From The Conversation.

Australian e-government is a long way behind many other developed nations. Our national leadership has utterly failed to comprehend why e-government should have been a national priority decades ago, and continues to offer little in the way of policy direction.

Hence, our current solutions are a bizarre mish-mash of inconsistent approaches, making it confusing and frustrating for Australians. Every mis-step sets back public trust in online government services. Usability, reliability and security are the keys.

The Australian Tax Office (ATO), for example, provides online data entry, but inadequate explanatory guidance. Searching the ATO website is risky because it also contains obsolete material from previous years.

The ATO communicates by print-formatted electronic documents to a separate MyGov email inbox, making reference to non-existent additional information, yet two-way communication is not possible through this service.

If the Digital Transformation Office is appropriately funded, empowered and motivated, then a top-down review of government services may be able to address the usability and reliability issues over time. Of much greater concern and urgency is the challenge of digital identity.

Who are you?

The Australian MyGov identity system was developed by the Department of Human Services (DHS) for the online delivery of Centrelink and Medicare transactions in particular.

According to the Department’s own website, it has no role in the development of government-wide online services. So it is perplexing that the ATO has adopted an identity solution from a non-specialist department, developed to address a particular application and its own list of security concerns.

Whether those particular security concerns are relevant to the ATO is not clear. It’s also not clear whether a top-down threat assessment was ever conducted for either the DHS or the ATO.

The security threat is not just that government agencies want to protect their own systems, it is also that the users of these services need to be able to trust that their private information is accurate, correctable, auditable and secure.

The key issue is establishing that the digital identity of an account truly belongs to the physical person. Unfortunately, personal health records, social security payments and tax details provide a strong incentive for identity theft, and MyGov’s identity verification process is weak.

So how else could you establish that you really are who you say you are?

The UK and New Zealand

The UK government rightly puts identity front and centre in the mission of the Government Digital Service. And the UK government has been at pains to consult and to explain publicly how the digital identity system will work.

In the UK model, identity is established by one of a small number of private service providers, using multiple identification sources. In most cases, this can be done entirely online. The UK government also believes that the private sector is the most efficient way to develop evolving solutions to minimise the risk of emerging identity fraud attacks.

There is a further requirement that identity verification for a particular government service is proportionate to the service. Passports need biometric verification, but other services have less stringent requirements.

We have similar familiar in-person processes in the form of a 100 point check for financial service providers such as banks, and multiple identity documents for passports.

New Zealand has followed the UK model with RealMe. However, the service is provided by the Department of Internal Affairs in collaboration with the New Zealand Post Office rather than private providers. Once identity has been established, details can be shared with service providers.

Of particular interest in New Zealand is that RealMe is sufficient to open a bank account and apply for a passport entirely online.

The Estonian approach

The mature and battle-hardened Estonian e-government approach includes digital signatures, electronic prescriptions, online voting, and opening and operating both bank accounts and online businesses. Estonia has also extended its digital services to so-called e-Residents.

Estonia’s identity solution requires a smart identity card to be issued in person, which is when they collect biometric information, including a photograph and fingerprints. A smartphone application also provides identity validation for lower risk services.

The underlying system architecture provides a very robust and secure platform for both government and private sector services, even enabling users to verify who has been accessing their private information, and why.

The Estonian approach works in no small part because of strong and effective leadership in the 1990s, which brought with it public support. Whether or not Estonians like their current government, there is an inherent sense of trust in the security of government services.

What is happening in Australia?

If you search hard enough in the Digital Transformation Office website, you’ll eventually find a glib reference to digital identity. Just A$254 million has been budgeted over four years to begin the transformation of Australia’s Commonwealth services to online delivery. That’s less than half the cost of the Adelaide Oval redevelopment, but with enormous and quantifiable long term benefits to Australia’s economy and society.

In 1985 the Hawke Labor government proposed a national identity card, the Australia Card, which was subsequently abandoned in 1987. Politics got in the way of our nation’s leaders to grapple with real policy substance, to Australia’s detriment.

