Transcript: Trust in Digital IDTrust in Digital I

00:00 Dave: Hello and welcome to episode two of the Australian Payments Plus Point of View podcast, in which we examine the theme of trust from all angles. I'm your host, Dave Ellett, Chief Commercial Officer at AP+ and joining me today is Andrew Black, Managing Director of our Digital ID solution, Connect ID. 

Our guest is John Shepherd, the First Assistant Secretary of the Digital ID and data policy division within the Department of Finance. The division includes the Digital ID task force, which is leading work to develop a comprehensive, economy-wide system for Digital ID, including the introduction of legislation and rules and the establishment of a regulator.

John has held senior roles at the Australian Bureau of Statistics and the Australian Tax Office, and is one of Australia's foremost thinkers and practitioners on digital identity and what it means to the everyday lives of Australians. John, Andrew, welcome to the AP+ Point of View.

01:02 John: Thanks for having us.

01:02 Dave: So, John, maybe I'll start with you. It's been a big twelve months for Digital ID in Australia, but before we dive into that, tell us a little bit about yourself, a bit about your background and what led you to the role you have now.

01:15 John: Thanks. It certainly has been a big twelve months and I reflect on that more and more as we get closer to the 30th June. I have been at the Department of Finance leading Digital ID for the last, now just over twelve months. I've been in the Australian Public Service for over 33 years. 

You mentioned I worked in the ATO for quite a long time actually on a range of initiatives, and also had a really good period in the ABS, particularly when COVID hit and data was gold during that period. So, how I came to be leading Digital ID was they were looking for someone to lead the task force last year, someone was moving on.

01:49 I got asked would I come over. My background, I've been leading transformational projects for up to probably the last 20 years, working with industry in particular to understand their processes and look at how we can leverage those in government. So, really focused on those natural business processes rather than having business change their processes to meet government needs. 

A key example of that was the single touch payroll initiative, which I led for three years through implementation, getting legislation and implementing at the ATO that was 800,000 plus employers in Australia had to report differently, had to report every payday as part of paying staff, as part of producing a pay slip out of their system. And then the byproduct was that reporting and that data that's become again so important for things through COVID, like JobKeeper, through ABS, analysis of jobs and wages over that time.

02:41 It's just been a really good example of leveraging what's a natural business process. But to actually get other benefits. And the key benefit for that one, for government and for citizens was protecting the super guarantee of employees because it created visibility that wasn't previously there, that people's super was both being accrued and being paid and marrying those two things up. 

So I've done a few other similar kind of things since then, but that's probably the key one. And the actual Digital ID initiative represented something for me of even greater scale and importance, particularly something I think that's going to touch every Australian, not just every employee and every employer, but everybody, including my kids. And we'll probably get onto that later about some of those personal examples that we need to solve.

03:25 Dave: Yeah, thanks for that. Obviously vast experience there. And as you say, a big busy twelve months around Digital ID and we will start to unpack some of that. Andrew, I'm interested from you. You've been around the Digital ID world for a few years. Just talk about maybe your experience in recent years and the role you've been playing.

03:41 Andrew: Thank you. It's been a journey that I've sort of looked back on and started to connect the dots a bit more recently without sort of thinking about it. But my background's been sort of primarily financial services, but largely in fraud and cybersecurity. So, in the UK, sort of building digital identity products around fraud, around protecting people and biometrics products, and looking actually in the UK, how can we, could we build a digital identity network? 

I then moved to Australia with my wonderful wife, who gave me a pretty straightforward sales pitch as to why Sydney was great and actually saw this very similar market with similar dynamics, but the exact same need for a strong, robust digital identity network. So, been fortunate to be part of Australian Payments Plus and building out Connect ID and for those who maybe don't know what Connect ID is, we're building a digital identity network where you can reuse trusted providers who you already have a relationship with to prove something about you.

04:39 So your bank, instead of having to take photographs of documents and passports and share them online, using your bank to re-log into something or sign up to something. Share that data. So it's a mission that's incredibly close to my heart and how we help protect people, and something I'm very, very passionate about.

