﻿ I have to get a new passport and I have
two expired passports from different countries . I'm going to apply for both of these at the same
time and have a... passport race.
So I’m going to have this passport race between New Zealand and Canada to see one
is better at providing this basic government service that most people in a country will
need at some point during their life. Oh my god, it’s Paige from the future,
jesus fucking christ. I’m still waiting on one of the passports!
The Problem The big issue,
the first and most obvious issue hits you on form PPTC 054 immediately.
Have you ever noticed how obsessed the government is with your mothers maiden name?
Well that’s the government trying to verify that you are a unique person.
There are many Robert Smith's in Canada, there may even be a Robert Smith born on the same day,
in the city, but all of that and the mother’s last name?
I mean the mother’s last name really dates the system. Traditionally this would be a
different name to yours and unknown fathers are more common than unknown mothers.
Your first name, last name, your birth date, your place of birth and mother's maiden name
are a very long unique identifier for you. And with that information, the government workers
can pretty much pinpoint everyone and that would be fine if it was the 1950s still.
However it's not, and repeating this information again and again to match
me to a database that the government has wastes tons of time and is really insecure.
If only that was a convenient universal identifier for you and the government to communicate.
Oh wait, there is. But it’s shit, it’s called a SIN number.
Now with just one small number we CAN let the government know who we are,
and that would be fine if it was a 1980s, however it's not
and now anyone can use a short string of numbers and our name to basically ruin our lives.
You see, even though they legally shouldn’t, many organizations still ask you for your
social insurance number because that is the standard universal identifier for a person
here. What else you going to use. But they constantly ruin people's lives, because.
Here are a series of numbers, by random chance alone one of these numbers probably
belongs to a Canadian citizen. It's so insecure and should never have been used
for anything except internal record keeping. Now if you don't like the idea of being a number,
you already are but in a less convenient form.
So what is the modern, Circa fucking, 2007 standard for this?
Well the first thing that you notice about the passport renewal process in New Zealand,
was the fact that you could log into it using this thing called “RealMe”.
So you know how you can log in with Google, Apple, or Facebook? Well in New Zealand, you can log in
with this government login called RealMe. You create a username, you prove that you are
who you say you are, and that you live where you say you live.
ONE TIME! And then you use that service to log in
and fill out forms across the entire government. And not just national government things like a
passport, you can literally book a government building using the same system. And I did.
Now obviously that saves the government departments money every year. You aren’t
building the same system again and again, for every single government department.
So the smallest library in the smallest city in some shithold in New Zealand
“Dunedin, like very other south island town it’s a hole”
Can leverage the login system of the national government to make sure you
can actually take out a copy of “How to Talk to Your Cat About Gun Safety”.
It saves you time as well as well, you’ll never write your fucking mothers name
again. Which is especially great for the woke members of my audience. Who
says a woman can’t walk out on her family! You never have to send another copy of your ID,
or print a utility bill or fill in your place of birth again and remember that extends to
everything from banks and universities to passport renewals like I did.
When you use it on a service you can decide what you want to share, just your name, or your
birthday, your government verified address. You’re basically saying to the a government “OK,
I give you permission, let these guys know where I live, let them know what my name is”
And all this is secure. password protected for the modern era and backed by 2 factor
authentication. Doing it once, the right way, means that every government service that uses it
also gets those benefits. None of those flimsy and deeply
flawed “What was your first pet’s name?” questions which are the online security equivalent of the
rhythm method. Enjoy your new child! Also, no uncertain answers to questions.
I mean was my best childhood friend really Scott? I mean, Nathan was the first,
is that what I would have written? But then I mean, scotts really come
back into the fold. Next in line please.
Passwords are the minimum now. If you find out that someone has figured out your password,
maybe they do a little bit of damage and then you can get it reset. But if you find out someone has
figured out knowledge of your childhood, you can't change that, you were born there, that was your
first pet's name. Research shows that many victims of identity theft are actually being targeted by
members of their own family for this reason. So with a password you just reset it,
and it’s something that you keep as a secret, no-one else knows that.
