Ontario Smart Card Project: A Critical Exploration

1
Ontario Smart Card ProjectA Critical
Exploration

• Andrew Clement
• Felix Stalder
• Tamy Superle
• Ana Viseu
• Information Policy Research Program
• Faculty of Information Studies, University of
  Toronto
• http//www.fis.utoronto.ca/research/iprp
• May 3, 2001

2
Introduction

• Original idea evaluate the smart card proposal
• Surprisingly little information available
• Reoriented to find out the basic info and
  understand the process
• Overview
• Making sense of the OSCP (Ana)
• Interpretations and issues (Felix)
• Future directions (Andrew)

3
Making Sense of the OSCP 1Public/media Views

• Concerns over ID card
• Will hold all your information
• Surveillance
• Makes tracking easier
• Biometrics
• Finger / retinal scan
• Database linkages

4
Making Sense of the OSCP 2Privacy
Commissioners Views

• Federal Privacy Commission
• Warns of slippery slope from access to
  universal ID card and internal passport
• using biometrics to identify us. They seem to
  think that's efficient. I think it's outrageous.
• Information and Privacy Commission of Ontario
• Member of External Advisory Council
• Concerns, but not fundamentally opposed
• Biometrics, only with greatest caution
• Public consultation with privacy impact
  assessments!

5
Making Sense of the OSCP 3Ontario Government
View

• In the not too distant future, the smart card
  will be one of the government IT solutions.
• Nothing has been decided yet. Everything is
  still being considered
• Official beginning Speech from the throne, 1999
• March 2000 formal direction by Cabinet
• Developing implementation framework and a
  registration process

6
Making Sense of the OSCP 3Ontario Government
View (cont)

• Rationale
• protect privacy
• reduce fraud
• new electronic service channels
• create efficiencies by reducing duplicate
  registration for services

7
Making Sense of the OSCP 3Ontario Government
View (cont)

• Possible applications
• government funded health (current focus)
• the Ontario Drug Benefits Program
• drivers licenses
• proof of age
• organ donation instructions
• social assistance

8
Interpreting the OSCP 1 Machiavellian secrecy

• The government has a strong scheme in mind that
  it will drop on us when everything is in place
• Public concerns will have no time to coalesce
• This government has a history of this, even in
  the privacy area

9
Interpreting the OSCP 2 Confused retreat

• The project turned out to be much more
  complicated than first anticipated
• Recent change in senior staff.
• They really dont know what to do and are afraid
  to reveal this
• Other smart card projects suffer this fate

10
Interpreting the OSCP 3 Timid diligence

• Lots of serious work going on, with real concerns
  for surveillance and privacy issues
• Because of sensitive issues and a critical
  press, very low profile until things sorted out
• Normal government procedures inhibit open
  disclosure

11
The current picture

• Secure access card stores little personal
  information, serious concern with privacy
• Private key in PKI system?
• Registration process one person - one card
• Biometrics unlikely, for now.
• No plans for public consultation

12
Emerging issues

• Difference between access and ID card?
• Mission creep
• infrastructure and application(s)
• Long-term, incremental development
• No clear rationale (will it reduce costs?)
• Profound dysfunctional obscurity
• Emphasis on administrational efficiency

13
Re-conceptualize the card

• Adopt perspectives of the citizens/users
• Optional attractive enhancement to service
  transactions
• Provide
• Clear, relevant functionality
• Ease of incorporation into everyday activities
• Verifiable assurances of privacy
• Anonymous authentication, multiple independent
  pseudonyms
• Reader authentication and audit

14
Transparent citizen engagement

• Be open about the process
• Make all relevant information readily available
• Broaden representation in public consultative
  bodies
• Welcome, dont stifle, debate
• Involve the citizenry at every stage
• Goal setting
• Card prototyping in realistic use settings
• Follow-up assessment

15
Summary conclusions

• The positive potential to use ICTs for effective
  access to government services is marred by
  unrealistic ambitions and excessive obscurity
• High risk of failure
• Shift approach
• Citizen rather than business approach
• Trust Ontarians - engage them in the process!
• http//www.fis.utoronto.ca/research/iprp