04:56 Dave: I think one of the things that, you know, even having you both on today, thinking about the public and private intersection for anything like a Digital ID solution is quite important. And we've got to think about that intersection. I think that we will unpack that a bit later. But clearly, we've all got to collectively work on trust and how we underpin trust for everyone who wants to use those services. 

So, John, I've got another question for you. So, citizen trust is crucial for any successful Digital ID service in Australia. How do you think the expansion of Digital ID services benefit and inspire trust for Australians?

05:31 John: So I'll probably start there with a short story around, it happened a couple of weeks ago. My son's just moved. He's just finished uni and moved to Sydney to rent a little place in Redfern. And as part of that, he and his girlfriend needed a couple of guarantors to go on the rental application for him because he and his girlfriend were both just moving into full-time work for the first time. 

I was sent a link to an app, a rental app, where I started by having to provide three pay slips, my bank statement with transactions, balances, 100 points of ID. It was actually not only a total pain and inconvenient, but kind of thinking, where's this data going? He's one of how many applicants for this property? 

06:12 There's myself, there's him, his girlfriend, his girlfriend's mum, all providing data into this thing. He's thinking he's not going to get a property first go, he's going to have to apply for other properties. So the proliferation of data, I know my wife was saying, I was sitting, actually, at a computer because I had to scan stuff and upload it into this app and you couldn't pass go without updating every single thing. And I'm contemplating loading blank documents with please call me on them and stuff like that to get around it.

But it was just really, just brought home to me this thing about why we need to expand our Digital ID and other services to reduce this oversharing that we're all doing, and also the importance of accredited systems. 

06:52 This app is not accredited. There's no regulator who knows who the data has been shared with, how long it's been stored, how it's protected. I just know there's way, way, way too much data being collected off people. And you're not in control of it. You don't have any choice. You can't pass go. His application wouldn't have even got looked at if I didn't actually do it. I ended up doing it, but it made me feel incredibly uncomfortable.

07:14 Dave: I mean, you talk about there, about all the data that's being shared. I think one of the key things that the kind of industry is focusing on that data minimization, I'd be interested in both of you, how you're thinking about that. Obviously, some data needs to be shared to do a 100 point check. It needs to be shared securely and safely. But you don't want to share more than you need to. So maybe start with you, Andrew, how are you thinking about the data minimization?

07:35 Andrew: I think there's two parts we've got a real challenge for. One is how do we educate consumers to help them understand there's better ways to do that, whether that's solutions, tools, whether the legislation and the bill is seeking to achieve, to give them the rights to do that. One of the other major challenges is businesses and regulators. Right? So there's a little bit of a probably inherent legacy of businesses taking the just-in-case mentality, "Do I need to capture that? - Not sure." Trade off of risk department, compliance department, "We should keep it just in case." Right?

And it's the sort of lore of digital identity instead of actually the law. It's that sort of practise of we should keep it just in case, instead of thinking, what do I need? Frankly, I think the tide is beginning to turn on that and we've seen the last couple of years in the market and feedback from customers and feedback from the bill that actually there's lots of businesses who are actually taking the opposite stance of saying, I don't want it. 

08:32 I want to reduce the amount of data I have to store, I want to reduce my risk profile, I want to give customers control, but reduce that. So I think there's a real education piece to do with different sectors and industries who have sort of inherited practises to just stop and check and stop and check to see if that's the case, and then educating consumers on the tools they can use to kind of have more control over that data.

08:55 Dave: Yeah, it's interesting because on the consumer side, you're worried about where your data is, but on the merchant side or the business side, how much data do you want to hold? Because the cost associated there with the risk of that going out to your business ongoing is higher, much higher in the digital world. So, John, same question to you, though, how are you thinking about data minimization from a government perspective?

09:15 John: I agree with what Andrew said. There's a bunch of L-A-Ws, but there's also a bunch of LORE where people just have always erred on the side of keeping more rather than less. Data storage has been pretty cheap, or it's become cheaper over time as well. But I think if I go back to my first point about what really inspires trust and what trust means to me, if you think about that interaction that I spoke about with the rental application, that's not putting the citizen at the centre. That was not an easy process to follow. 

