Other countries have found safer alternatives to the nine-digit number that dominates identity in the U.S.
By Suzanne Woolley
10 October 2017 2:54:20 AM AEDT
In the wake of the huge Equifax data breach, which compromised the personal information of 145.5 million U.S. consumers, the Trump administration asked federal departments and agencies to do something bold: Come up with a new identity system that does not rely on overexposed and octogenarian Social Security numbers.
Other countries already enjoy just this kind of society in which there’s no unique nine-digit number that holds the key to anyone’s economic identity. The problem might not be imagining a world without Social Security numbers but surveying other systems to pick, and perhaps adapt, the best ones. “The U.S. doesn’t have to totally reinvent the wheel here,” said Daniel Castro, director of the Center for Data Innovation, a think tank.
Rob Joyce, special assistant to the president and White House cybersecurity coordinator, suggested at a recent conference in Washington that an improved system might involve technologies such as a “modern cryptographic identifier.” And in fact other countries already embrace blockchain and biometrics as backbones for government and private-sector systems. Often these tools are used in tandem with other authentication techniques to verify a citizen’s identity, provide easy access to services, and keep a permanent record of interactions. Whether these technologies now gaining momentum will prove enough protection against future cyberattacks will be the story to watch over the next few years.
Here are some of the ways governments outside the U.S. have set up modern identity systems that allow citizens to share and protect their personal information.
Rob Joyce, special assistant to the president and White House cybersecurity coordinator, suggested at a recent conference in Washington that an improved system might involve technologies such as a “modern cryptographic identifier.” And in fact other countries already embrace blockchain and biometrics as backbones for government and private-sector systems. Often these tools are used in tandem with other authentication techniques to verify a citizen’s identity, provide easy access to services, and keep a permanent record of interactions. Whether these technologies now gaining momentum will prove enough protection against future cyberattacks will be the story to watch over the next few years.
Here are some of the ways governments outside the U.S. have set up modern identity systems that allow citizens to share and protect their personal information.
Trusting the Blockchain With Identities
“One of the world’s most developed digital societies” is how Estonia describes itself on its e-estonia.com website. After a nationwide cyberattack in 2007, the government began moving toward a blockchain-based system developed by an Estonian company to secure and protect its data and systems. Blockchain is software that supports a sort of public ledger, albeit an encrypted one, that stores data that cannot be erased or rewritten without leaving a record of the previous data.
Estonia’s eHealth Authority is working on putting its citizens’ medical records on blockchain. Dubai, another early government adopter of blockchain technology, plans to do the same with medical records and have all government documents on the blockchain by 2020.
An Estonian press officer using the country’s mobile identification in Tallinn, Estonia. Photographer: Fabian Weiss/The New York Times via Redux
Estonian ID cards, which have an electronic chip, can be used to vote, bank online, get a prescription, file taxes, apply for state benefits, and much more. The cards require two PIN codes: the first is to authenticate an identity; the second acts as a digital signature. When the person is linked with whatever resource they’re using, the data are preserved on the blockchain.
Estonia’s government database system is based on a secure data exchange called X-Road, and citizens use their e-IDs to access services. It’s a sort of peer-to-peer encrypted information exchange between independent computer systems. The X-Road website notes that the Estonian-developed system is being used in Finland, Azerbaijan, Namibia, and Faroe Islands. Japan consulted with Estonia in launching its MyNumber card, its first national digital ID program.
Voice Biometrics Turn Identity Into Sound
The Australian Taxation Office uses voice-based biometric authentication for its call center and mobile app. Rather than provide a date of birth or a password when calling about your taxes, citizens can create a voiceprint and then identify themselves by saying, “In Australia my voice identifies me.” About 3 million taxpayers have done that.
The technology was developed by Nuance, a Burlington, Mass., company. Nuance also has deals with Australia’s Department of Human Services and Department of Immigration and Border Protection. Australia’s intent, though it’s not quite there yet, “is to ensure that citizens have a unique identifier that they can use across all government agencies,” says Brett Beranek, director of product strategy for voice biometrics at Nuance. Beranek says its algorithms can measure more than 1,000 voice characteristics to verify an identity.
The Australian government is working to create a comprehensive digital identity system. The website for its Digital Transformation Agency’s GovPass project says that “users will be able to prove themselves by having an accredited organization vouch for them, such as a government agency, or in the future, even their own bank.” The project involves building new technology that will function as a middleman between a government department and an organization or other verifier of a person’s identity. An “electronic tick of approval” from an accredited verifier will open up access to government online services.
Starting in January, meanwhile, taxpayers in the United Kingdom using the mobile app of tax authority HM Revenue and Customs (HMRC) have been able to enroll to use voice identity to get speedier service from the tax agency.
The technology was developed by Nuance, a Burlington, Mass., company. Nuance also has deals with Australia’s Department of Human Services and Department of Immigration and Border Protection. Australia’s intent, though it’s not quite there yet, “is to ensure that citizens have a unique identifier that they can use across all government agencies,” says Brett Beranek, director of product strategy for voice biometrics at Nuance. Beranek says its algorithms can measure more than 1,000 voice characteristics to verify an identity.
The Australian government is working to create a comprehensive digital identity system. The website for its Digital Transformation Agency’s GovPass project says that “users will be able to prove themselves by having an accredited organization vouch for them, such as a government agency, or in the future, even their own bank.” The project involves building new technology that will function as a middleman between a government department and an organization or other verifier of a person’s identity. An “electronic tick of approval” from an accredited verifier will open up access to government online services.
Starting in January, meanwhile, taxpayers in the United Kingdom using the mobile app of tax authority HM Revenue and Customs (HMRC) have been able to enroll to use voice identity to get speedier service from the tax agency.
Fingerprint and Iris Scans Turn Bodies Into Identities
Bloomberg Business
Get the best of Bloomberg delivered to your inbox daily
India’s identity biometrics program is called Aadhaar, which means “foundation” in Hindi. Citizens can enroll to get a 12-digit Aadhaar number, which is issued by the Unique Identification Authority of India. You increasingly need the number to perform transactions, such as opening a bank account, or get services, so citizens are under real pressure to enroll. That number is linked to a central database containing biometric information, including an iris and fingerprint scan, demographic information, and a photograph. India’s government has mandated that people filing their electronic income tax return must link their 10-character permanent account number, which is needed for many financial transactions, to their Aadhaar number.
A migrant farm worker scans her fingerprints to register to receive a national identity card and number in New Delhi, India. Photographer: Ruth Fremson/The New York Times via Redux
Such countries as Tanzania, Afghanistan, and Bangladesh have gone to India to learn more about Aadhaar. Paul Romer, chief economist at the World Bank, has called it “the most sophisticated system” he’s seen. The World Bank’s World Development Report 2016: Digital Dividends noted that “a digital identification system such as India’s Aadhaar, by overcoming complex information problems, helps willing governments to promote the inclusion of disadvantaged groups.”
Privacy advocates have raised concerns about the program, which now has biometric data on more than 1 billion people in its database. A May report by India’s Centre for Internet & Society noted that it had found “public disclosures by four government portals of Aadhaar numbers” and other personal data, but had not found that the central biometric database had been breached.
In August, responding to legal challenges to the biometric program, India’s top court ruled that citizens have a fundamental right to privacy. That has been described as a potential setback in the government’s plan to link more parts of citizen lives, such as their mobile phone numbers and driver’s licenses, to their Aadhaar number.
