Rapid resumption of international travel has pushed the Department of Home Affairs to fast-track digitisation of incoming passenger declaration forms, which will be relaunched within weeks as mobile and web apps that can be quickly reconfigured to keep up with fluid international COVID regulations.

Digital identity firm ForgeRock will provide the framework for the new Digital Passenger Declaration (DPD), project lead Accenture recently announced amidst plans to launch the finished application in its initial form before year's end.

Accenture won the tender for the DPD Project in September, breathing new life into a digital ‘Permissions Capability’ project that was being floated by government ministers a year ago.

The new system replaces the printed Incoming Passenger Cards (IPCs) that are handed to every person arriving in Australia – 9.47 million of them during 2019, just before international travel numbers dropped off a cliff in March 2020.

That lull created an opportunity to fundamentally reinvent the IPCs – which have long been designed, printed, distributed, and stocked in their millions as printed documents that were difficult and expensive to modify.

DPDs, by contrast, allow screening questions to be modified instantly as travel regulations change.

This means, for example, that questions about passengers’ recent movements can be continually updated with current lists of regions with concerningly high COVID numbers.

The platform will also be able to securely store travel-related documents such as internationally recognised COVID-19 Vaccination Certificates.

“For a government entity, it’s quite visionary and it’s what the country needs to do,” David Hope, senior vice president for Asia-Pacific and Japan with ForgeRock, told Information Age.

ForgeRock’s identity platform – which is already managing over three billion identities worldwide and counts ANZ Bank, Bank of Queensland, and AustralianSuper amongst its Australian customers – underwent “a very detailed, thorough evaluation” during the DPD tendering process, Hope said.

“And then, because of the whole border reopening, it really sped up and took on a life of its own.”

Identity-driven government

ForgeRock already integrates with more than 200 different web applications – but, director of sales engineering Adam Biviano said, the DPD’s need to accommodate hundreds of different identity, vaccination, travel and other credentials had created “quite a significant set of challenges”.

“It’s not just a matter of developing an additional identity system,” he explained. “It’s a matter of dealing with the complexities of the diverse types of individuals that you’re going to be experiencing.”

“Even just normally dealing with the variety of people inside Australia is challenging enough for people who are designing digital services for government – but when you expand that out to include people from various backgrounds, languages, countries, and even different brands of phones, those are the things that this system has to deal with.”

Home Affairs has bigger plans for the DPD: for a government that has long-struggled to gain traction around digital identity, the app will provide viable, relatable use cases that will catalyse the government’s broader push towards identity-based digital transactions.

Recent success in linking Medicare vaccination certificates with state check-in apps was one example – but the platform, Minister for Employment, Workforce, Skills, Small and Family Business Stuart Robert said, will ultimately support an “overarching digitisation program [that] could include visas, import permits, personnel identity cards, licenses, registrations, and other documents – making previously cumbersome processes easier, safer and more transparent.”

Drawing a line on identity

Consolidating identity information may save money, but some are calling for constraint amidst concerns that DPD-like services will become back doors to unified national identities.

In many countries “identity is very fractured and fragmented [and] it’s very politically problematic to have a unified identity,” Trend Micro Research principal threat defence architect Craig Gibson – who was involved with the WHO technical efforts around vaccination certificates – noted during a recent webinar.

“It’s far less problematic to have a COVID vaccination certificate,” he continued.

“So many countries are moving quickly to use that certificate as the core hub of national identity, basically bolting on all of the other kinds of identity onto these COVID vaccination certificates.”

Yet given the degree to which cybercriminals have already compromised such systems – there are entire marketplaces built around falsified credentials, often issued through legitimate channels – Gibson warned that “the current incarnation of vaccination certificates are not suitable for national identity.”

“Anybody who can add themselves to that supply chain, for instance by gaining access to a hacked system or certificate will add themselves to the supply chain,” he said – which is why he advised the technical committee to adopt a zero-trust strategy requiring continuous verification of credentials.

With a core role in the design and execution of the DPD, Biviano knows all too well what is riding on the project’s success and eventual expansion.

“Who knows what information we’ll need to collect when the COVID situation continues to evolve in the new year and beyond?” he said.

“If we want to keep Australia’s borders open, we need robust infrastructure that is going to be able to adapt to whatever scenario gets thrown at us.”