McDowall JamesDr JAMES McDOWALL (ACT): Thank you very much Mr Speaker. With the risk of turning the debate into a hate on RealMe session I would say that I'm glad to hear I'm not the only one. We are going to give the benefit of the doubt on this and support it to select committee albeit cautiously because we think the direction of travel is right. The intent is right. This is what has been going on overseas and I can understand why they are doing it although I would go about it in a slightly different way. So this bill seeks to modernise identity standards which will in theory give people a choice as to what services they use if they are certified or not. I'm a little sceptical about that but we'll get to it.As I say the objectives are right but one of the main issues that I have with this bill is just the detail. It's the technical detail; it also relates to fees and so on. In terms of how to approach this bill—I've been reading through it and reading through the statements and I've sort of thought Do I come in here as a politician or do I put my IT hat on?" having spent the majority of my career in IT or IT related fields.Barbara Kuriger: A bit of personal experience is always good.Dr JAMES McDOWALL: It is. Thank you Barbara.I've also been involved in a lot of pen testing and security testing cyber-security white hat hacking and all that sort of thing. So seeing the bits and especially in the legislative statement last night about cyber-security left me with some questions that I hope the select committee can have a look at as well. So it intends to provide verification services by implementing standard rules. It'll be opt-in and those that opt-in and meet those and are certified will have to follow those rules or they will face penalties. So this isn't about centralisation of identity as some might think; it is just about rules and standards but it's not completely clear what best practice actually is. Again it is lacking in detail.Regarding the penalties—in the legislative statement tabled yesterday I'll just point out that it was said that there'd be a public warning and/or a cancellation of accreditation if rules are broken. It didn't actually mention that there are in fact quite substantial fines. I think that is something that needs to be communicated quite well through this process so that people who may be interested or organisations that may be interested in signing up are fully aware of what they're getting into.I'm not entirely certain that this will deliver better services at the other end. Proof will be in the pudding. I'm not sure based on the bill if Application Programming Interfaces are going to be used to share data between private and public organisations. And I wonder you know; in theory this could lead to a situation where a Government agency could the police for instance issue a driver's licence on your phone and that would be a trustworthy piece of ID. So is that the direction we're going in? That would be quite interesting for that to happen.Regarding application fees again this is one thing where some more clarity would be nice. It says in the bill in clause 23(1)(d) "be accompanied by the fee prescribed by the regulations (if any)." So it's a fee if any and that the fee whatever it is if there is one may vary in amount over time. I'm sure the committee that's being put together will decide that. So yeah a little bit more sort of transparency around that would be good.I think my concern is that the intent here is right but that the Government is trying to micromanage the economy just a little bit. And in any case look the storing and using of people's private information is a sensitive topic and trustmark or not for lack of a better word any database can be compromised. So what happens then? What does the risk profile look like? Who is accountable if a service provider who has opted in and meets that standard does get a breach and how far does that breach go? What is the interoperability between databases and so on?There are two additional issues I'd like the select committee to examine at a high level. Will organisations actually want to opt into this given there are fines there are penalties because there's nothing stopping them from just continuing as they are at present and operating like that? And secondly will users or the customers actually care if an organisation has a trustmark or not? Because many online services are offshore anyway and they will not be a part of this. If you've signed up to Spotify and Netflix that is not going to come into this. This is the selling point here—you know the this will certify this process the framework you meet those requirements in terms of how you store that data identity and how you share it how you use it and in return with that certification you might get more customers or something along those lines. So this is pretty important to make sure this actually works.So in addition to privacy and security concerns I've had one person ask me "What about visa status?" Being in the immigration shadow portfolio of course I have to slip that in there. So what about visa status? If you're unlawful or if your visa is expiring or your residency or not how does that kind of data information get shared when you sign up to something? I'll just move a little bit to the legislative statement and one of the opening lines in terms of justification for this bill was that some people don't trust current systems and that sounds very anecdotal. I would actually like to know what they mean fully there and what kind of research has gone behind that. Sometimes systems do not yet exist—that was an interesting statement. And the thing about remote use and that was another one of the cases behind this because it increases flexibility in theory and you can prove things digitally; that sounds great. Hopefully it works out. During the pandemic many organisations were able to increase their flexibility. I think of lawyers for instance. They could actually certify documents over Zoom and I never thought that they would be able to do that and certainly not in recent times but that's a possibility. So there is a bit of flexibility out there already. But I do acknowledge that this kind of bill and this kind of framework will make that a little bit easier and a bit less ad hoc.There would be more control over your data—that was another statement yesterday evening. Again just reflecting on my cyber-security background and my white hat hacking—we'll call it that—background I'd like to know what that's going to look like—having more control of your data. So as I said the reality is everything is hackable everything is interceptable etc. Another line is from the legislation: "Opt-in accreditation will allow the digital identity service providers [time] to upgrade their systems to comply with the … rules at their own pace". Yes I get that. My only concern there—devil's advocate—is what kind of pressure will be applied from the State for organisations to actually sign up to this? So you know they'll have time but then will there be a bit of a marketing campaign to try and convince users you know customers in New Zealand that they should be using certified services because they're the ones that are trustworthy and those that don't have it aren't? You've got to be careful of that because it kind of sounds like a bit of a good racket in the making.So I think in conclusion I wonder if we should be doing this slightly differently as they've done overseas starting with the public sector first Government agencies because it makes sense there. And you know rolling that out seeing how the framework is used and what standards are used and what is best practice and then turning to the private sector if they wish at a secondary bill and giving them the option. Because I think what we'll find—and again the Minister referred to banks I think in his example yesterday—is that banks treat customers' information very seriously. And the other thing here is you might have four or five different banks and if they're all operating under the same standards as per this bill you know does just one singular point become you know; you figure one security measure out and then suddenly you can attack all of them? So does it make it better or worse than what they're already currently doing? So we've got some reservations and some concerns but I think the direction of travel is right and we're happy to commend this to the House."