Robust policy debate still might not have delivered the Australia Card, but whatever solution emerged might have set up Australia to be a world leader in the delivery of modern government services.

Policy needs to be driven by open public discussion and consultation. The UK and New Zealand models are compatible with Australian expectations, although the Estonian smart-card based solution is far more robust and versatile.

We have two clear choices: an eAustralia Card would offer flexibity, security and convenience, not to mention eliminating a half-dozen cards from a typical wallet; or we can continue to fail to innovate, swallow our pride and follow New Zealand’s lead.

In the absence of well-considered policy driving e-government services, Australians will continue to have no good reason to trust our government to keep our private information secure.

Author: Matthew Sorell, Senior Lecturer, School of Electrical and Electronic Engineering, University of Adelaide

When you type up a racy email to a loved one, do you consider the details private?

Most of us would probably say yes, even though such messages often end up filtered through intelligence agencies and service providers.

On the other hand, as the digital world becomes more personalized, consumers have begun to accept, appreciate and apparently request relevant connections between their online behavior and displayed advertisements.

It’s fairly commonplace now. Type camping gear into your browser, and for the next few weeks you’ll see online ads for shoes, stoves, shirts and even fashion accessories, all specially designed for camping.

But when you send an email to a family member, or when you receive an email from a friend, do you expect the same type of follow-on advertising as you do from internet searches?

Or do you expect some different level of privacy simply because the information is cloaked in an email?

That’s the issue at stake in a pending lawsuit against Yahoo! Inc.

The case against Yahoo

Plaintiffs filed an email privacy lawsuit against Yahoo in the US District Court for the Northern District of California under several privacy laws, including the Stored Communications Act (SCA) – a federal law that prohibits an email service provider from knowingly divulging to any person or entity the contents of a communication while in electronic storage.

Under the SCA, an email service provider may, however, properly disclose the contents of such communications with the lawful consent of the originator or an addressee or the intended recipient of such communication.

Earlier this year in May, Judge Lucy Koh granted plaintiffs’ request to proceed in the lawsuit as a nationwide class action.

Class actions allow plaintiffs with identical or similar claims to come together as a group in one lawsuit against a common defendant, rather than each plaintiff bringing his or her own individual lawsuit against the same defendant. Typically, many of the claimants would not have the resources to pursue their individual claims for oftentimes relatively modest economic damages. A class action allows them to pool their resources, hire attorneys on a contingency basis to limit or eliminate plaintiffs’ out-of-pocket expenses and seek potentially larger awards than would likely result from a series of individual lawsuits.

Koh is the same judge who denied class action certification in a similar email privacy case against Google last year. The key difference, as Judge Koh noted in her May ruling, is that the plaintiffs in the Yahoo case sought to include in the class of plaintiffs only non-Yahoo Mail subscribers, while the plaintiffs in the Google case tried to include subscribers as well.

This is important because of the issue of notice and consent: did non-Yahoo Mail subscribers have notice of (and thereby consent to) Yahoo’s publicly disclosed policy of scanning, and possibly sharing, emails simply by corresponding with a subscriber?

Given the express language in the SCA that lawful consent of the originator or an addressee or the intended recipient of such communication is sufficient, and given Judge Koh’s prior ruling that Yahoo’s terms of service establishes consent of the Yahoo Mail subscribers – the answer appears to be yes.

In its request to the Ninth Circuit Court of Appeals for permission to appeal Judge Koh’s class action order, Yahoo argued in part that the court improperly decided that the issue of consent could be analyzed within a class action. Yahoo argued that since consent is an issue that is specific to each potential plaintiff’s behavior and action, it would not be appropriate to examine it on a “class” basis, but rather it should be looked at on an “individual” basis. Yahoo’s request was denied without discussion. A preliminary trial date for the Yahoo case has been set for February 8.

Consumer expectations of privacy

At first blush, it’s tempting to say that emails are different from online behavior and internet search histories, and therefore deserve a heightened level of privacy. An email, like its offline counterpart US mail, is personal, private and akin to a confidential one-on-one conversation written with a specific recipient in mind.

