Challenges to a Canadian Identity Policy:

Learning from International Experiences

Krista Boa, Andrew Clement & Gus Hosein

Identity Project - Canada

7th Annual Privacy and Security Workshop & 15th CACR Information Security Workshop, November 2-3, 2006

QuickTime™ and aTIFF (LZW) decompressor

are needed to see this picture.

“We have to have a real debate on this [a national identity card] … we cannot bury our head in the sand anymore. Something is going on worldwide and we have to have that debate. Three years ago we were in the avant-garde, but right now we’re trailing.”

Denis Coderre, “Day Proposes National ID Card”, Canadian Press, February 17, 2006.

What is identity policy?

A comprehensive national identity scheme involves the collection and processing of individual-specific data that will be shared across services, both within and beyond government, often for a wide variety of purposes.

Overview Moving toward a Canadian Identity

Policy Regime?

Implications for the Relationship between Citizens and the State 7 main areas of concern

Conclusions and next steps

Moving toward a Canadian Identity Policy Regime?

Emerging components: e-Passport (DFAIT/Passport Office) Biometric visas (CIC) NEXUS & CANPASS (PSEPC/CBSA) Identity Management Policy Framework (Treasury

Board) Principles of Authentication (Industry Canada) Changes to Existing Identity Schemes (Federal &

Provincial) Western Hemisphere Travel Initiative (US), Smart

Borders Agreement (Canada/US), Security & Prosperity Partnership (Canada/US/Mexico)

Implications for the Relationship between Citizens and the State

Changing an existing policy or implementing a new one can alter how people regard their governments.

Can be positive or negative Choices must be made with care

1 - Political Risks

Public trust is essential Risks to political incumbents

Tendency for public support to decrease over time as policy problems are identified and publicized (Australia, UK, France)

Lack of confidence in governments’ ability to successfully develop and implement the system (UK)

Risks to democratic institutions Attempts to avoid political risk through relying on

international and other obligations (US REAL-ID and EU biometric passports) and avoiding public debate (OSCP)

2 – Multiple, Inconsistent Goals

The purpose of such a system must be clearly articulated

Goals include: Combating terrorism Combating benefit fraud Combating identity fraud and theft Managing borders Supporting private sector with adequate identification

regime Promoting e-Government services

Purpose relates directly to the type of system developed

e.g., combating terrorism v. promoting e-government services

3 - Feasibility of Goals

Can the system be built to meet the stated goals and objectives?

To develop a new database or build on existing ones? (UK, Australian smart card)

As the goals become broader, the feasibility is reduced (Ontario Smart Card Project)

4 - Effectiveness of choices

Are the chosen design specifications and technologies appropriate to meeting the goals?

changes to passport regimes (EU & US) centralised v. decentralised models (UK,

France) implications for other databases (UK)

5 - Costs

Four facets of costs-consideration: costs attributed to design decisions distribution of costs costs burden - who pays? opportunity costs

Costs are often under-estimated in proposals

6 - Who makes the decisions and owns the system?

Federal or provincial (Canada)?

Which ministry within a government? Tendency for primary group’s interests to

have significant implications on design (e.g., law enforcement v. the Treasury)

7 - Privacy and Civil Liberties

Practically every government considers these issues within their policy, but how well they consider it in their design and implementation will influence the level of risk that is likely to arise.

Conclusions

Modern identity policies are highly complex social and technological instruments that must be carefully designed and deployed to avoid or balance the risks outlined here.

A successful policy can be seen as a positive renewal of the social contract.

An unsuccessful policy can be seen as a profound lack of respect by the government toward its citizens.

Next Steps … In-depth analysis of Canadian identity policies and

programs Provide a range of policy options for Canada Workshops in Vancouver, Ottawa, and Maritimes

(December 2006 to February 2007) A final report to the Office of the Privacy Commissioner

in March 2007 A real public debate?

This work is supported by the Office of the Privacy Commissioner of Canada Contributions Program and SSHRC INE Digital Identity Construction Project.

Questions?