DIA wants igovt ideas, not detail

Internal Affairs has given businesses until Wednesday week to come up with proposals on how they could use and help support its $122 million online identity verification and log-on service.

About 30 businesses, including Westpac, the Bank of New Zealand and Kiwibank and technology firms EDS and Unisys, attended a briefing in Wellington.

Officials encouraged them to generate "energy and ideas" that would help ensure ongoing government support for the initiative.

Identity services group manager Annette Offenberger, who has overall responsibility for igovt, said that at this stage, there was no need for organisations to "commit themselves at a detailed level".

The department is due to report back to Cabinet by early December on how the private sector might be involved in helping run, fund and use the system. Cabinet will then consider igovt's long-term funding.

Several banks have expressed interest in using igovt to authenticate the identity of new customers, so that they can open bank accounts online.

Internal Affairs suggested that the system could also be used by online auction sites to verify traders' identities.

Trade Me head of trust and safety Chris Budge says that could appeal, but it has questions over the use of a single ID and the risk of fraud.

The Government was open to a variety of models for outsourcing parts of igovt, as long as privacy and government data were protected, officials said.

Private-sector partners might be able to sell the intellectual property behind igovt overseas, they suggested. At minimum, Internal Affairs might contract with a business with a large branch network that could establish people's identities when they first enrolled to use igovt's identity verification service (IVS). It is envisaged people would enrol in IVS in person.

Those enrolled would be offered a "two-factor" token, similar to those issued by banks to secure internet banking transactions. It would display a code that changed every 60 seconds and which they would enter, in addition to their user name and password. Instead of a token, people would be able to have an igovt code sent to a nominated mobile phone.

One benefit is people could log on to online services supported by igovt using the same user name and password, without the risks otherwise inherent in using the same password to access different online services, some of which might be insecure. That could reduce the costs and inconvenience resulting from people forgetting their user names and passwords, and having to get passwords reset.

Internal Affairs says people might also be able to sign up to IVS at the same time they applied for or renewed their passports.

Ms Offenberger says use of igovt by buisnesses would provide a bigger market to support the initiative. Banks, insurers and utilities were obvious customers, but credit reference agencies could provide an agency service for businesses, such as retailers, that might occasionally want to check the identity of people they transacted with online, officials said.

Any businesses that had to tighten their systems to deal with proposed anti-money laundering legislation now before Parliament might benefit.

Internal Affairs suggested banks and utilities might want to help fund igovt to make sure it quickly got critical mass and to avoid the operation of igovt being contracted out to a provider that would seek to run it at a profit, a model the department remains open to.

Issues raised by businesses at the briefing included whether the Government would be liable if they relied on igovt to authenticate someone's identity and later found they had been defrauded. Officials indicated this was unlikely.

It was possible ministers would signal before Christmas whether the public-private initiative would proceed, or whether they had "lost their nerve".

HOW IT WILL WORK

Your basic igovt log-on is made up of your user name and password.

For services that require an extra level of security, you will also be required to enter an igovt code, a randomly created code for one-time use.

You need to correctly enter the igovt code to log on. The code is synchronised with the igovt system and you have a limited amount of time to enter the code.

Each participating service provider will decide whether their service requires this extra level of security.

igovt by text: when you log on, a unique igovt code will be automatically sent by text to your registered mobile phone.

igovt by token: an igovt token will be issued to you, which displays a unique code that changes every 60 seconds.

- Bang! Showbiz