“The CareCard was designed in the late 1980s,” said Ian Bailey, assistant deputy minister of technology solutions for British Columbia’s Ministry of Technology, Innovation and Citizens’ Services. “There was no photo on the card, just a number and a name, and no expiry date. It was a very weak credential, and while we knew 9 million had been issued, we had no idea how many of the cards were still in play.”
Weak security made illegal practices possible such as selling the cards, especially in communities close to the United States border to Americans looking to access free health care. And on the payment side, poor security made it easy to charge for services without proof such services were actually provided.
Given the lack of security, the potential for fraud, and to improve patient safety, the British Columbia Ministry of Health began searching in 2011 for a way to replace the CareCards with a smarter credential integrating better identity-proofing technology.
The province of British Columbia is no slacker when it comes to e-government. According to a 2012 Stratford Institute study of e-commerce in Canada, British Columbia ranks first overall among all the provinces for its e-government initiatives. “B.C.’s overall first place ranking comes as a result of its dedicated customer-centric approach in providing online services, sharing online information, and encouraging online engagement,” says the report.
Therefore, if the province were going to replace the CareCards, it was going to do it right.
Dave Nikolejsin, now deputy minister for BC’s Energy and Mines, was CIO of the Ministry of Technology, Innovation and Citizens’ Services in 2011. As such, Nikolejsin was working with a senior group of deputy ministers on a strategy to take on some of the bigger e-government challenges.
“We had already tackled much of the cool online stuff like booking a campground, paying for government services online, etc., but we wanted to be able to do more of the things citizens really cared about — the types of interactions that you can only do if you know authoritatively who someone is online,” said Nikolejsin. “That’s where we bumped up against the identity problem. We needed to find a way to do transactions that were more complicated. We wanted a general-purpose way to identify people securely that was reusable across multiple programs.”
This effort eventually brought the Ministry of Technology, Innovation and Citizens’ Services and the Ministry of Health together.
“As we talked, we realized there was no sense in just putting a new, high-quality, tamper-proof health card out there and then issuing 9 million of those like we had the previous CareCard,” said Nikolejsin. “So we combined our efforts. If we were going to solve this problem for health anyway, why not we solve it in a general purpose way and enroll people in an identity service that would work for health and also for any other program where we needed to identify people online?”
The two ministries therefore began planning how they could replace the CareCard with a secure card that could be used for multiple government services. Luckily, Canadian banks began replacing their mag stripe credit cards with chip and PIN cards around the same time.
“Today, it’s rare to find a Canadian merchant or retail outlet that does not use chip and PIN,” said Bailey. “Canadians are now used to using strong security every day. That was a big aspect of making the new health cards a reality. We wanted to make sure the public was ready for more advanced authentication technology, and we saw that they were.”
As the idea of issuing a new, more secure CareCard using chip and PIN technology began to gel, the two ministries had another issue to tackle: how to execute the replacement. They needed a way to positively identify people in person using biometric facial recognition technology, enroll them, and then issue them the new secure credential. For the solution, they turned to the BC Insurance Corp., the Canadian equivalent of a U.S. Department of Motor Vehicles.
“Our drivers’ licensing processing counters already existed, and the Insurance Corp. of British Columbia already had procedures in place to positively identify people,” said Bailey. “They already had all of the machinery needed and all the storefronts for taking photos, as well as contracts in place to create high-quality, tamper-proof credentials.”
