Privacy and Identity in the

Mobile Landscape

Professor Margaret Jackson

Presentation to the Smart Services Forum

September 2006
Aim

ƒ My aim is to bring together findings of two

research projects on the theme of privacy,
trust, security and identity.
ƒ Case studies on the adoption of wireless technology
ƒ How people manage money and how they bank

ƒ Then relate these findings to mobile banking.

Privacy and Identity in the Mobile Landscape Slide 2

Defining Some Terms
ƒ Privacy

Focus is on ‘personal information privacy’ and can mean both

‘non-disclosure of personal information’ and ‘control over the
use of one’s information’.
ƒ Identity

The other side of privacy. How do businesses identify to whom

they are providing goods and services? How much information
is enough?
ƒ Security
Some customers confuse ‘privacy’, ‘identity’ and ‘security’.
Security for many is control of access to financial information
and account details.

Privacy and Identity in the Mobile Landscape Slide 3

Wireless Case Study

ƒ 14 case studies of wireless technology have

been completed.

ƒ We mapped the wireless landscape not in

terms of the wireless technology used, as
many studies have, but by focusing on the
type of product or service wireless technology
can deliver.

ƒ We chose projects which fell into three

categories of wireless mobility:

Privacy and Identity in the Mobile Landscape Slide 4

Wireless Case Study cont…
1. M-Commerce – consumer transactions
(including sales of goods and services), using
a mobile phone or the Internet accessed via
wireless

2. M-Services – services to individuals and

organisations, such as banking and wireless
communications in health

3. M-Enterprises - enterprise solutions, such as

logistics applications or supply chain
management solutions.

Privacy and Identity in the Mobile Landscape Slide 5

Who We Talked To
AREA SIZE ORGANISATION TECHNOLOGY STATUS

mCommerce Small Publisher of Guides – SMS Shelved

transfer content from hard
copy & Internet to phones

mCommerce Large Telecommunications – Mobile Phones Shelved

using a mobile phone to buy
cans of soft drink

mCommerce Small Wireless Solutions Provider Mobile Phones Implemented

– Providing Tickets to Mobile
Phones
mEnterprise Large IT Storage Company – Wireless PDAs Implemented
Storing Data from PDAs
mEnterprise Large City Council – CCTV Wireless CCTV Implemented
mEnterprise Large Water Supply Company – Wireless In Development
Providing Onsite Dispatch
Maintenance for Water Pipes
mEnterprise Large Gas Supply Company – Wireless Implemented
deliveries of gas Dispatch

mServices Small Dentist – Reminding Clients SMS Implemented

about Appointments
Privacy and Identity in the Mobile Landscape Slide 6
Who We Talked To cont…
AREA SIZE ORGANISATION TECHNOLOGY STATUS

mCommerce Large Bank – Recharging Mobile Phones Implemented

Mobile Phone at ATMs
mServices Small Mortgage Broker Wireless Laptops & Implemented
Services – Online SMS
Mortgage Applications
mServices Large Tertiary Education / Wireless PDAs In Development
Hospital – Medical
Records
mServices Large Tertiary Education – Wireless PDAs & Implemented
Course Materials Mobile Phones
mCommerce Large City Council – Paying for Wireless PDAs & Implemented
Parking via a Mobile Mobile phone
Phone
mServices Small Private Taxi Group – Wireless Dispatch Implemented
Bookings and Payments & Mobile Phones

Privacy and Identity in the Mobile Landscape Slide 7

General Findings
ƒ Most of the media articles about wireless projects
are misleadingly positive

ƒ The same problems with implementation of

projects occur in different industries/sectors but
there is no exchange of information about
problems across sectors.

ƒ Many are keen to use the technology but are

struggling to find a compelling business case.

Privacy and Identity in the Mobile Landscape Slide 8

General Findings cont…

ƒ Implementation of wireless projects has been

harder than expected.
ƒ Once started, the major issues are with the
technology and with integration with existing
systems.
ƒ In some cases, computer security is not well-
handled and is often a late add-on.
ƒ Projects with mobile phones collect the most
personal information.

Privacy and Identity in the Mobile Landscape Slide 9

Regulatory Findings
ƒ No real understanding about how the Privacy
Act operates and to whom it applies.

ƒ Hard to know which act applies to some

activities eg, is a telecommunications
company which supplies credit a credit
provider?

ƒ Changes to regulations and policies can

disrupt projects eg NSW police and CCTV.

Privacy and Identity in the Mobile Landscape Slide 10

What Else do the Case Studies Show?
Replacing a paper-based process:
These projects have generally worked well
ƒ Gas deliveries and demonstrated a strong business case.
ƒ Maintenance of water pipes While there are some privacy issues, most
ƒ Taxi bookings and payments are built into the implementation plan from
ƒ TAFE course notes the start.
ƒ Medical records
ƒ Storage of data from PDAs
Using a mobile device to do a small transaction: There is usually limited take up (if they move
past the trials) and privacy and identity
ƒ Parking and infringement warnings problems in that a lot of information is
ƒ Recharging a mobile phone account at collected about the customer, well in excess
ATM of that needed for the service. The projects
ƒ Purchasing a can of soft drink are ‘a good idea and we have the technology’.
Adding value to existing services to customers:
Seen as a service by the customer and as an
ƒ dentist appointments extension of other services
ƒ tickets
ƒ mortgage broker
New Activity
Some issues with these
ƒ CCTV
ƒ Content

Privacy and Identity in the Mobile Landscape Slide 11

Banking Project
ƒ Interviewed 79 people from a range of
backgrounds.

