When we think of homeland security, our mind often turns to those annoying characters at the airport whose job it is to rifle through our hand luggage. But behind the scenes, a wide array of technology is being deployed in an attempt to keep us safe.

That's not always a good thing.

While some of the frankly impressive technology being used by law enforcement and intelligence agencies may indeed contribute to our security, they also have potential for misuse.

As you'll read in Follow that face, the Australian Federal Police has enjoyed considerable success by using facial recognition to recognise offenders with forged identity credentials. But experts say it's conceivable that facial recognition technology may one day evolve to the point that government agents could identify any citizen through a photograph. That could include citizens protesting controversial wars, or perhaps citizens guilty of Australia's newest crime: sedition.

At Customs, Jill Savage, national manager for Border Intelligence and Passengers Development Branch, says the SmartGate project will enhance border security, but is geared more towards efficiency goals. "The primary driver is we've got increasing traveller numbers and infrastructure limits at airports," she told ZDNet Australia. "Normally our response would be to increase staff ... but we don't have extra space so that normal manual process isn't an option for us [anymore]."

This report also looked at how law enforcement bodies intercept voice and data communications, thankfully subject to rigorous due process, and how sub-atomic particles neutrons, may one day help Customs officials peek inside all manner of cargo.

You'll also read about the Howard Government's proposed national identity card -- to be issued to the vast majority of Australians -- which it argues is anything but.

Howard himself passionately opposed Prime Minister Bob Hawke's proposed Australia Card in the 1980s, before back-flipping this year -- security concerns make it reasonable, he says. Despite that statement, the federal government now insists the card is not being introduced as a security measure, but as a way of cracking down on fraud.

Despite the cool-factor of security technologies, it's important that we remain level headed; it's important that we don't embrace technology for technology's sake. It can be used to protect or oppress, to safeguard against attack or to stifle dissent. It is our duty to make sure the compromise between individuals' fundamental, if not legal, rights to privacy and freedom of expression aren't skewed too far in either direction through bad policy.

 

Follow that face

When a 17-year-old buys a fake drivers licence, it's hardly a threat to national security. When an Al-Qaeda operative does, you could have some problems, says Australian Federal Agent Rob Tunnicliff.

"A NSW drivers licence might be used by an underage drinker or someone who's avoiding having points removed from his licence," he says. "Or it could be used by someone who is trying to get a security licence at the Sydney Opera House for the sole intention of blowing it up."

Tunnicliff, the national coordinator of the Australian Federal Police's Identity Security Strike Team, knows how hard identity crime is to investigate. "We've had instances where people have used hundreds of names and addresses," he says. "So the face is what's important to us."

Trying to pin down criminals who specialise in creating partially or completely fabricated identities means a long paper trail, and following it is often fruitless. Now, however, with some clever technology at his fingertips, Tunnicliff's team has changed the equation by following suspects' faces, not their forged or fictitious details.

His team is pioneering the use of facial recognition software in Australian law enforcement.

"We've found that our offenders are very mobile, very adaptive and they have committed frauds in every state in Australia," he says. "But once you actually find the person you've got them because they've got their face all over everything."

It works like this: The Federal Police are handed a false ID, suspect photo, or CCTV footage from other agents, agencies, or even private organisations like banks. Tunnicliff loads it into a massive image database, and cross checks it for possible matches to other images they've captured. He can even cross-match against other image databases, like drivers licence databases held by roads and traffic authorities in most states and territories.

In some cases, it will lead to other fraudulent identities. In others, it helps federal agents to identify who a criminal really is.

Since its establishment in 2003, the Strike Team's efforts have been successful. Recently, operation Hickey netted 13 arrests. The federal government is impressed, having allocated an extra AU$20 million in funding to the team in the last budget.

While the team's high profile arrests have involved fraud offences, Tunnicliff says his group also focuses on counter-terrorism. However, he's less forthcoming on details when it comes to those operations. When ZDNet Australia asked him if he could elaborate on the use of facial recognition technology in counter-terrorism investigations, his answer was a firm "no".

Despite this, he says there are obvious national security benefits for tackling ID crime in all its forms. Tunnicliff says over 400 false documents were used by the 9-11 hijackers, for example. "It's not just about passports, it was to avoid scrutiny, immigration visas, work permits," he says.

By busting the syndicates that create false documents, he says, it's harder for terrorists to obtain the credentials they need to carry out an attack.