And recent lawsuits underscore this temptation. A new case filed a few weeks ago in California federal court alleges that Twitter is “eavesdropping” on users’ private messages in violation of federal and state privacy laws. Another suit filed earlier in September in the Northern District of California alleges that Google unlawfully diverted non-Gmail users’ email messages to extract content.

But one of the key issues in the case against Yahoo is whether email users – specifically those who do not subscribe to Yahoo Mail – consented to Yahoo’s publicly stated policy that emails sent through its service are scanned and analyzed by the company.

Yes, Yahoo’s publicly available web pages, including the Yahoo Mail page, disclose its scanning practices and the possible sharing of email content with third parities, yet the plaintiffs argue that before sending an email to a Yahoo user or before receiving an email from a Yahoo user, they were not given notice of that policy and therefore did give their consent to it.

The plaintiffs’ argument, while superficially plausible, will be a challenging one to make. Companies such as Yahoo and Google have long provided notices and disclosures to consumers, yet consumers rarely read privacy policies or terms of use.

So given this persistent choice either to not read or to disregard privacy disclosures, can plaintiffs (whether as individuals or as a group) really object to scanning emails for targeted advertising – whether they’re subscribers or not?

Leaving aside the issue of consent for the moment, is our online behavior or our internet searches really any less personal – or any less private – than the content of messages sent by users of a free email service that publicly discloses that their emails will be scanned and possibly shared with third parties?

No, they really aren’t.

As The New York Times noted in April 2014 in Sweeping Away a Search History:

Your search history contains some of the most personal information you will ever reveal online: your health, mental state, interests, travel locations, fears and shopping habits. And that is information most people would want to keep private.

Given the intensely private nature of internet searches and email messages, it’s hard to think that consumers would somehow expect more privacy in one than in the other, especially when they use Yahoo Mail, Gmail or other services that users know rely on advertising to support the product. And neither should we expect complete privacy if we use a paid email service to send a personal message to a user of one of the free services.

Realistic levels of privacy

It’s clear from Judge Koh’s earlier rulings that Yahoo users do not have a right to privacy in the messages that they send to or receive from a Yahoo email user given the respective terms of service governing Yahoo Mail.

But do the non-Yahoo users who willingly sent an email to a Yahoo account holder (and presumably received some) have a right to privacy when the account holder has none?

The plaintiffs allege that Yahoo intercepts and scans subscribers’ incoming and outgoing emails for content, including the content of emails to and from nonsubscribers. The plaintiffs further allege that Yahoo copies the entirety of such emails and:

extracts keywords from the body of the email, reviews and extracts links and attachments, classifies the email based on its content[,] … [and] subjects the copied email and extracted information to additional analysis to create targeted advertising for its subscribers, and stores it for later use.

Plaintiffs allege that Yahoo intercepts, reads and learns the content of non-Yahoo subscribers’ email communications without the non-Yahoo subscribers’ consent. The plaintiffs say such conduct violates the California Invasion of Privacy Act (CIPA). Judge Koh certified the nationwide class action with regard to the SCA claim and a California-only subclass with regard to the California state law claim under CIPA.

Unlike the Google case, in which Koh denied the plaintiffs’ request for class action certification, the alleged privacy claims in the class action against Yahoo are no longer for money damages (since plaintiffs abandoned their claim for money damages when they moved the court for class action certification). Rather, it is about asking the court to determine that Yahoo’s acts violate the SCA and, if so, that Yahoo be prohibited from engaging in that practice in the future.

The plaintiffs won a short-term victory in achieving class action certification, but this bigger issue over whether they can object to the scanning process – based on a right to privacy – given Yahoo’s disclosure of its scanning and possible sharing practices and given that they chose to send and/or receive an email to a Yahoo user, is far from being decided in their favor.

And they’ll have a tough road ahead making their case, because an important lesson we’ll all learn eventually is that email privacy can sometimes be a digital paradox.

Author: Lydia A. Jones, Adjunct Professor of Law, Vanderbilt University