They were way collecting, it was more convenient for them in that flow to make every applicant collect the max amount of data in one hit. But it wasn't a pleasant experience or an easy experience or a secure experience for the citizen. So they weren't putting me at the centre of that. In fact, it was a horrible process that they put me and every other applicant. But they were putting their needs first, or thinking, let's just collect it all up front and then we can sort it out, because we'll have it all. We don't need to go back and ask for more.

10:11 Like, ideally, if they were looking after me, they would say, just collect the minimum they need to assess my application. Then if they decide that my son's going to get the property, come back and collect that other data then, don't collect it off everybody. So I think it's in that regard, it's how do you continue to think about people and citizen and ease, as well as that minimization principle.

10:33 Dave: I think about the Australia Card, that obviously was initiative some time ago and that had barriers to adoption, and they're probably going to be similar barriers to adoption of Digital ID, you know, the stigmas with consumers and merchants. So, how do we collectively, as the government and private sector, think about those stigmas and work together to change those over time? And how do you think that's maybe changed in the last few years with the kind of move to the digital economy?

10:58 John: That's a real culture piece and look, still a real source of misinformation as well. So we lead a lot of times with saying Digital ID is not a new card, it's not a new number. And I know you picked up the point about the 100 point check, so I increasingly talk about it as a modern form of the 100 point check, which we've all been doing since 1988, except that it puts you in control of the documents. 

You haven't got to scan and send them off somewhere. It allows you to verify yourself once and reuse it, which in the 100 point check, you had to verify every single time, and allows you to prove who you are, say you are in an online interaction.

11:32 So I think that's certainly a key part of how do we move away from that. Our culture in Australia is not to have a card and not to have a single new number, unlike other international systems where that is the case and the government gives everyone an ID card, that's just not going to fit our culture. It didn't back when the Australia Card was mooted, and it doesn't today. 

So I think we've got a good way forward to build on what people have accepted. The 100 point thing that's been around are happy to do with their existing identity documents. We just want to make it easier and make it so you don't have to share all that stuff over and over again.

12:08 Andrew: I might just jump in and build on that because John's absolutely right. And the principles we take forward as to how we take the public on the journey, two of the main ones that are part of the bill, part of what we're doing is around consumers and individuals having choice and also being voluntary. The system, Connect ID is voluntary and having individuals be able to choose whether to use this and also which provider. 

So would I like to use my bank? Would I like to use my government agency, my state or federal government agency? I think that's the way we take people on the journey and make sure that they feel bought in. To John's example of the rental journey, how much better is an experience there where you log on and not only you don't have to provide all the information, but you choose where you want your information to come from. 

And I think that's what I'm certainly hopeful for, is how we take the country on that journey and make it really clear. This is, we think better, we think better for people to have more control, but it is voluntary as a system. And it's ultimately about you choosing your relationships.

13:08 Dave: I mean, I think my sense is that last five years digital economy post COVID, you know, obviously people are much more comfortable using their digital services and therefore providing their ID. But I think what we're thinking about via the public and private is still that there's choice. You're still going to choose to where you want to verify that. 

And I think for me that's one of the differences maybe from where the Australia Card was for where we are now. And I think therefore, my personal view is that consumers are much more likely to adopt this. And I think the kind of macroeconomic factors have also kind of moved that way as well.

13:41 John: There's also, can I just add to that there's also an important comms bit that we've got here, and there's also a vehicle in the legislative framework, which is a trust mark, which we will be allowing accredited providers to use to demonstrate that they've met that highest standard of security and privacy, et cetera. 

So, there's an important role here for us around, all of us around communicating this to users, educating people to look for accredited services, and that that's better than unaccredited services. So I think again, as part of this, how we build trust over time, we'll be getting that message out of.