New Card Sparks Privacy WorriesThe BC Services Card’s introduction last year sparked a backlash from privacy advocates, who worried the provincial government was integrating citizens’ personal information and creating a national ID card without adequately consulting the public.“If the government has its way, the card will be used not just for access to government services, but also for credit card and as transit passes. That’s a lot of access to personal information,” wrote Vincent Gogolek, executive director of the BC Freedom of Information and Privacy Association (FIPA), last year in the BC edition of the Huffington Post. Both FIPA and the BC Civil Liberties Association criticized the scope of public input for the card, noting that most comments came via email instead of face-to-face interaction. The groups also panned the citizens panel assembled to review the card technology. “The panel will only be allowed to make a limited range of recommendations,” the groups contended in a joint letter sent last August to Andrew Wilkinson, minister of Technology, Innovation and Citizens’ Services for the BC government. “In particular, the panel will not have the option of recommending either the elimination of the combined BC Services Card or of the government’s ID management plan.” In April, BC Information and Privacy Commissioner Elizabeth Denham praised the quality of recommendations from the citizens’ panel, as well as from a group of experts brought in to review the Services Card system. Denham said advice coming from these groups should guide the expanding use of the card. “These consultation reports should be the blueprint, and we will be measuring the government’s future design against the recommendations made by citizens and experts in this consultation,” she said. |
To get a new BC Services Card, eligible British Columbians simply enroll when renewing their driver’s license. People who do not drive can still enroll at the nearest location where drivers’ licenses are issued. Once a person enrolls, he or she is issued a new BC Services Card, or the combined card. Although the cards can be combined, the information is held in separate databases. Citizens must then re-enroll every five years.
As of Feb. 5, 2014, British Columbia had issued 1 million new BC Services Cards.
Privacy was one of the biggest challenges the province faced in introducing the new BC Services Card. Pre-emptively, the three ministries ensured that the government privacy commissioner was closely involved in the project from the beginning.
“Our privacy commissioner was brought along through the whole process, which helped nullify a lot of citizen concerns,” said Nikolejsin. “It was essentially important that we had our privacy commissioner involved from day one.”
Last winter, the BC government also conducted a public forum focused on the BC Services Card and privacy. Citizens were invited to visit a website where they could share their opinions and concerns about the new endeavor. Privacy and civil liberties specialists from around the world were then invited to Vancouver, where they dedicated a couple of days to talking to citizens about the technical solution and the policy framework around it.
The forum also featured a citizen’s panel. Twenty-six thousand letters were sent to citizens around the province inviting them to be part of the panel. Based on the responses, 36 people were selected and brought to Vancouver for two weekends, where they were shown the technology and what could be done with it, and then asked about their opinions and concerns. The information collected is currently being collated and the BC minister plans to issue a report on the results soon.
“We found the citizen panel to be a pretty important endeavor and we learned a lot,” Bailey said. “For the most part, people are behind this effort. I think that 10 years ago it would have been extremely controversial, but not now. People understand what we are trying to achieve — that we are trying to protect privacy and that we are making sure information is portioned appropriately in different segments of public services.”
Nikolejsin said the BC Services Card is actually a privacy-enhancing set of solutions. In other words, if criminals were somehow able to access secure data, they would not have enough information to provide them any further access.
“Just having bits of information cannot elevate your access to the point where you could commit identity or payment fraud,” Nikolejsin said. “Privacy actually ends up better than it was before with this solution.”
In addition to acting as a driver’s license and health ID card, the BC Services Card also provides the foundation to authenticate citizens for a growing number of online services. For example, the education sector is exploring using the Services Card to authenticate students, parents and others who will use the BC Government’s new student information service.
The BC Services Cards also contain a near field communication (NFC) contactless payment chip.
“When we were looking at what chip to use, we were aware of the emergence of NFC in the mobile space, so we decided to go with an NFC contactless chip,” said Bailey. “The price point per chip was very low, and the chip has a whole global industry around it to ensure it’s secure and standards-based, and it is going to have continuing investment. At the same time, NFC readers are becoming more and more available on computers and in mobile devices, so we saw it as a great investment for the future.”
Potential future applications could include contactless transactions and data exchange. BC has a contract with Toronto-based SecureKey Technology to authenticate chips online using the Visa back end.
While the BC government does not yet have services available that can utilize the chip, it expects to soon.
“That’s going to take some time, just like it did on the payment side here. We all got our credit cards with chips in them long before we could use the chips,” Bailey said. “It took a while for merchants to get caught up with new devices and new payment terminals.”
For now, BC will continue to issue the new BC Services Cards knowing they are more secure and less prone to fraud than the previous cards. According to Bailey, it will take five years to issue cards to everyone in the province.
In the meantime, the Ministry of Technology, Innovation and Citizens’ Services is juggling inquiries from other Canadian provinces that are eager to follow in its footsteps.
“We are talking to all the other Canadian jurisdictions about the project and they are interested,” said Bailey. “I think these types of cards are going to be a big part of the future.”
