January 2008
To one degree or another, verifying identities has always been important for businesses and governments. But in an era when both public- and private-sector services are increasingly dependent on electronic capabilities, the movement of citizens across national borders becomes more fluid and businesses compete on speed to validate transactions and serve customers, verification is more critical than ever.
National ID cards have been touted for years as one way to promote safer borders and more secure transactions. But there has also long been a concern over whether these cards could provide both a high degree of assurance about identities and a high degree of protection for individual privacy. Recent experiences in Portugal, where the government has implemented a new, comprehensive "Citizen Card" program, suggest that identity authentication and privacy are not, in fact, incompatible.
Portugal and its citizens have a long history with ID cards. Decades ago, the government began issuing cards to identify citizens and provide them with a range of civil and commercial services. However, as Anabela Pedroso, president of the national government's Agency for Public Reform (known by its Portuguese initials, AMA), explains, "The success of these ID card programs [had] become, over time, a burden on citizens." Indeed, Portuguese citizens carry as many as five cards—one each for basic identification, taxes, health services, social security and voting. Each card has separate numbers and formats, and each government agency has its own face-to-face and electronic authen-tication processes.
Early in 2006, as part of the government's overall modernization effort, the AMA launched an initiative to consolidate Portugal's disparate ID programs into a single Citizen Card. "Improving our citizens' overall experience with accessing services was one important goal of our initiative," says agency chief Pedroso. "We wanted to simplify administrative processes and make more services available in an electronic or virtual fashion."
But there were other important considerations. "We also sought to incorporate leading-edge security and privacy features that had not been a component of the existing identification programs," Pedroso adds. "Some isolated instances of fraud and forgery had occurred, and we were looking to new technologies to create stronger authentication."
Legal Barriers
The program faced a number of challenges from various perspectives, including technology, governance and constitutional rights. Coordinating multiple government agencies and ensuring their buy-in—critical to the program's success—would require a complex governance model and shared leadership. In addition to the AMA itself, each of the five participating ministries—Justice, Finance, Health, Social Security and Internal Administration (for voting)—needed a voice in the program's design.
Consolidating citizen information and access into a single program meant clearing a high legal barrier. The privacy of Portuguese citizens' personal information is specifically protected by the country's constitution. And in addition to Portuguese law, relevant European Union regulations had to be taken into account.
The Portuguese government also wanted to use new technologies with which it had little previous experience. The AMA turned to Accenture for global program management, as well as for technology and integration expertise. According to Nuno Guerra Santos, who managed Accenture's team: "The technical challenge was related, in part, to coordinating and integrating new technologies in biometrics and integrated circuitry. But it was also related to the unique environment of the public sector: multiple agencies, each with different identification formats and systems, and each rightfully concerned with protecting the integrity and security of citizen information."
The Portuguese Citizen Card program was designed to avoid giving a single government entity sole ownership of all of the citizen data. Instead, information is maintained where it originates: The Justice Ministry is responsible for legal data, the Finance Ministry for tax data, and so on.
To maintain the firewalls between the government entities, Accenture worked with Siemens and Microsoft on the implementation of an interoperability framework that allows identification across all the systems, while personal data remains within the various ministries. The card uses tokens—single-use passwords—that are intelligible only inside their own systems. "The only point at which a citizen's entire ID data exists in an information system is during the card personalization stage," notes Accenture's Guerra Santos. "After that stage the data is removed from the system, and the process is audited."
According to the AMA's Pedroso, "The interoperability framework that makes possible a federated approach to identity management is a truly innovative aspect of our ID program. In fact, we are the first such program to be both highly effective at identity management and authentication and also fully in compliance with European Union regulations."
Portugal's new Citizen Card has been successfully piloted with 16,000 people; plans are in place to roll the program out to 2.7 million people per year, with full implementation expected by 2012. The new card improves security and provides a number of enhanced features, including a secure electronic ID, mechanisms for strong authentication in both online and offline environments, the ability to sign documents electronically, and a biometric validation application contained within the card.
From the citizen's point of view, "convenience is a big plus," says Pedroso. "Citizens do not have to remember multiple user names and passwords, nor fumble with different cards for different purposes."
Multiple Channels
The new Citizen Card can be used across multiple channels. For Internet-based transactions involving government services or online purchases, a citizen relies on the card's authentication or digital signature certificates. Over the telephone, people can use a password or token to identify themselves and receive fast and ready access to information and services. The card is also a physical document that can be presented in person at retailers or government agencies.
The ability of a strong citizen identification program to expedite business process optimization is another benefit already being realized by the Portuguese government. "Internally, we have already improved many processes from this new ID program," says Pedroso. "And this is an area where we expect to increase our focus over the coming years. We believe this program continues to be an opportunity to improve our processes, delivering both cost efficiencies and service improvements."
High-Performance Government
The Citizen Card program is helping the Portuguese government advance toward an objective identified by Accenture's ongoing research as a critical milestone for a high-performance government: citizen-centric public service. The new national ID card means that access to, and delivery of, government and commercial services conforms to the intentions and needs of people—rather than having people conform to the intricacies of various access channels with multiple rules and administrative demands.
From a technology standpoint, adequate testing was critical to the success of the Citizen Card pilot. "Plan and take very seriously the test phase of the project," advises Pedroso. "Once a card is issued, it is too late to fix bugs and glitches. It has to be right the first time."
Compliance with standards is another key success factor, adds Pedroso: "Without basing a solution on international standards, you will be dependent on a single supplier, and will not be able easily to integrate with other systems and countries." For example, Lisbon is currently developing several interoperability projects with other countries that would not be possible if the Portuguese Citizen Card did not comply with major international standards.
Involving all stakeholders—not only the various agencies but also employees at all levels of government—in the program is also essential. Says Pedroso: "We are proud of how we have worked to form a common leadership team among politicians and public servants. We have been impressed by how much could be accomplished in such a short time."
But, she is quick to add, "we also know this is just the beginning of our e-government journey."
Outlook Contributing Editor Craig Mindrum is based in Chicago.
To Top
This Article is Tagged:
Government/Public Service