1

SENATOR THE HON GEORGE BRANDIS QC

ATTORNEY-GENERAL
MINISTER FOR THE ARTS
ADDRESS AT THE OPENING PLENARY OF THE
CeBIT AUSTRALIA 2014 CONFERENCE

SYDNEY 5 FEBRUARY 2014
Introduction
I would like to begin by thanking the organisers of CeBIT Australia for the opportunity to
speak at what is one the pre-eminent events that brings together representatives from
business, government and the broader community to discuss developments in technology that
are central to Australias future.
It almost goes without saying to an audience like this that information technology is the key
enabler of just about all aspects of life in the 21st century. Unfortunately, it is also a key
enabler of crime and other security threats.
In todays world, the protection of our IT systems and the information that they contain is an
important priority for all governments, as it is for the private sector and the broader
community at large.
As the minister in the Australian government responsible for national security, I am
committed to continuing to strengthen the governments engagement with business to ensure
all Australians have trust and confidence when transacting online that their identities arwill
be secure.
One of the key elements of this work is the effort to combat cybercrime which has been
estimated to cost Australia around $1 billion each year.



2
Delegates to CeBITs Cyber Security Conference will no doubt hear more about these issues
later today. I would like to focus on one aspect in particular, and that is the issue of digital
identity.
This is one of the best examples of an issue that is important both to law enforcement and
cyber security on the one hand, and privacy and digital productivity on the other.
The term identity theft was first coined, apparently, in 1964, but the origins of identity
crime date back much further in fact they are recorded in the Old Testament.
In the Book of Genesis Jacob assumes his brothers identity, by providing false symbols of
his brother Esaus character to their blind father Isaac, in order to receive a blessing that was
intended for Esau.
Fast forward from Biblical times to almost 10 years ago and identity security is
acknowledged as a priority by all Australian governments.
The National Identity Security Strategy
In September 2005 the COAG Special Meeting on Counter-Terrorism agreed to develop a
National Identity Security Strategy to combat identity crime and to better protect the
identities of Australians. This strategy was later formalised by an intergovernmental
agreement signed in April 2007.
The 2005 COAG decision also included the establishment of a national Document
Verification Service to combat the misuse of false and stolen identities. This service was first
funded by the then Government in the 2005-06 Budget and has since received a total of $30
million of Commonwealth funding.
The National Identity Security Strategy was established with a strong law enforcement and
national security focus. This is because identity crime can be used to facilitate all manner of
serious crimes such as money laundering, drug trafficking and even terrorism.
An example of identity theft is what is known as tombstone fraud. Those of you who are
familiar with The Day of the Jackal may recall how the terrorist the Jackal assumed the
identity of a dead person to evade detection by authorities.



3
Despite greater use of technologies such as biometrics and other improvements in our identity
security arrangements, the methods used by the Jackal are still available to criminals today.
The growth of online genealogy research services can make it even easier to obtain the
information needed to commit tombstone fraud, without actually needing to visit a
cemetery.
In 2011 a Sydney man was convicted of a range of offences in which he used fraudulent
identities - obtained through tombstone fraud - not only to facilitate drug trafficking, but also
to sell to his criminal associates who were involved in an outlaw motor cycle gang.
Identity crime is rated by the Australian Crime Commission as a key enabler of serious and
organised crime which in turn costs Australia an estimated $15 billion annually.
In terms of broader impacts on the community, identity crime is also now one of the most
prevalent crime types in Australia.
Today I can announce the results of an identity crime survey conducted last year by the
Australian Institute of Criminology.
This survey asked 5,000 people about their experiences of identity crime and misuse. It
disclosed a number of important findings:
9.4 per cent of respondents suffered the theft or misuse of their personal information in
the previous 12 months.
o 1 in 5 people reported misuse of their personal information at some time during
their life.
5 per cent of respondents suffered financial losses as a result of identity crime.
o The average loss was over $4,000 per incident; ranging from $1 to over $300,000
in the most serious case.
Victims also suffered significant non-financial impacts:
o Victims spent an average of 18 hours dealing with the consequences of identity
crime and more than 200 hours for victims of a total identity hijack



4
o 11 per cent of victims experienced mental or physical health problems requiring
counselling or other treatment, and
o 6 per cent of victims said they were wrongly accused of a crime.
These findings should be a call to action for us all and not just to redouble our efforts to
combat identity crime.
They are also a reminder of the importance of maintaining appropriate security in the online
world in which Australians are spending increasing amounts of their time whether this be
working, studying, shopping, socialising or any of the myriad other things that we can now
do online.
Verified Online Identities
Aside from the direct impacts on victims of identity crime, traditional approaches to
managing identity crime risks can create unnecessary burdens on business and citizens more
broadly.
This is particularly the case when transacting online. The question of identity is now central
to establishing the confidence that is needed to facilitate a range of on-line transactions.
But its becoming increasingly accepted that traditional approaches to managing identities
online are, to put it bluntly, broken.
Many of us know the joys of having to remember multiple passwords.
Recent research by the Australian Communications and Media Authority from 2013 indicates
that the average Australian maintains between 5 and 50 different login and password
combinations to manage their online lives.
Not only are passwords open to exploitation by criminals, they are increasingly inefficient.
Its been estimated that password problems take up between 20 and 30 per cent of all IT
service desk calls.
And that the annual cost of password resets alone is around $1 billion globally.