14:13 Dave: Yeah, I was going to ask you about that later, but things are picking up now. Yeah, I agree. I mean, on the trust mark, I think if a consumer, over time gets used to seeing that, that builds trust in the consumer and it's used consistently, which I know is part of the bill's work, I think that should engender trust from businesses and consumers to kind of drive adoption. So, absolutely agree. One of the things certainly we think about a lot in AP+ is around inclusion. And I know obviously from a government perspective that's super important as well. So, how do we think about Digital ID from an inclusion perspective? And what barriers may we face to that as we think about access?

14:48 Andrew: I think first it's understanding what those use cases are today and understanding who we're talking about. I think making sure that whilst this is called a Digital ID, we don't design for digital only and digital-first journeys. So, certainly what we do is it's understanding all of those examples where those online in-person remote use cases, those who perhaps have difficulty interacting online and designing products and services with accessibility standards, so making sure that everyone can access them, making sure that because this is voluntary, there's always a route for citizens to go. 

But also thinking about those in remote communities, and particularly those for those of our sort of First Nations Australians who don't perhaps fit into today's 100 point check bucket, and making sure that we don't just replicate that system online. It's not about digitising what we are today, it's about truly making it a digital economy and having an inclusive digital economy. 

15:44 So we're working with leaders and those communities, some amazing enterprises and startups, looking at how do we capture unique attributes and making sure we capture sort of whole economy use cases. But for me, it starts first and foremost with consultation and understanding what are the pain points today, what are the use cases where there's perhaps higher barriers to entry and making sure those are baked in as part of any design of service or regulation.

16:11 Dave: And John, how are you thinking about inclusion?

16:13 John: Look, I'll add, and just add to what Andrew said about that consultation, certainly first and foremost, actually listening to community and what some of those barriers are. We've certainly had a lot of great input and feedback through the consultation we did on the bill last year and now on the rules that's been happening. Certainly some of these challenges are not unique to Digital ID. They're more about digital inclusion overall. And I know that we think about these as barriers around accessibility, affordability and ability, the digital ability to be able to do this. So we've got some really good examples. There's some really simple examples.

In our current way, we verify people who use, for example, a myGovID. You can only get a strong MyGovID if you have a passport, which brings us to 53% at the moment of the community have a passport. So, that's already a barrier for some people to get a strong ID through there through facial verification. Another really good example we heard through consultation was in a submission to the Senate Committee from Blind Citizens Australia. 

17:16 And that was a really practical one about not just the fact that we need more than passports and driver's licences, because, again, blind people don't have driver's licences, they have proof of age cards. But also the fact that the current process of taking the liveness test, where you take a selfie with your phone to actually verify back to your passport, is not a straightforward thing for a blind person to get right. So they need voice prompts and other things in there to what is a international best practise.

And they're not things that we currently do, but we need to hear and change that, they're obvious things when you hear it. But that's why consultation and, you know, really taking account of the submissions from some of these groups can really make this a better system. And I'll finish by saying one of the things we also frequently heard through consultation was inclusion is as much about trust as anything else in the system. If you can't make it inclusive, you're not going to get the trust of society either. So I think that, for me is, kind of just really says it.

18:08 Dave: So, loud and clear I hear from both of you, inclusion is really high on the agenda. But inclusion comes with consultation, and we've got to continue to consult to make sure we understand those use cases and we're serving the needs of all the communities that we need to.

18:23 John: Dave, can I just add to that quickly because I think the other point I should have made was our identity system at the moment is not necessarily inclusive either, but this builds on so the source documents is a real challenge, people having enough source documents, whether that's First Nations People, a lot of whom don't have a birth certificate, migrants who don't have a lot of identity documents when they come to Australia. 

So it's getting a start. How do you get a start? So that's one area that we're really focused on, some pilots and things to try to resolve, looking at that undocumented or people with poor source documents, looking at some different ways that we can build trust in the fact they are who they say they are.

18:59 Dave: Great. Sounds like there's a lot happening in that space. So we talked a little bit earlier about, it's been a huge twelve months, particularly for you, John, but I know for you as well, Andrew. So if you look ahead over the next sort of twelve months, kind of what's the big things on the agenda for you? Maybe start with you, John.

