Digital ID Security and Privacy

According to the provided content, clients are advised to keep sensitive information locally and not share it with service providers unless explicitly asked to do so. Additionally, clients should track ID activity and report any suspicious movements or changes to the service provider. This ensures that personal data remains private and secure.

Assignment-5- Privacy, Security and Ethical Reflection
About the case
MySupport is an application portal run by the charitable institution giving income support
service to disadvantaged people, homeless people and the people requires mental service.
Earlier the service users require to access service at 3 different government agencies along with
charity but as per the request of the Government of Australia, the new portal will integrate
each platform into a single platform so that a service user incase needs any other specialized
service, he/she need not require to approach multiple agencies for acquiring service. With the
integrated platform (which is also connected to government’s citizen charter), the clients of
charity will get all required services and support. [Ayed, G. B. (2014)]
Here in this report, we are addressing privacy and security threats and ethical issues with the
new approach. We will also recommend some actions that the client of MySupport that they
can take in order to protect their private information at their level.
Personal and ethical implication of privacy of NGO clients
It is said that from now onwards, it is the digital ID of the service users will be used in order to
integrate each and every community and healthcare service that government and the
charitable institution are offering. Under the new plan, each such services will be managed at
one particular space i.e. MySupport. As it is an integrated service system which not only the
charity but also government can access the client information, it is raising the following
personal and ethical effect on privacy of the information. The effect can be discussed in both
positive and negative manner.
Positive effect on the person (client of the charity) on privacy in MySupport
Integrated service- One of the biggest advantages that client will perceive from the new system
is availability of all required services in on platform. As the client is having a digital ID, he/she

will not require to approach a number of service agencies or departments to reveal the
healthcare or community services. This will help in keeping the information (data that client is
likely to keep private) confidential over the digital network. The only way such information will
be used is to use the specific digital identity to access the data thus anonymity can’t be
maintained for using such data.
Secured network- Government of Australia has laid specific guidelines and laws under its
information privacy and security Act.1988. So system that government is promoting to
implement with the charity will keep that Act rules and guidelines in mind. This will ensure the
client that his/her health and other private information will be safe in the network. Moreover,
as the service includes privacy agreement with providers, it minimizes the chances of
confidential information vulnerability. [Windley, P. J. (2005)]
Full range of service- MySupport is a portal that will provide a wide range of information about
the different support services available to the people requires care and support. Earlier, the
service user has to look for services to fulfil the need but with such integration, the person can
apply for the services he/she wishes to without incurring further time, cost and effort. Even
they don’t need to resubmit all information which can increase data vulnerability because the
service provider will take the information straight from the portal with authentication practice.
Standardization of information- Earlier, the service providers may ask different information that
may or may not be relevant for the service. This has the privacy risk of the client which will be
now minimized by the standardized set of client information. In the portal, there will be
standard biodata format which client needs to fulfil. Unless some additional information is
required, the service provider will use those standard information only. This will give
confidence to the user regarding the new system privacy. [Recordon, D.,et.al2006]
Negative effect of the implication
It is not that the service user will have only influence on the new portal system, it can have
some negative effect on privacy case. This can be-

Network security- The government has not expressed the digital ID security to the client thus
the user will always in dilemma whether the new system is free from virus, Daniel of service
and any other malware risk factors to keep the confidential information remain same.
Misuse of private data- Until now the information about client was accessed by one service
provider only. Now as all services are included, all can see the private information about the
client which can create confidentiality issue for the network.
What if the person dead? - In future, all client information will be in digital database which is
linked to Government’s citizen database. If the user is no more, how all information will be
treated, is still a question mark. How the data will be destroyed or removed from the system,
who will do so, who will ensure etc. questions will rise in person’s mind. [Cross, D. B et.al2010]
Change in behavior
There will be certainly behavioral changes will take place among the users of the new service
system. The behavioral changes among the user will depend on the privacy provisions in
MySupport portal. If the government and the charity provide adequate security to the digital ID
(for e.g. access with figure print, retina scan etc.) then user will show trust and confidence on
such portal to provide adequate information for service effectiveness. Otherwise, user won’t
produce full data if any doubt or confusion on data privacy is there.
Ethical implication on privacy of client for MySupport portal
These can be the ethical consequences that can arise in relation to privacy challenge with
MySupport portal.
Invasion of privacy- One of the key ethical issues associated with the new system is
government’s full accessibility to the client’s data. Government can use such information to
have personal gain (vote bank or support). It can also sell the information to any outside parties
without notice of the client and charity that will affect the privacy of information of client. This
can be considered as lack of consent risk associated with the portal. [Hansen, M.,et.al2008]

