RealMe faces questions, as digital identity legislation nears

Friday, 1 October 2021

Aplyid co-founder Claudia Smith says big Government-run digital identity solutions have failed right around the world.

Chief commercial officer and co-founder of Aplyid, Claudia Smith, has a list of failed government-sponsored digital identity projects all around the world.

There is Australia, where the government’s Digital Transformation Agency has reportedly spent A$200 million (NZ$209m) over five years developing a central digital identification system.

Then there is Britain, where the government wanted to create one digital identity system to rule them all, invested £175m (NZ$342) in the exercise, but ended up competing with their own tax department.

In the end, the tax department’s bespoke digital identity system attracted 16 million users while the British government’s favoured digital identity option ended up with just 8 million.

* First real estate agency warned for anti-money laundering failures

As more and more vital services move online, thousands of Kiwis are being left behind, mainly due to economic circumstances. (First published September 2020)

* Police setting up $9m facial recognition system which can identify people from CCTV feed

* RealMe accounts can not be verified in two South Canterbury districts

Smith concedes Singapore managed to create a centralised digital identification platform, and invested big money in it, but she notes it has a lot more control over its population.

“Western governments have all tried to do something like that. But without having a national ID card, without it being mandated, without having a great technology platform, then it becomes challenging to get that market coverage, or take-up, to be across everything, and the only provider.

“And then you get the questions of, ‘is that the right thing to do?’. And, does everyone want the government to have control of their identity, that’s then used to do everything.”

New Zealand’s current contribution to this worldwide quest for a digital identity system is a conjoined word, RealMe.

Communications Minister David Clark says he has asked the Department of Internal Affairs to look at modernising RealMe.

However, the Government could also be set to take a greater role in the regulation of digital identity services, through a bill set to be introduced to Parliament later this year.

Digital economy and Communications Minister David Clark says the Government soon plans to introduce the Digital Identity Services Trust Framework Bill, and is also investigating how it can modernise RealMe.

Clark says the proposed law will allow individuals to have greater control over their data, which will also regulate how different identity services work with one another.

Clark and Internal Affairs also want to make sure RealMe fits in with a broader piece of work between Australia and New Zealand which aims to create a single economic market between the two countries.

NZ Post was contracted to market the RealMe service when it launched.

Under the identity services trust bill the Internal Affairs could soon become not just a provider in the market of digital identity services, through RealMe, but a regulator of these services too.

Smith says this, and Government guidance around anti-money laundering compliance legislation, creates the potential for the Government to use its regulatory power to make its own RealMe digital identity service the dominant digital identity verification system, and squeeze out private competitors.

She says this, would be a mistake.

“I would question whether or not there is a need for RealMe, and whether or not the Government should be the regulator, and the police officer, as well as the provider. There’s certainly a question-mark for me there.”

An Internal Affairs spokeswoman says if the Digital Identity Services Trust Framework Bill is to pass, the two functions of regulator and competitor will be separated off from one another.

RealMe was spun off an old New Zealand government project called iGovt, started in 1999, which aimed to give people a central login for use on government services.

Aplyid co-founder Claudia Smith says there is a conflict between Internal Affairs’ role as a regulator and the fact it competes in the market through RealMe.

The RealMe digital identity service owes its red and white New Zealand Post aesthetic to, well, New Zealand Post, which was contracted to market the Department of Internal Affairs-run service.

By 2012 tInternal Affairs was moving to digitise all government forms, and its ambitions had expanded beyond providing a handy login for government services.

A press release from the newly rebranded RealMe service in 2013 announced it would be “a new government-backed identity verification scheme that could let people get a mortgage and exchange contracts on properties without ever leaving their couch”.

The hope was RealMe would allow different online services to verify an individual’s identity online, the example often used by promoters of the service was that traders in a TradeMe auction might use RealMe to verify the identity of a buyer or seller.

Anti-money laundering regulations were coming into force, and there were high hopes of getting more private sector agencies on board by way of using RealMe to satisfy the new rules.

By 2016, 5000 people were signing up to RealMe, which was being pitched as a “digital passport”.

However, gripes around the service, and digital exclusion issues, have also been growing.

Last year Stuff reported on a Citizen’s Advice Bureau report which concluded the “digital passport”, which had originally been intended to open up more Government services to people, had turned into a major barrier.

“While RealMe promises a streamlined digital experience, the reality for many people is far from straightforward,” the report concluded.

Digital Identity executive director Michael Murphy says centralised systems are more vulnerable to security failures.

The chairman of Computers in Homes ran a class of eight people through RealMe’s identity verification, after two days, only two people were successfully able to setup their online identity.

Issues with RealMe are partly how companies like Smith’s identity verification company gets customers. The digital products some private companies provide for verifying customer identities are just easier to use for many companies.

Establishing a customer’s identity has become a painful part of what real estate agents, accountants, and lawyers have to do, all thanks to phase two of the anti-money laundering regulations.

It is too difficult for people in these professions to meet these obligations on their own, so they often outsource their compliance to specialist companies.

While gripes about RealMe have grown, the service’s mission, focus, along with Internal Affairs’ role in running it, has become less clear.

Smith says Internal Affairs appears to not really know what it wants from the service. At conferences within the digital identity industry, the vision of what RealMe should be about differs depending on which Internal Affairs staff member you speak to or hear from.

She says some of those potential conflicts between the government’s regulatory role, and its role as a competitor, are already showing.

A piece of Anti-money laundering regulation guidance released in July, around how companies should interpret identity verification legislation, says an electronic source that incorporates biometric information should be used to verify a person’s identity.

Then, in a footnote, the guidance notes only RealMe is capable of meeting this requirement.

An Internal Affairs spokeswoman says the department eventually wants to make the biometric data RealMe has access to, through its access to passport data, accessible to other private providers, but notes this will require clear rules around access to biometric data.

Smith says the recently-released Anti-money laundering guidance has all the hallmarks of the government, as a regulator, making it easier for its own digital identity service to become the dominant provider, the kind of quixotic quest which has ended in failure around the globe.

She says initiatives to create a single government-run identity system inevitably fails because in a democracy it is a tall order to create one product suitable for a diverse range of markets, companies, and people.

Digital Identity NZ executive director Michael Murphy also warns against embracing “one single identity solution to rule them all”.

Even within the government it can be difficult to aggregate data held by different agencies. Murphy says it is much more sustainable to have a system where there are multiple different ways to prove your identity.

A centralised system would also be more vulnerable to security failures, compared to one where the data is spread out over multiple services.

Murphy’s hope is that the Digital Trust Framework Bill will set out the rules for how different parts of this digital identity ecosystem should work with each other.

“We will have a federated, user-centric model, with multiple components in it.

RealMe is likely to have a role to play within that, he says.

“Exactly what role, I don’t know.”