5
So there is significant scope for savings for business, government and our customers - if we
can improve our management of online identities.
A recent study by the Secure Identity Alliance and Boston Consulting Group estimated that e-
Government services, enabled by trusted digital identities, are set to yield an estimated $50
billion in annual global savings by 2020.
Many governments around the world have recognised that establishing a system of trusted
digital identities can not only help stimulate the digital economy, but also help to prevent
identity related crime.
New Zealand has established its RealMe service in which citizens can use a trusted
government-issued identity credential to access a range of government and private sector
services.
Other governments are engaging the private sector even more closely in these efforts. For
example, under the UKs Identity Assurance Programme accredited private sector identity
providers offer citizens a choice of digital identity credentials that they can use to access
government online services.
At the last election the Coalition committed, in its E-Government and Digital Economy
Policy, to working with the private sector in developing a national approach to verifying
identities online.
And earlier this year the Prime Minister jointly agreed with the New Zealand Prime Minister
to investigate the mutual recognition of trusted online identities.
The Document Verification Service (DVS)
Australias Document Verification Service, or DVS, was originally conceived in 2005 as a
tool to support law enforcement and national security outcomes; however it is fast becoming
a vital enabler of the digital economy.
The DVS enables organisations to verify information on government identity documents such
as driver licences, passports and Medicare cards back to the issuing agency.
DVS checks are conducted via a secure online system, providing a Yes/No response in 1-2
seconds.



6
Privacy considerations are at the forefront of the DVS design. The system is not a database; it
does not store any personal information. All DVS checks must be done with the informed
consent of the person involved.
There are 20 or so government agencies that issue and manage the 50 million or more
government-issued documents that are the foundations of our national identity
infrastructure.
The DVS is used by an increasing number of these agencies.
Id like to acknowledge the role of the NSW Government as being a leader in DVS use
among state and territory jurisdictions. But government agencies are only part of our national
identity infrastructure.

The private sector issues a greater number of identity documents, such as credit and debit
cards, which are often used to prove identity.
Business also performs a range of other important identity security functions, such as the
work of the banks in the prevention of money laundering.
DVS private sector access
The government is working closely with the states and territories and the business community
to expand DVS access amongst Australias private sector - the engine room of our digital
economy.
Im pleased to announce that the DVS commercial service is now operational.
While still early days, there has been strong interest in the service:
over 160 private sector applications have been approved
the service now has 23 active private sector users
the first few thousand private sector transactions have been completed.
Private sector use of the DVS is largely focused on companies in the financial and
telecommunications sectors.
The DVS makes it easier for banks to detect money laundering using fake identities.



7
It makes it easier for mobile phone providers to check the identities of people purchasing
pre-paid SIM cards to help prevent criminals using these phones to mask their activities.
And it also helps ensure the accuracy of telephone account information used for important
public functions like emergency warnings.
The DVS is also an important part of the Governments efforts to reduce the red tape burden
on business by minimising compliance costs that can flow from these important regulatory
obligations.
DVS use for pre-paid mobiles has been estimated to achieve time and cost savings of well
over 50 per cent, compared to other manual processes for verifying customer identities.
Future directions
The Government is working with the states and territories to further expand DVS access
amongst the private sector. This includes businesses with identity verification requirements
under state and territory legislation, such as e-conveyancing, electricity distribution and
working with children checks.
There is also a broader range of businesses which may also find it reasonably necessary to
use the DVS, in accordance with the Privacy Act, to help verify identities of their staff or
customers.
Discussions with industry have already shown that DVS access is helping to drive innovative
new online business models and services, built around promoting trusted digital identities.
Having appropriate privacy safeguards is important for maintaining public trust and
confidence in the system.
The DVS is a clear demonstration that privacy and security need not be mutually exclusive in
the online environment: in many cases they can and should be mutually supportive.
The Australian Government looks forward to reaching agreement with the states and
territories over the coming months on new arrangements for expanding private sector access
to the DVS.



8
Conclusion
In highlighting the importance of identity security, let me conclude by emphasising that
Australians retain the right, enshrined in the Privacy Act, to act anonymously in a wide range
of situations.
Governments and business need to respect this right by only requesting the verification of a
persons identity when they have a reasonable need to do so and then only to the degree
required by the transaction.
Similarly, governments and business should be able to confirm a persons identity when they
have a need to do so to have confidence that the person is who they claim to be online.
As I said a moment ago, the need for identity security and the right of privacy are not
mutually exclusive, and are indeed complimentary objectives.
Tools like the DVS are important enablers of the digital economy, and are also a key part of
national efforts to combat identity crime one of the most prevalent crime types in Australia.
During the course of your conference, I encourage you to reflect on the importance of trusted
digital identities over what promises to be a series of stimulating discussions on cyber
security, e-government, digital economy and related issues over the coming days.
And I wish you well with what Im sure will be a successful, stimulating and consequential
conference.
ENDS