Your Facebook user name and password can log you onto hundreds of third-party services, but good luck trying to claim Employment Insurance with them. A Twitter handle is similarly ineffective to electronically file your income taxes. If you have a bank account, on the other hand, chances are you already have a more streamlined way of accessing all manner of public sector programs without even being aware of it.
Amid all the talk of startups at last week’s Canada 3.0 conference in Toronto was an afternoon session called “Approaches to Solving Enterprise Cyber-Security Challenges.” The real focus, however, was a rare glimpse into identity management programs in the public sector, including some of the decision-making behind the Treasury Board’s launch of the Credential Broker Service late last year. This is part of what is known, federally, as the Cyber Authentication Renewal Initiative, a massive undertaking that could radically change the way citizens connect with the government online.
So far TD Bank and a few other institutions have joined the Credential Broker Service, which uses technology from Toronto-based SecureKey to log citizens into government portals using the same credentials as what’s on their bank card (or swipe it) along with their banking password.
“We wanted to find a solution that would cost us less as a government,” said Rita Whittle, a senior director at Treasury Board Secretariat’s CIO branch who has been working on the Cyber Authentication Renewal and Federating Identity project. These are still early days, but she suggested those costs are falling from approximately $50 million to $20 million as a result of the new approach. “We’re also focused on remaining engaged with citizens. We don’t want to become stale.”
The government has tried to improve identity management in the past, of course, and has learned from those early efforts. “We’ve had to walk away, sometimes painfully, from initiatives such as Secure Channel,” Whittle admitted, referring to a project widely criticized for its failures. “It was a challenge because there was still the issue of, ‘We’ve forgotten our user names and passwords,’ and having to do the recovery process. From a maintenance perspective, it becomes a little tiresome.”
The Credential Broker Service should avoid such problems by working through online identity information already collected by the banks. However SecureKey’s technology is designed to work in such a way that the government won’t know which bank’s credentials you’re using, and the bank won’t know which government services you’re accessing.
“We knew that our clients would not necessarily jump at the opportunity to use their online bank account passwords,” Whittle said, which is why the government will continue to provide its own credential for those who prefer it. “What we want to re-emphasize is that you now have a choice.”
John Tarnowski, associate vice-president, North American Money Movement (Online/Mobile) at TD Bank Group, said the main advantage for the banks is validating the credibility and trust they’ve already established with their customers.
“The way TD looked at this was from the convenience and comfort standpoint,” he said, pointing out that on average, people log into their online bank accounts up to twice a day. “It should be easy to extend that (logging in capability) out to them for other things. This is a foundational pillar for us.”
If the government is counting on the trust Canadians have in banks, the banks need to count on something to maintain that trust. The answer is obvious: as long as they continue to invest in the technology that supports strong, secure, reliable performance across their IP networks, they will continue to reposition themselves as the gateway to all manner of online transactions. This is new for the private sector in this country. Downtime will no longer threaten just their own reputations as businesses. It means the government will look like it has chosen the wrong partners. Neither sector can afford to have Canadians lose faith.
Develop the most secure network possible by downloading, ‘Planning Security Budgets,’ a white paper from Allstream partner Arbor Networks.