The government of British Columbia, Canada, had a problem. The province’s CareCard technology — the identity card BC residents use to access health services — was more than 20 years old and had never been significantly updated. Even worse, the number of CareCards issued significantly outnumbered the population of the province (4.5 million).
“The CareCard was designed in the late 1980s,” said Ian Bailey, assistant deputy minister of technology solutions for British Columbia’s Ministry of Technology, Innovation and Citizens’ Services. “There was no photo on the card, just a number and a name, and no expiry date. It was a very weak credential, and while we knew 9 million had been issued, we had no idea how many of the cards were still in play.”
Weak security made illegal practices possible such as selling the cards, especially in communities close to the United States border to Americans looking to access free health care. And on the payment side, poor security made it easy to charge for services without proof such services were actually provided.
Given the lack of security, the potential for fraud, and to improve patient safety, the British Columbia Ministry of Health began searching in 2011 for a way to replace the CareCards with a smarter credential integrating better identity-proofing technology.
The province of British Columbia is no slacker when it comes to e-government. According to a 2012 Stratford Institute study of e-commerce in Canada, British Columbia ranks first overall among all the provinces for its e-government initiatives. “B.C.’s overall first place ranking comes as a result of its dedicated customer-centric approach in providing online services, sharing online information, and encouraging online engagement,” says the report.
Therefore, if the province were going to replace the CareCards, it was going to do it right.
Dave Nikolejsin, now deputy minister for BC’s Energy and Mines, was CIO of the Ministry of Technology, Innovation and Citizens’ Services in 2011. As such, Nikolejsin was working with a senior group of deputy ministers on a strategy to take on some of the bigger e-government challenges.
“We had already tackled much of the cool online stuff like booking a campground, paying for government services online, etc., but we wanted to be able to do more of the things citizens really cared about — the types of interactions that you can only do if you know authoritatively who someone is online,” said Nikolejsin. “That’s where we bumped up against the identity problem. We needed to find a way to do transactions that were more complicated. We wanted a general-purpose way to identify people securely that was reusable across multiple programs.”
This effort eventually brought the Ministry of Technology, Innovation and Citizens’ Services and the Ministry of Health together.
“As we talked, we realized there was no sense in just putting a new, high-quality, tamper-proof health card out there and then issuing 9 million of those like we had the previous CareCard,” said Nikolejsin. “So we combined our efforts. If we were going to solve this problem for health anyway, why not we solve it in a general purpose way and enroll people in an identity service that would work for health and also for any other program where we needed to identify people online?”
The two ministries therefore began planning how they could replace the CareCard with a secure card that could be used for multiple government services. Luckily, Canadian banks began replacing their mag stripe credit cards with chip and PIN cards around the same time.
“Today, it’s rare to find a Canadian merchant or retail outlet that does not use chip and PIN,” said Bailey. “Canadians are now used to using strong security every day. That was a big aspect of making the new health cards a reality. We wanted to make sure the public was ready for more advanced authentication technology, and we saw that they were.”
As the idea of issuing a new, more secure CareCard using chip and PIN technology began to gel, the two ministries had another issue to tackle: how to execute the replacement. They needed a way to positively identify people in person using biometric facial recognition technology, enroll them, and then issue them the new secure credential. For the solution, they turned to the BC Insurance Corp., the Canadian equivalent of a U.S. Department of Motor Vehicles.
“Our drivers’ licensing processing counters already existed, and the Insurance Corp. of British Columbia already had procedures in place to positively identify people,” said Bailey. “They already had all of the machinery needed and all the storefronts for taking photos, as well as contracts in place to create high-quality, tamper-proof credentials.”
New Card Sparks Privacy Worries
The BC Services Card’s introduction last year sparked a backlash from privacy advocates, who worried the provincial government was integrating citizens’ personal information and creating a national ID card without adequately consulting the public.
“If the government has its way, the card will be used not just for access to government services, but also for credit card and as transit passes. That’s a lot of access to personal information,” wrote Vincent Gogolek, executive director of the BC Freedom of Information and Privacy Association (FIPA), last year in the BC edition of the Huffington Post.
Both FIPA and the BC Civil Liberties Association criticized the scope of public input for the card, noting that most comments came via email instead of face-to-face interaction. The groups also panned the citizens panel assembled to review the card technology.
“The panel will only be allowed to make a limited range of recommendations,” the groups contended in a joint letter sent last August to Andrew Wilkinson, minister of Technology, Innovation and Citizens’ Services for the BC government. “In particular, the panel will not have the option of recommending either the elimination of the combined BC Services Card or of the government’s ID management plan.”
In April, BC Information and Privacy Commissioner Elizabeth Denham praised the quality of recommendations from the citizens’ panel, as well as from a group of experts brought in to review the Services Card system. Denham said advice coming from these groups should guide the expanding use of the card.
“These consultation reports should be the blueprint, and we will be measuring the government’s future design against the recommendations made by citizens and experts in this consultation,” she said.