myGovID facial recognition trials slated for mid-2020 – Strategy – Security

The Digital Transformation Agency is hoping to begin publicly testing the facial recognition component of the government’s digital identity credentialing app by mid-2020.

Chief digital officer Peter Alexander revealed the time frame in senate estimates on Thursday, but stressed the DTA wanted to get the all-important biometric feature right before introducing it.

“We would like the biometric to be in by mid-year, but we wouldn’t pressure that,” he said.

“This is about getting it right because the biometric is so important that we do need to make sure that this is successful.”

The biometric refers to the facial recognition component of the Australian Taxation Office’s myGovID digital identity credentialing app. The ATO is the government’s exclusive identity provider.

myGovID, which has spent the last nine months in public beta, currently allows citizens to create a digital identity that can then be used to log into a limited range of online government services.

It currently works like a digital equivalent of the 100 point ID check by using the Document Verification Service and Face Verification Service to verify identity documents like passports, Medicare cards and driver’s licences.

But for citizens to access more confidential services – under what the DTA calls identity proofing level three (IP3) – requires that facial verification and liveness detection – or a proof-of-life test – be embedded in the app.

According to the trusted digital identity framework, IP3 provides “high confidence in the claimed identity and is intended for services with a risk of serious consequences from fraud”.

Since September 2018, the DTA and ATO has been testing liveness detection software from IDEMIA to check if a person is real by prompting them to move their head between a series of points.

But the pair still haven’t finalised which identity proofing solution to integrate within myGovID, with the ATO last month approaching the market for “additional vendor to test their solution against the ATO’s core usability and security requirements”.

“No decision has been made on which vendors and which products will be eventually used for Liveness detection. All options are being kept open,” an ATO spokesperson told iTnews.

“This exercise is about making sure that we have tested and optimised the IP3 experience for our clients.

“The ATO will continue to test multiple vendors and products in order to optimise the available usability and security requirements.”

On Thursday, Alexander said that while the facial recognition component has been trialled with test groups of citizens and has been shown to work, the feature has not yet been used publically.

DTA chief Randal Brugeaud described the approach to the “implementation of the biometric features to ensure the Facial Verification Service operates as expected” as “very considered.

“We are working through a set of technical issues in order for us to allocate an identity which has a biometric anchor,” he told estimates on Thursday.

“We want to make sure that the person that is granted that identity is entitle to it, so we’re ensuring that the quality of the biometric is exactly where it needs to be.”

Brugeaud also revealed that the myGovID app has now been downloaded more than 492,000 times, with a total of 332,421 myGovID digital identities created to date.

This figure is growing daily, as tax professionals continue to shift to myGovID to replace the soon-to-be mothballed legacy AUSkey authentication credential.

myGovID, which is set to move from public beta to live later this month, became the default option for tax professionals to access the ATO’s new online tax agent portal in January.