The AFP isn't the only agency that's using facial recognition technology. Customs will launch its new SmartGate system at Brisbane airport in February next year. Jill Savage, Customs' national manager, Border Intelligence and Passengers Development Branch, says the project will enhance border security, but is geared more towards efficiency goals. "The primary driver is we've got increasing traveller numbers and infrastructure limits at airports," she told ZDNet Australia. "Normally our response would be to increase staff ... but we don't have extra space so that normal manual process isn't an option for us [anymore]."

The SmartGate system is completely automated. Australian e-passports are embedded with chips loaded with a biometric imprint of the photo on the main page of the document. The passport holder can enter a booth, be automatically scanned by a video camera and let through, all with no human intervention. If the system can't verify that the person being scanned is the passport holder, they're presented to a customs officer who can perform further checks.

So what's the security advantage? "In terms of border security, essentially it means that we've got a high degree of confidence that the person presenting the passport is the person who has their image in that passport," says Savage.

ZDNet Australia tried to play devil's advocate with Savage, but she wasn't having it. "I'm sure a customs officer would notice that you're a man with a woman's mask on," she says when presented with a cunning plan to evade SmartGate's facial recognition software. "It's been tested on things like masks and so on, and they don't let you through."

Stephen Kent, who has written authentication standards and testified before the US Congress on the issue of identity systems, agrees that biometrics come in handy in border control applications. "If an individual asserts two different identities when crossing a border at two different times, biometric authentication can detect this anomaly and call it to the attention of border control officials," he says. "Also, in the case of facial recognition, if an intelligence agency has photographs or video of a 'person of interest' but no ID, it may be possible to use this covertly collected biometric data to alert border control officials when the individual tries to enter a country."
But Savage says SmartGate "series one" won't have that capability just yet. "In SmartGate series one the emphasis is on self processing at the border, not necessarily [on] comparing them with biometrics from other places, that's pretty much out of scope from what we're doing at the moment," she says. "It's about doing the border clearance process, rather than getting into other activities that other organisations might be interested in."

Kent, vice president and chief scientist for Information Security at technology solutions firm BBN, says there is little independently verified data on the reliability of facial recognition software, but Savage says the SmartGate trial has yielded fantastic results.

And, says Kent, biometrics at the border is a good idea, even if it is just about adding an extra layer of authentication to existing documents. "Because the inclusion of biometric data in passports also tends to make use of digital signatures to provide authenticity and integrity for the reference data, it makes passport forgery harder at the same time," he says.

In law enforcement applications, like the AFP's ID Security Strike Team, it's a covert method of investigation, he says. "The big concerns here are the accuracy of these systems, and whether their use in border control contexts might trigger more widespread, domestic surveillance use," Kent says.

Indeed, privacy concerns have rattled some. Is it possible that government agencies could zoom in on ordinary citizens at a protest rally and immediately identify them from their face?

According to Ken Pfeil, a security consultant and former Security Program Manager for Identix, a biometrics company, it's not completely fanciful. "This technology has serious privacy implications, especially here in the US," he says. "It is not beyond the realm of possibility at all for it to be grossly misused in the name of combating terrorists."

"(While) the marginal accuracy and incompatibilities between systems would inhibit the scenario ... today on a large scale, technology gets better with time and is conceivable in the future."

The spying game

The capability for the government to spy on your communications has been in place since well before the events of September 11, 2001. Australian law dictates that all communications carriers must allow law enforcement and intelligence agencies to intercept the signals and data they relay. Thus, equipment used in Australia is equipped with an interception capability.

The Government's role in actually developing this technology is seldom spelled out, however. The Defence Signals Directorate, Australia's equivalent of the United States National Security Agency, actually employs engineers in research and development to develop voice and data interception technology.

The technical capability of Australia's DSD is impressive, it even shunted off mobile phone triangulation software to the United States Government in the '90s, according to an inside source who spoke to ZDNet Australia on a strict condition of anonymity.

Fortunately, says the source, the agency takes its charter very seriously. It's not allowed to spy on Australian citizens, and by all accounts the bureaucrats who run the show make sure that doesn't happen. Other bodies, like the Australian Federal Police, are allowed to spy on Australian citizens, but only if they have an interception warrant, which is granted by the courts. ASIO (Australian Security Intelligence Organisation), on the other hand, can intercept communications on the authority of the Attorney General and it doesn't need a court granted warrant.

Thankfully, since September 11, 2001, the Government hasn't given agencies carte blanche to engage in open-slather spying. But it has altered legislation to allow agencies to spy on suspected terrorists, if a warrant is obtained.

