Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p1
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 1/17)
Character Range: 139900–143019

14               Authenticator levels to be bound to a digital ID                                                                                                                                                                                                      AL1, AL2 or AL3  AL2 or AL3                                            AL2 or AL3                                           AL2 or AL3   AL2 or AL3  AL3

Note 1: For item 2, the checks undertaken by the ISP may be done through checking the ISP's records for a digital ID with the same attributes.
Note 2: For item 6, the checks undertaken by the ISP may include checks against the ISP's registers of known fraudulent identities.
Note 3:  For item 14, see the Accreditation Data Standards for the requirements to be met before an authentication level for a digital ID can be asserted.

5.11  Verification using an Australian passport
 (1) For items 10 and 11 in the IP Levels Table, if an Australian passport is being used for identity proofing for IP Level 3, that credential can be used simultaneously to satisfy the requirements both for a CoI credential and a photo ID.
 (2) For item 10 in the IP Levels Table, if an Australian passport is being used for identity proofing for IP Level 4, that credential can be used to satisfy either the requirements for a CoI credential or a photo ID, but not both.

5.12  Technical verification of credentials
       If an ISP is using technical verification to verify an Australian passport or a foreign ePassport, the ISP must:
 (a) comply with the sections of the ICAO Doc 9303 Standard that apply when using remote public key infrastructure to verify an ePassport; and
 (b) for an Australian passport, review the certificate revocation list, published by the Department of Foreign Affairs and Trade, to establish whether the passport has been cancelled; and
 (c) for a foreign ePassport, if the issuing country publishes a certificate revocation list, review that list to establish whether the foreign ePassport has been cancelled.
Note: At the time these rules were made, the certificate revocation list for Australian passports was located at https://www.passports.gov.au/australian-country-signing-certificate-authority-csca.

5.13  Source verification using non-government credentials
  If an ISP is using a document or other credential issued by an entity other than an entity covered by subsection 50(3) of the Act, the ISP must:
 (a) use approved cryptography to establish a trusted and secure connection with the authoritative source for that credential; and;
 (b) ensure the document, other credential or attributes, being verified are current.
Note: Entities covered by subsection 50(3) of the Act are government entities.

5.14  Visual verification
  An ISP must:
 (a) for visual verification of a document or other credential—ensure visual verification is conducted only by personnel who have been appropriately trained to conduct such verification; and
 (b) not use visual verification if source verification or technical verification has been conducted and the result indicates that the document or