19:14 John: So, I mentioned, I think the consultation on the rules. So, the Digital ID legislative framework has the now what's become the Digital ID Act. And I love saying that, the Digital ID rules and the Digital ID standards that sit underneath that is the set of things that spoil it out. So we've been in consultation for the last four weeks on the rules and some of the standards. We'll do more of that. We're doing that in a couple of tranches. So the next set of rules will be consulted on later this year into next year.

We're really, our target now with the legislation passed is the implementation of that, and the target for that has to be implemented by the 1st of December this year, six months from royal assent. So we're certainly working on making sure we've got the essential rules and standards in place. They'll have to be made as legislative instruments in parliament. 

20:04 There's work to do there in terms of the transitioning existing services to the legislative framework that includes the range of Commonwealth and some state and territory services that are currently part of the Australian government Digital ID system. 

And really getting the regulator ready. So ACCC will start as a regulator from the 1 st of December, so them getting their systems and processes ready to take over the accreditation. That's been happening in the interim, oversight authority, which is part of my group for now.

20:30 So there's a bit there. The other big one is as part of the budget, the government has also announced the idea of pilots for verifiable credentials and digital wallets and including potential pilots there with the private sector. So for us, it's how we now start to bring this thing to life, particularly the expansion through things like pilots, but learning through those pilots gradually and then looking at how we can expand into some of those key use cases that I've talked about.

20:58 Andrew: It's a perfect build for our focus for the next twelve months is supporting John and government and consultation and feedback and Connect ID as an accredited digital identity exchange. We're the first digital identity exchange to be accredited or first private sector one, sorry, three years ago, so continue to support there. But for us, the focus is bringing those use cases to life, which I'm super excited about. So, John will be delighted to hear, one of those first ones we've already launched with is a rental use case. So hopefully...

21:24 Dave: He's gonna be happy. 

21:24 Andrew: If he doesn't get the apartment or needs to move again, let us know. We'll try and make that process a bit easier, but we're working with three major identity providers live already. We have CommBank, National Australia Bank and ANZ all live. I'm working with others to bring them on board by the end of the year. But I'm incredibly excited to see this in people's hands over the next twelve months. 

So the core sectors for us are that rental and real estate market we're supporting customers in already, employee onboarding is one we're seeing a lot of interest and demand in, and that employee onboarding journey making that seamless in the telco sector, as well as actually sectors like insurance and also digital skills sort of marketplaces. 

22:06 So peer-to-peer marketplaces online, where I want to verify not only that you are as I am, but you've got the credentials behind it for, is it the plumber, for example, on those sites? So yeah, I'm just very passionate. We've worked on this for a very long time to see this out and live and have Australians be able to use it over the next twelve months.

22:23 Dave: So John, you talked about and it's in the bill over the next two years, the interoperability between public and private sector. How important do you think that is and how you think about that from your perspective?

22:34 John: I think it's a key feature of the system, of Australia Government Digital ID system that we've spoken about and the government's spoken about having that whole of economy focus. Importantly, we talked earlier about choice. So, giving citizens choice of not just a government-provided ID. I mentioned again some of those cultural barriers and challenges that people have about whether they want to use a government ID for all parts of their life. 

We certainly get kind of different feedback on that that people would, you know, would prefer to use an ID of their choice to do certain things in their life when they're not interacting with government. As an example, I think also the importance of that innovation piece.

23:11 So it's very hard for one provider to meet everybody's needs and to be fit for purpose for all the kind of different uses and use cases that we talk about for Digital ID. So that idea of tailoring, I think there's a massive opportunity for seeing providers come forward to tailor their solutions to certain segments of the community, to certain problems. I think they're all the things that I see are important about the private sector, having the private sector involved here as well.

23:40 Dave: And it'd be remiss of me not to ask, Andrew's talked a bit about Connect ID. What's your views on Connect ID?

23:44 John: I'm not sure I've heard of it, actually. 