But let's look at the interception capability of the Australian government:
* Fixed line interceptions
We've known for a long time that the government has the capability to intercept calls made from fixed line telephones. All manner of agencies and state authorities can intercept calls, subject to due process.
* Text messages
Think very hard before sending that text message about blowing up the Lucas Heights nuclear reactor. Telecommunications companies store SMS messages after they have been delivered to phones, and law enforcement agencies can apply to the courts for warrants to seize them as a "stored communication".
* GSM interceptions
The government can not only listen to your calls, courtesy of interception capabilities built into GSM gear by companies like Ericsson (and others), but they can pinpoint your location, too. Some of this technology was developed at the Defence Signals Directorate by the Australian government, sources told ZDNet Australia.
* International telephone calls
Thanks to facilities like Pine Gap in the Northern Territory, the Australian government can spy on the communications of countries like North Korea and China using signal intercepts relayed to the Australian ground station from satellites. This can include phone calls or radio communications, including military communications about troop movements. Pine Gap's staff is split between Australian and US personnel. It's the largest CIA-manned facility outside the United States, and a building block of the US-Australia alliance. Also used for over the horizon radar.
* Internet communications
ISPs in Australia (carriers) are required to offer interception capabilities to government agencies. An AFP agent, for example, can turn up to an ISP with an interception warrant, and the service provider can set up a VPN (virtual private network) tunnel to send data directly to the agency's facilities.
But despite a solid interception capability, it's entirely possible for terrorists and criminals to communicate anonymously and privately over the Internet by using encryption technologies. Dr Eugene Spafford of Purdue University in the United States has advised US Presidents Clinton and Bush Jr on Internet security. Spafford told ZDNet Australia terrorists are using the Internet for everything from communications and coordination efforts to the distribution of propaganda.

"They're good at using technology for communication; satellite phones ... several terrorist groups of different forms, revolutionaries in different countries use the computer as a means of communicating anonymously," he says. "It's not possible to trace from cell to cell. It [the Internet] is good for that."

And there are products available that make intercepting your phone calls virtually impossible. Les Goldsmith, of Electronic Surveillance Detection, an Australian company that offers Technical Surveillance Counter-Measure (TSCM) services, also sells GSM compatible mobile phones equipped with strong encryption. If both callers are using one of these phones, which use military grade encryption, the call cannot be intercepted.

"If you want to make sure that there is no opp for someone to intercept your call, the only way to do that is to use end-to-end encryption," he told ZDNet Australia in a telephone interview. "If there is a GSM intercept it's going to just receive encrypted data."
The Cryptophones are popular with government agencies and some large corporations that are eager to ensure foreign nations or competitors aren't listening in, Goldsmith says. "We try to stay away from the criminal element," he adds.

Indeed, a document held by an Australian intelligence agency discussing the dissemination of fundamentalist videos -- including those showing beheadings -- shows little can be done. Here is an excerpt from the discussion paper seen by ZDNet Australia:
"One of the terrorists' problems with sending out videos in 2003 was their size -- this has inadvertently been resolved by the release of new Californian software titled YouSendIt. It creates anonymous [emphasis added] Web sites with multiple links for viewing software which can also be compressed. There are now more than one million file transfers a day using this software. The US has no means of legitimately stopping messages and beheading videos from being disseminated from a large number of international sites."

Nasty people with nasty motives can hide behind encryption and anonymity on the Internet ... something the Attorney General is trying to counter. In fact, Australians are being snooped on like never before.

In May, Attorney General Phillip Ruddock announced an AU$87 million funding boost for the Australian Federal Police's surveillance program. The money, to be spent over four years, will be used on new equipment and a coordination centre designed to organise collected intercepts.

"The quality and quantity of intelligence coming into and out of the AFP has increased enormously in the past four years," a statement touting the initiative said. "The AFP will ... establish a single facility to manage the collection, monitoring, recording and evidence preparation of terrorism-related electronic surveillance material."

Containing containers

With roughly one million containers coming into Australia each year and one million headed out, it's perhaps not that reassuring to hear that only 100,000 of them are x-rayed, and 10,000 searched. However, the Australian Customs Services insists a risk management approach to securing the country's ports is the way to go.

The trick is knowing which containers need to be inspected in the first place, according to the Australian Customs Service Director of Sea Technology Strategies, Glenn Lyon. "We require brokers and importers to disclose what's in the container ... they're risk assessed and run against profiles," he told ZDNet Australia.