Limiting the service- As the user of the service is disadvantaged people or people with mental
illness, so it is expected that some other person will create ID digitally for the users (may be the
charity employees or their relatives or friends). This will limit the availability of service as there
may be users who may not able to feed all private information in the digital network due to lack
of technology knowledge or trust factor.
Control of Government or influence on service- As the Government is approaching to integrate
support service, it may influence the charity’s privacy rules and guidelines with their own.
Unless government signs a privacy agreement with charity and users with specified privacy
clauses, the influence of government on private data usage will be there.
User consent- Although a privacy agreement is signed regarding usage of information but
normally it is expressed to use for service delivery but the government may use the information
for some other purpose secretly without expression of client. This can violate privacy
agreement.
On positive note, ethical implication can be-
Control over data usage- Due to centralized database server, the service provider has to use the
information available in the server. If it requires more, they need to provide reasons and
permission from the client. This will improve monitoring of data usage.
Copyright- MySupport portal is exclusively designed for the charity thus no other organization
can seek information from client who are not registered with the portal.
Service to all- Earlier it was not possible to address all needs of the client with the private portal
of the charity but by integration with government, now more people will come under the
program and government can explore more support service provisions. [Chow, S. S et.al2012]
Personal and Ethical Implications on Security of the client of NGO
Likewise privacy, there can have both positive and negative impact of MySupport approach on
the security aspects of the client of NGO. The security aspects can be addressed at personal and
ethical level as below-

Personal Implications on security aspect of MySupport
Alike privacy, there can be presence of both positive and negative effect of this new system. Let
us start with positive side-
Transparency- This is one of the highlighted feature that will give positive impact on client of
the service. In MySupport system, the client can see the information feed and its utilization
over the network. The client can track the service status at any point of time along with the
service agencies detail. Overall, it is providing transparency of network to the client.
Convenience-Digital ID is easier to maintain than traditional paper-based information collection.
The information collection takes fraction of time to fill the information and also takes lesser
time to share the information with all those services providers which client is looking for. Even
client doesn’t need to bother about its physical security (misplace or theft) as such information
is kept secured network (either encrypted or with authentication provision).[Bélanger,
F.,et.al2011]
Forgery- In case of paper-based information collection or private portal, there is a high level
chances of making a forged documents or information files in order to exploit the service users
for money. With the integration of government, now such scrupulous actions will be minimized
to a large extend. Here the IT governing body of the Government of Australia will look after the
security of information which is more reliable to private security provision.
Match with compliances- With the government support and inclusion of support services with
charity services, now the client will get assurance of complete service delivery which are as per
the provisions of Department of Health and Community Service. This will improve confidence
and trust over the service provisions.
Negative side of implications-
Data Breach- If the MySupport system is not provided with adequate security provisions, there
is a high level threat of data breach through virus, malware and any other IT security attacks. It
is believed that hackers show a greater interest in Government’s database, they may try to

intervene the client’s database to steal useful information such as bank details, health records
etc.
Hijacking of accounts- Digital ID normally works with a unique ID and a password (letters,
numbers and symbol combinations). If the ID and password is hacked or leaked at any point of
time, then it will create client information and data vulnerable. If the client hasn’t changed
password for long or provided an easy to guess password, attackers can easily crack such IDs.
Fake Accounts- The ill-minded people can open fake accounts using dead or missing person’s
information to avail the government support services especially monetary services. Until Digital
ID creation requires unique identification such as finger print, retina, face recognition etc. the
security threat will be there. [Camp, J. L. (2004).]
Inside threat- If the people inside the charity or government employees steal the data from the
digital ID using proxy server or network, it will put the client information in trouble.
Ethical Implication on security aspect of MySupport
There can be both positive and negative implications over the new approach on ethical
grounds. The positive sides can be expressed as- [Clauß, S.,et.al 2001]
Security of privacy- Digital ID is user-based control system thus the client has absolute rights
and accessibility towards the information in the network. He/she can share or not to share the
information with the service providers at own choice. This ensures security to the private or
confidential information of client.
Legitimacy- Digital ID provides mileage to legitimacy of the service users. As the ID and
password for the digital system is unique, only the right user will able to access the services.
This will protect intruders for creating any security complications.
Visibility of the service delivery- Both the client and the provider can track the service status
over the digital network. This will help government to monitor service provisions.
Explore service provisions- The aim of government to integrate the community and healthcare
services is to know the adequacy of existing level of service and gap of service delivery. With