23:48 Dave: Or heard of the person who's running it?

23:49 John: My views on Connect ID is, it is on our accredited list, so I might have heard of it. But look, they play a part, obviously working and obviously have some good partnerships there. We've been a part of a couple of the events where again, that innovation, thinking about use cases and things, it's been good to see that kind of market starting to evolve a bit. And Andrew's not a bad fellow either.

24:10 Andrew: Thanks John for the glowing recommendation, I'll slip him $20 later. But just on the public-private sector, I think it's not just a nice idea, nice to have. We see it in other markets globally and particularly in the Nordics, where it's vital, right? If we don't have a cohesive, interoperable private and public sector, the country loses out. We create siloed, different fragmented services and we don't realise the societal, but also the economic gains.

So the average sort of log on a bank ID is 230 times a year and an average sort of citizen's life, and that's slightly different to set up and reasons for why. But the potential economic benefit for Australia is sort of three to 4% of GDP if we do this right over the next 10-15 years. So it's fundamental of a choice, but it's not just a nice idea in a white paper, we see other countries doing it really, really well. So there's a track record to get out there and chase down and beat.

25:04 John: It also, I think, Andrew, I think it also addresses in part the single point of failure thing as well. So there's a redundancy or fallback here. With so much to go through these systems, having a range of solutions not only gives choice, but it also gives fallback which we've seen, for example, even with telcos and things, having choice as well as redundancy is really important.

25:25 Dave: Yeah. Helps with the big social issue as well. As we talked about earlier, trust data minimization. I think public and private sector working together around the higher-order challenge is great to see. And I think personally I feel that's what we're trying to do here. So last question for you both. If you think about the future, what excites you most about the next five years, and what do you think or hope will be the lasting impact of the legislation that you're putting in place?

25:48 John: Look, for me, I've said this a few times, but I think I'm excited about not talking about Digital ID and trying to explain it and correct and bust myths and correct misinformation. It just becomes part of what we do. And I think about it. I don't think about how I pay anymore when I go and buy a coffee or I go to the supermarket and pay for my groceries. I just don't think about what I'm using. It's just that convenience of tap secure, tap and go pay for my things. It's just part of what I do.

I don't even think about how I'm doing it anymore. That's what I look forward to with Digital ID and the increased use of credentials is it just becomes natural part of what we do and it makes things easier. And I don't even need to think about is it secure. I just trust it. 

26:30 Andrew: Completely agree. I think as a user I'm incredibly excited at the prospect of never having to scan a photocopy, my passport or driving licence or handed over to somebody and hope it's in some secure filing cabinet somewhere. Being able to reduce the amount of times I have to do that I'm incredibly passionate about and excited about. 

I'm going to contradict the previous answer, but I'm actually really excited for the prospect for Australia as well because we often reference Canada or the Nordics and these examples of what's gone really well. But actually in five years’ time I hope Australia is the global leader and they're referencing us. We've got the perfect platform.

27:05 Not just Connect ID platform, but the perfect platform as a country, regulatory environment. Buy in from private and public sector and that opportunity to have a real hybrid ecosystem I think puts us, you know, with a phenomenal opportunity to be a global leader and have bank ID knock on our door and say, "How have you done that?" I think that's very possible in the next five years, and I'd be very excited at that prospect.

27:27 Dave: I forgive you for shamelessly pushing Connect ID, but thanks for that. It wasn't lost on me. But in closing, John, Andrew, thank you very much for joining me today and talking about trust, particularly as it relates to Digital ID. I know the listeners would have got a lot of valuable insights from the discussion and really interested to hear how public and private sector are working together over what's to come over the next 12, 24 plus months. So thank you very much for your time today.

27:55 Andrew: Yeah, thanks for having us. Thank you.

27:56 John: It's been great. Appreciate you inviting me on.

28:03 Dave: Thank you for listening to the AP+ Point of View podcast. Be sure to share it with your colleagues. For more information and the latest news and views from Australian Payments Plus, visit www.auspayplus.com.au and follow us on LinkedIn.