A single sign on is especially good because there are simply too many places to secure,
every bank account, every phone company, every Health Department, or utility company.
But now across Canada a flimsy set of numbers, like your passport number or your healthcare
number and they unlock your identity to the world. And this is because the government
hasn’t stepped up and filled that void with a real authentication service for citizens.
Fixing This I wanted to figure out how New Zealand
got to the point, so I called them up. Hilariously small country stuff.
“Is this the prime minister?” “Yup!”
I interviewed Tim Waldron who is a manager at RealMe. And he answered
lots of questions that I had. Thanks Mate! According to Tim in the early 2000s New Zealand
was actually looking at Canada to see how to do online services for the government. Canada was
seen as a leader in this space, at the time New Zealand didn’t even have Lord of the Rings to
its name let alone “broadband internet”. The New Zealand government created the “2000
E-government Strategy”[1] that identified logins as a key project and now with 5.7 million logins,
in a country of 5 million citizens. It is a ubiquitous standard.
So how did New Zealand end up beating Canada to the basic building block of e-Governance,
a secure digital ID? Well that plan did include creating
a government login system The obvious first big user was the New Zealand equivalent of the CRA,
allowing them to ditch the insecure SIN number problem that New Zealand also had at the time.
But critically built into these early plans was consultation and citizen involvement and
that's probably even more important than having the login system specified. That
iterative process allow it to to evolve with the times and move away from being a “tax department
login” as the internet grew and changed. They were just very focused on making it useful
and good, treating citizens like customers. So to this day they still bring in focus groups of
citizens and ask them what they need and make the changes, and then they repeat that process.
Just constantly making sure, that they thing that they’re doing actually meets
the needs of New Zealand citizens. It was weird hearing a government official
saying “Customer centric design” so much, and you can see the impact of this even in the name.
It started off as the “Government Login Service”, which became igovt, which finally became RealMe
in 2013. At first glance you wouldn’t know that it was a government department at first glance. It
looks like a private sector enterprise. The name changes reflect society,
it becomes friendlier each time. This is through putting people in a room, and asking them,
hey what do you want?[2] And then just figuring out how to fucking do it.
God god, is it really as simple as making a plan that values citizens, and then executing it?
Yeah it is. Yep, but here’s the real surprise,
there is a place in Canada already doing this. So what Canada does have, and this is at the
Federal level, is the CRA login, but that is very minimal and can only be used for
tax and business related things. Canada has a GCKey, but it doesn’t let
you login to the CRA or passport services, which are the most common interactions that
Canadians have with the federal government. And there is a more universal system, but but
because the government didn’t work with Canadians and step up to the plate of providing the solution
it has been instead filled by the banking sector. Oh banking sector, it’s been a while.
Instead of allowing you to sign into your bank with your government login,
you instead can sign into your government with your bank login[3]. They’ve created a for profit
organization called securekey and verified.me which look on the surface like RealMe but that’s
much less useful, not accountable at all to citizens and has a total agenda[4][5][6].
Our government is stuck in a half-outsourced state for its single sign on government
authentication system. Canada is the country where
the government still operates liquor stores but has outsourced checking your identification.
But, there is hope. I went province by province and looked
at the login services for the various provincial governments and how you do a range of things.
Pay Taxes, Fines, Drivers Licenses, Health Records, Municipal logins.
So for the small provinces, they all suck, all of them. Many of them have just, dead links and 404s
half the websites look like they were designed as a favor by someone’s uncle Tim Tables.
TD ROWSPAN As you click around you bounce
from one decrepit dated design to another in this frankenstein's mixing bowl of stitched together
government services. It’s not a surprise they don’t have the vision to set up a login system,
they can’t even follow a design guide. Worst place Ontario,
you get caught, you just cancel the check. Ontario has One-key, and you can login to pay tax,
register a business. That’s it. No healthcare records, no federal integration, still using
a “Security Question”[7] I was surprised at how crap our largest province was.