constant monitoring by the government, they can assure all services are delivered consistently
and will also come to know about any additional provision is required to the client.
Negative implications on security-
Consent issue- Although digital data can be taken with authentication but here government is
having absolute control over the database of MySupport. It can use the data of client for
personal benefit which can pose a threat to his/her financial and personal life position.
Government may secretly use the information without informing the client.
Outdated software or poor protection- If MySupport portal is an outdated cloud service or
hasn’t provided adequate security provisions, attackers can easily crack the network system
and can take confidential information of client and service provider for own benefit.
Incorrect information- There is always a security threat in relationship input of false information
from client or service provider. As the digital accuracy can be measured by auditing, but in
matters like mental and community health, such steps are limited which is giving space to
incorrect information. [Bertino, E.,et.al2009]
Limited to the client of charity- The benefit of the support services are available to only those
people who have enrolled to the charity. Thus, the program is not serving to the society at
large. It can security concerns for those people who are falsely enrolled into similar network by
fraudulent people.
Recommendation for the Clients who are going to use MySupport
network
There is no hard and fast set of rules or guidelines that can ensure data protection and
integrity. The cloud network MySupport’s security and privacy concerns are with the
government and charity. It is their roles and responsibility to provide adequate protection to
client’s data.
From the client’s perspective, the following steps can be taken in order to at least secure data
as much as possible.

1. Define your PII- Personally Identifiable Information
The client must decide the information or data that he/she feels to be categorized under PII. It
can be information related to health, finance, social security etc. the client must express the
statement to the service providers that which information they require for the service delivery.
If the client finds any asked information is under PII, he/she should enquire details about the
usage of such information and about the protection of data. Before taking any service, the
client needs to match the requirements with his/her own PII. [Mont, M. C., et.al2003]
2. Keep the password quirky and change constantly
Majority of privacy and security concerns are coming from this factor. Many at times, the user
applies easy to recall or simple to guess passwords for their digital identification. Even they
don’t change until some intruders attack the ID. This habit needs to be changed. The client must
set the password for MySupport Portal which is difficult to guess by mixing of numbers,
alphabets in lower and upper case and special characters. Even they need to change the
password once in 2 or 3 months. They also require to keep the password physically secured i.e.
not to write anywhere which can be accessed easily.
3. Read the privacy and security agreements properly
One of the biggest mistake we people normally commit is ignoring the privacy and security
agreements that are given for digital platforms. In case of physical information sharing, we
enquire but for digital platform, we tend to agree without reading it full. This gives the chances
to manipulate and misuse information. Here the client needs to enquire full information about
the sharing and usage of information there in digital network.[Takabi, H.et.al 2010]
4. Don’t use any proxy server or open network to open digital ID
Using proxy server or open network i.e. where the security system over network is poor can put
your digital ID under security and privacy risk. Using such medium can give direct entry to the
hackers to steal your personal information by corrupting or obstructing your path to open the
digital ID. The client needs to use safe server or network medium protected by adequate
firewall.

5. Delete old or unnecessary data from the Digital ID
One of the safe way to keep the information secured and safe is to delete unnecessary and old
data from the digital ID that are no longer required to avail service. By doing this, you can
assure that such old data or unnecessary data won’t get misused. It is difficult to say which is
necessary and unnecessary in such system but a reasonable steps can be taken from client side.
For ex- If the portal didn’t ask for Tax ID as mandatory information, don’t give it. [Halim,
R.,et.al2009]
6. Provide data in encrypted or authentication platform
MySupport platform hasn’t expressed the type of digital ID to the charity thus if the client is
supposed to provide information, it should share in an encrypted network or the network that
seeks authentication of the user.
7. Backup your data
It is a wise step for the client in order to keep the data safe and secured. The backups of each
and every information your put into the digital ID will help to recover the data even if the digital
ID corrupted or lost by denial of service. The backup shouldn’t be done in the same system. It
should be kept in a external hardware or in other secured system.
8. Anti-virus and firewall system
This is one of the common way to keep the data and information secure and safe. By installing a
good anti-virus into the system that can protect the device from virus, malware, Trojan horse,
worms etc. Apart from the installation, the client must keep the system updated with anti-virus.
[Cross, D. B. et.al 2012]
9. System update
The user of digital ID must keep the Operating System (OS) and Network System updated in
order to avoid any sort of virus and malware attacks to the system. Attackers target those
systems that are out of date.
10. Don’t share ID information unless it is necessary apart from Service Prover