ƒ Asked them:
ƒ How they managed their money?
ƒ How they bank and pay accounts?
ƒ How they handled the online environment?
ƒ About their relationships with their bank or building
society.

Privacy and Identity in the Mobile Landscape Slide 12

 Our Interviewees
ƒ 31 men and 48 women. This dominance of women
was partially explained because women manage
money particularly in the lower income
households;

ƒ Participants were aged between 18 to 80 years

ƒ We had a range of annual household income

levels: 15 had an income below $25,000; 18
between $25,000-49,999; 12 between $50,000-
$74,999, ten between $75,000-$100,000 and 20
had over $100,000 a year. Four participants did
not want to disclose their household income;

Privacy and Identity in the Mobile Landscape Slide 13

Our Interviewees cont…
ƒ Twenty-three participants had a Certificate or
lower educational qualification, 51 had a BA or
higher degree, four had other qualifications
and one did not say;
ƒ 49 used Internet banking;
ƒ 15 people used the Internet but didn’t bank
online; and
ƒ At least 50 people had a mobile phone and 3
used them for mobile banking

Privacy and Identity in the Mobile Landscape Slide 14

 Our Findings
ƒ We found that generally online banking is almost a ‘middle to
high income activity’ – you need disposable income.

ƒ People with disabilities regardless of income will use the internet.

ƒ Those who use it do so because it is extremely convenient, so

much so that its convenience overrides any concerns people hold
about privacy, identity or security.

ƒ Concerns about the privacy of the personal information handed to

banks is not really an issue with most people, but changing
personal information details can be a source of frustration, all in
the name of privacy.

Privacy and Identity in the Mobile Landscape Slide 15

Our Findings cont…

ƒ Concerns had to be probed for and focused on the security of

credit card information and on unauthorised access to
accounts.

ƒ Nine people were concerned about ‘identity theft’; eight of

them used internet banking.

ƒ Only three people of the nine were concerned about theft of

identity as opposed to theft of money from accounts or cards.

ƒ A small number of people will not purchase goods over the

Internet because they have concerns about the security of
their credit cards details or because they have no need to do
so, but they will still bank online because it is convenient
(attitude to eBay, airline tickets).

Privacy and Identity in the Mobile Landscape Slide 16

Our Findings - Security
…in the sense of unauthorised access to their accounts
ƒ Security was a matter of great concern to 12 of the 49 users.
The usefulness and convenience of Internet banking overrode
these concerns. ‘The bank will look after me’.
ƒ Security was a matter of some concern to 37 of the 49
Internet banking users in our sample. There were two
different kinds of people in this group. Some saw themselves
adept at information technology and security and judged that
the security mechanisms in place were adequate. Others
trusted the bank would look after them in case of loss.
ƒ All of them had different risk minimization strategies. These
include boosting the security of the PC, ensuring that only a
‘safe’ computer was used for Internet banking, checking their
balances regularly, using a credit card with a low limit or
curtailing use.

Privacy and Identity in the Mobile Landscape Slide 17

Important Factors to Note

ƒ We found that people still trust their bank to look after

them if anything goes wrong with their accounts.
ƒ Attitudes to some aspects of security are probably not
what banks would hope for in that our interviewees will
share account passwords and other access procedures
with their partners in certain contexts.
ƒ Online banking, as well as being convenient, was easy
to use.
ƒ A lack of confidence with the Internet often led to a
sense of discomfort with Internet banking, and at times
taking the guise of security concerns.

Privacy and Identity in the Mobile Landscape Slide 18

Relevance for Mobile Banking
ƒ If the mobile service offers something of
value/convenience to the customers, they will use it,
despite any concerns about security or privacy.

ƒ We asked our interviewees about possible uses of

mobiles - checking account balances, paying bills and
authentication of access to accounts were mentioned.

ƒ The service must be easy to use. Other studies have

shown that ‘people's perception of security when doing
on-line transactions depends on the simplicity of the
site and on the availability of user support’. Eg Car
parking project

Privacy and Identity in the Mobile Landscape Slide 19

Relevance for Mobile Banking
cont…

ƒ Trust, rather than privacy, identity and security,

emerged as the single most important variable in the
use of Internet banking.

ƒ We also saw in our study how a lack of expertise and

familiarity with Internet use and Internet banking was
converted into security concerns. The same should
apply to mobile banking.

Privacy and Identity in the Mobile Landscape Slide 20

Relevance for Mobile Banking
cont…
ƒ Smaller micropayment activities weren’t seen as
particularly useful. Compare Oyster and Octopus
projects.

ƒ Banks should concentrate on engendering greater trust

in mobile banking, if they want to lessen fears.

ƒ Increasing customers’ sense of control over

transactions, personalising information and making
access to mobile banking easier to use will help in
developing trust. Technical specifications alone do not
make for trust.

Privacy and Identity in the Mobile Landscape Slide 21