Get it together Ontario. In the middle are two provinces,
starting with BC. In BC there is a thing called the BC Services Card... App,
it has very few things attached to it. But say you want to register a business, you have to
ironically use OneStop, or you can Login with your BCeID which can be used for that and a lot
of less common services like adopting a kid. The fact you have to pay for your license renewal
in BC at an office and the road test is this form where you get given a codeword that is “Sometimes
Your Mothers Maiden Name” for example, is a disservice for what is probably Canada’s most
technologically advanced province. BC’s problem is it’s all over the show with
multiple single sign ons systems. If they unified behind one thing they’d probably
be in first place. But instead you’ve got,
I don’t know what’s going on. Get it together BC.
Quebec has a slightly different problem,
there is a login system that’s been around since 2005. It has address verification,
it has logins for tax, it even gets you health records but that is where things fall apart.
It has a different problem to BC. It’s not that it has too many competing logins,
it’s a problem of having stalled out under the existing login system. The system is dated, and
stuck in a paradigm that’s very 2000s. But on the good side Quebec is in the process of modernizing
it[8] with the new Quebec Digital Id and the new department of Cybersecurity and Digital[9].
Yes it’s just called crypto security and digital.
And it makes you go like Crypto security and digital,
no that’s it, OK great! So I’m feeling a little bit more
optimistic about Quebec. Let’s go Quebec!
But there is one province that is already doing things right.
Scoring twice the number of points in my spreadsheet ranking is Alberta’s MyAlberta.
My Alberta digital ID or MADI for short is a digital tool that we use in Alberta for albertans
to authenticate who they are and login safely and securely and then use that as a single portal
to interact with a growing list of eservices giving them more choice and convenience.
Following right, is On. If it lets you verify,
login to tax stuff, register a business, get health records, signup for student services.
Right On And even in some cases that might be
with Canadawide services , Albertans can actually link with the federal system to authenticate
and access things like the Canada pension plan, employment insurance, old age security etc.
I was so happy to see a province in Canada showing us how to do it.
Yeah well this has been in the works for a very long time it was first
implemented in 2015, I guess we would be the 3rd government to be working on this.
It’s amazing how much milage you can get out of just executing a reasonably solid plan.
One of the things that Alberta has done right is the login is an independent thing
setup by the ministry of service. As the minister of service alberta whose
responsible for the digital backbone of government and responsible for the
MADI tool I’m really excited look for every opportunity to expand
the list of services that Albertans can access through this tool.
The game plan if you're a government in Canada is to set up this structure.
And give the bureaucrats a long-term strategy that self corrects as technology changes.
As long as you’re focused on continuous improvement.
Secondly, spin the system into a separate entity whose job is to make a useful
service that anyone can use. If it’s useful, institutions in your society use it.
A big focus for me is to try and get to the point where every Albertan wants to have a MADI account
because the value that it offers them is just so great that they can’t say no.
Now when I tell people about this obviously their eyes glaze over, oh what is it you’re angry about
this week Paige? Painting bricks is it?[10] Oh no government logins. OK.
But it’s just a matter of time before that complacency bites
them in the ass. I see it all the time. Maybe you’re trying to book a vaccination
appointment but you’re entering the same details in seven times, because
the stupid fucking form keeps clearing. Maybe you’re experiencing some chest pains but
you’re worried about going to the hospital because you lost your healthcare card.
Maybe your passport got stolen while traveling and you’re stuck there trying to
figure out the Russian word for “fax machine” thinking, god, can we not do this better?
The worst thing is a lot of the time citizens do absolutely everything right and the problem still
comes back to them. In 2017 over 160 million citizens of the US[11], Canada and the UK[12]
had their data stolen during the Equifax breach. If you're watching this video, and English is your
first language, there's a one-in-three chance that your personal information is sitting on
some hacker's hard drive somewhere. That data has never surfaced for sale.
It’s a ticking time bomb that could be unleashed at any time to get passports, credit cards and
to undermine our societies dated methods of verifying that we are who we say we are.
We've had years to prepare, years to repeal and replace the old way of doing things,
but our governments don’t do anything about it because we don’t hassle them about it.