The system is meant for disadvantages people thus most of the digital ID creation will be
carried by any third party like friends, family members, agents etc. Unless you are very sure
about the information secrecy with these people, don’t share ID information to these people.
11. Don’t forget to sign out before you leave the platform
Most of the people have the tendencies to let the digital ID as it is in order to avoid efforts to
put ID and password again and again. This behavior is actually troublesome because leaving the
ID open can lead to greater amount of privacy and security risk. If the device of the client gets
stolen, it would put the client in deep trouble. Thus, it is better to log out or sign out every time
you enter into your digital ID. [Gutierrez, A. J.,et.al2006]
12. Use of digital signature provision if available in MySupport
Although it is not clearly specified about the entry into digital ID but if there is a provision for
digital signature such as thumb impression, key questions, retina scan, OTP etc. then use that as
the mode of entering into ID portal. This reduces the chances of data vulnerability. [Laurent,
M.,et.al2015]
13. Keep the sensitive information locally
Unless and until the service provider has asked to put the information in Digital ID, the client
shouldn’t put the information in the ID rather if necessary share it personally to the service
provider. This will keep the information safe and private.
14. Keep tracking of ID activity and report suspicion
The last thing that client is required to do is to keep tracking of the transactions or movement
in the ID regarding services status, information taking and service delivery. The client should
enquire the movement with the service provider. If the client finds anything odd, without
wasting time, he/she should inform the service provider or the government looking after the
portal. [Lyon, D. (Ed.). (2003)]

References
1. Takabi, H., Joshi, J. B., & Ahn, G. J. (2010). Security and privacy challenges in cloud
computing environments. IEEE Security & Privacy, (6), 24-31.
2. Lyon, D. (Ed.). (2003). Surveillance as social sorting: Privacy, risk, and digital discrimination.
Psychology Press.
3. Mont, M. C., Pearson, S., & Bramhall, P. (2003, September). Towards accountable management of
identity and privacy: Sticky policies and enforceable tracing services. In Database and Expert
Systems Applications, 2003. Proceedings. 14th International Workshop on (pp. 377-382). IEEE.
4. Bertino, E., Paci, F., Ferrini, R., & Shang, N. (2009). Privacy-preserving digital identity management
for cloud computing. IEEE Data Eng. Bull., 32(1), 21-27.
5. Clauß, S., & Köhntopp, M. (2001). Identity management and its support of multilateral
security. Computer Networks, 37(2), 205-219.
6. Camp, J. L. (2004). Digital identity. IEEE Technology and society Magazine, 23(3), 34-41.
7. Bélanger, F., & Crossler, R. E. (2011). Privacy in the digital age: a review of information privacy
research in information systems. MIS quarterly, 35(4), 1017-1042.
8. Chow, S. S., He, Y. J., Hui, L. C., & Yiu, S. M. (2012, June). Spice–simple privacy-preserving identity-
management for cloud environment. In International Conference on Applied Cryptography and
Network Security (pp. 526-543). Springer, Berlin, Heidelberg.
9. Hansen, M., Schwartz, A., & Cooper, A. (2008). Privacy and identity management. IEEE Security &
Privacy, 6(2).
10. Cross, D. B., Hallin, P. J., Thomlinson, M. W., & Jones, T. C. (2010). U.S. Patent No. 7,703,128.
Washington, DC: U.S. Patent and Trademark Office.
11. Cross, D. B., Hallin, P. J., Thomlinson, M. W., & Jones, T. C. (2012). U.S. Patent No. 8,151,332.
Washington, DC: U.S. Patent and Trademark Office.
12. Laurent, M., & Bouzefrane, S. (2015). Digital identity management. Elsevier.
13. Recordon, D., & Reed, D. (2006, November). OpenID 2.0: a platform for user-centric identity
management. In Proceedings of the second ACM workshop on Digital identity management(pp. 11-
16). ACM.
14. Windley, P. J. (2005). Digital Identity: Unmasking identity management architecture (IMA). " O'Reilly
Media, Inc.".
15. Halim, R., Shaharyar, S. A., & Vapen, A. (2009). Digital Identity Management.
16. Gutierrez, A. J., & Feigenbaum, J. (2006). Digital Identity Management.

17. Ayed, G. B. (2014). Digital Identity Management. In Architecting User-Centric Privacy-as-a-Set-of-
Services (pp. 57-95). Springer, Cham.