Big Brother is here as the government links your face scan to tax, health and welfare benefits
PRIVACY experts have slammed the federal government’s new biometric identity system that will be required to access welfare services, labelling it a severe hacking risk.
Security
Don't miss out on the headlines from Security. Followed categories will be added to My News.
YOUR face will be scanned - and then analysed - to access Medicare and childcare subsidies, the age pension, welfare benefits and pay tax online under a controversial reform.
Under a Big Brother style scheme, Australians will have to provide biometric data to a controversial myGovID pilot program which will begin in October and Human Services
Minister Michael Keenan wants the $90 million system to be fully operational by 2025.
The government says it will help Australians frustrated at having to remember different passwords to access up to 30 government services but privacy and tech experts are worried people’s most personal attributes could be hacked.
“I would say the real concern is whether if this information leaks it could be used by somebody nasty to open a bank account or get access to your health records,” says Dr Vanessa Teague from Melbourne University’s School of Computing and Information systems.
IT security experts Troy Hunt who runs the website haveibeenpwned.com says India’s biometric identification system has been hacked many times and it is important for the Australian Government to be transparent about how our system will work to avoid that here.
The new system comes in the wake of the Cambridge Analytica scandal which showed how Facebok failed to protect the privacy of more than 87 million people globally.
The new ID will be voluntary but the government will use nudge tactics to force people into taking part.
Citizens who refuse to supply their biometric information won’t be able to access government services online, they will have to queue up at Centrelink offices to deal with government officials in person.
A spokesman for Digital Transformation Minister Michael Keenan said the new biometric ID system was is still a work in progress, “but the plan is to incorporate facial recognition biometrics into the system for those services where an additional layer of security is required such as creating a Tax File number online,” he said.
“This will provide greater certainty that the person who is applying is actually who they say they are,” he said.
The system will be voluntary, he said.
HOW IT WORKS:
Instead of going into a government office like Australia Post or Centrelink to create their myGovID Australians will simply go online using their phone, computer or tablet.
They will upload identity documents such as their birth certificate, passport, driver’s licence and Medicare card to the Australian Taxation Office which will check them against existing government records.
The system will then connect to the Attorney-General Departments’ facial verification service which will need to confirm the person setting up the myGovID matches the photo supplied to the government by using the camera on their device.
The system will capture, detect and verify the “liveness” of the person.
This digital facial image will be checked against the photo ID they provided the government, and then myGovID will delete it.
Privacy experts have serious concerns about the new ID system.
“The problem with using biometrics is you can replace a stolen password but you can’t replace your biometrics if they are stolen,” says chair of the Privacy Foundation’s health committee Dr Bernard Robertson-Dunn.
Once your biometric identity is hacked it becomes impossible for you to rely on your own unique biological markers it as a secure method of identification for banking, passport identification.
Dr Robertson-Dunn says the government also needs to have contingency plans in place to cover situations where a medical illness or accident may transform a person’s appearance making their biometric log in useless.
Last year a Vietnamese security firm claimed to have hacked Apple’s iPhone X facial recognition system using a mask made with a 3D printer, silicone and paper tape.
There have been reports that India’s national Biometric ID system Aadhaar which contains the personal biometric data of more than 1 billion people was hacked several times in the last year with the information for sale for less than $10 through WhatsApp.
Troy Hunt says systems have improved since hackers recreated the German defence minster’s fingerprint using a melted gummy bear and questions remain about whether a Vietnamese security firm was able to defeat Apple’s new facial recognition identification system using a mask.
The Australian Government says it will protect people’s privacy under the new system by using ‘double-blind’ architecture.
A person’s identity attributes will not be stored centrally and the Australian Taxation Office which will be the identity provider won’t know which government services individuals are accessing.
“Once an identity is verified, only the essential information will be retained, the rest will be discarded. This minimises security threats and limits ‘function creep’ (widening of the use of a system beyond the purpose for which it was originally intended),” the government claims in documents outlining how it will work.
Mr Keenan says the new system will speed up bureaucratic processing and save the government money.
A face-to-face or over-the-counter transaction costs on average about $17 to process. An online transaction can cost less than forty cents, he says.
“Under our digital identity solution, citizens will only need to establish their identity once, and can then use it multiple times to access multiple government services,” he says.
Over 24 million passengers have already given the government access to face recognition through the SmartGates used at international airport passport gates.
News Corp has asked the government what compensation would be provided to people if the system was hacked.
Earlier this year we revealed that the sensitive health data of Australians is subject to a data breach every two days and the organisations and governments that fail to protect it are facing no financial penalties.
Europe has introduced tough new penalties for data breaches will be set at four per cent of a company’s gross annual turnover.
THE ROLL OUT
By July 2019 the government plans to have rolled-out pilot myGovID services to over half a million users of government services.
. A pilot program using biometric identification to set up a Tax File Number will begin in October this year.
. Registering a business through the Australian Business Registry will be trialled with 100,000 people in December.
Online grants management services will be trialled with 5,000 organisations (and up to 10,000 people) in December 2018.
From March 2019, digital identity will be connected to the Unique Student Identifier, and Centrelink online services – including Youth Allowance and Newstart.
Also from March 2019, a pilot of My Health Record will allow 100,000 people to use their digital identity to create their My Health Record online.
HOW YOUR BIOMETRICS CAN BE HACKED
•In 2015 the fingerprints of 5.6 million workers were stolen from the Federal Government Office of Personnel Management in the US
•In November 2017 a Vietnamese security firm claimed to have hacked the iPhone X’s facial recognition security system using a mask made with a 3D printer, silicone and paper tape.
•In 2016 researchers at Michigan State University used an inkjet printer and special paper to convert high-quality fingerprint scans into fake, 3-D fingerprints that fooled smartphone fingerprint readers.
•In Germany in 2008 a hacker group lifted the Interior Minister’s fingerprint off a glass he used while delivering a public speech, copied it and reproduced it and distributed as a special insert in the club’s hacker magazine as part of a campaign to show fingerprints were not a secure form of identity.
•In 2014 another hacker claimed to have reproduced the fingerprint of the country’s defence minister using an image taken form one of her press conferences.