistic fire or inspiring visions, or even some dosh, the e-government effort seems bogged down in bureaucratic process.

It may be time to revise the strategy.