The risk assessment profile is, for the most part, a computerised and automated process. "Every container coming into the country is risk assessed. We do some analysis and profiling of export cargo as well ... looking at the information chain," Lyon says.

In addition, Customs intelligence officials work in the background, identifying suspicious organisations or individuals who may be seeking to bring dangerous or illegal goods into the country. High quality and reliable information is the first tool Customs uses in its fight against the influx of nasties.

The technology effort doesn't stop there. Worldwide, there has been an effort to make the transportation of some dangerous goods easier to detect. Explosives manufacturers, for example, have deliberately altered their products to make them more difficult to clandestinely transport. "There are international efforts underway to put chemical markers in all explosives," Lyon says.

In layman terms, a chemical marker in an explosive compound will make it "smell" unique, so a trace detection device can easily identify it. For the most part, manufacturers have been cooperative. "I imagine the international community would have concerns about an organisation that didn't want to cooperate," Lyon says.

Customs is also looking at investing in radiation detection equipment. Currently, its staff use handheld scanners to sniff inside containers during manual inspection, but it's clearly a capability the service wishes to expand.

One maker of radiation detection technologies, the confusingly named US-based outfit Canberra Industries, was recently awarded a US$11.7 million contract to provide Advanced Spectroscopic Portals to the US Department of Homeland Security. In Australia, the company's equipment is sold by Nu Scientific. Its managing director, Graeme McDonnell, says the technology has come a long way.

Traditional solutions have reliably detected radioactive material, he says, but haven't been able to reliably detect which type of radioactive material it might be with an appropriate degree of certainty. Now, highly accurate sensors can detect and identify radiation emanating from containers that are simply driven through a portal. "A truck or a parcel would go through it ... in a big port they may have five or six alleys with these things, it goes past, and if it gets nothing, it goes through," he says.

Why bother with radiation detection? Before the events of September 11, 2001, you could be forgiven for not knowing what a "dirty bomb" was. Today, hearing those two words combined are enough to scare the willies out of most sensible people.

Dirty bombs are designed to spread radioactive material across a wide area, rendering it uninhabitable. It's not designed to destroy or kill, it's designed to disrupt, causing mass panic and disrupting the target country's economy.

However, unlike crude, conventional bombs which can be made from standard chemicals and fertilisers, it's not that easy for the average Australian to wander on down to the local 7-11 to pick up a few kilos of deadly radioactive material. If a dirty bomb goes off, it's likely the material used in the device came from overseas, purloined from an insecure facility.

This is just one reason that Australia's port security has been tightened, but the list of materials the government wants to keep out is a long one. Conventional explosives, drugs, biological and chemical agents are others.

While McDonnell himself says the likelihood of a dirty bomb attack in Australian is quite low, the consequences of it happening make the detection equipment a worthwhile investment. "It is a major problem if this goes off," he says.

Glenn Lyon's colleague Adam Friederich, Border Technologies manager, says it's a good time to be in the market for technology, with private sector research and development at fever pitch. Still, he concedes his dream technology may still be some time away. "We'd like to have a machine that you hold up next to a container that tells you if there's anything in there you need to know about," he says. "But I don't think that will ever exist."

Nonetheless, the private sector has responded well to world events, he says. With so much private research and development going on, all the Australian Customs Service needs is to purchase solutions, not do its own development work. "We're always looking for new technologies ... we look to the suppliers, we don't do the R&D we look to providers who can do it for us," he says.

Lyon agrees. He says the commercial drivers for innovation in homeland security technology are significant. "If someone gets groundbreaking technology it will be worth a fortune. There are a lot of commercial drivers for this stuff," Lyon says.

One of the more interesting technologies being considered is currently being trialled by Customs at Brisbane airport. It's a cargo scanner developed by the CSIRO that uses neutron beams to peek inside packages. Unlike x-ray technology, the new type of scanner will give Customs officers a much more detailed view of what's inside a parcel. "It's doing air cargo containers, which are smaller, but certainly we're seeking to test whether the technology is worth being taken to other operating environments," Lyons says. "It certainly could be used in sea cargo."

Dr Nick Cutmore, CSIRO Minerals' program manager, Online Analysis and Control, is in charge of the neutron-scanning technology's development. The project has been going for four years, he says, with the Brisbane scanner brought online last year. He says the images displayed by traditional x-ray machines, like the ones we see at the airport scanning our hand luggage, are coloured by software. The CSIRO's approach is to use Gamma radiation to measure density and shape, much the same way as an x-ray does, in tandem with a neutron scan that reveals much more about materials being scanned.

"They're [x-ray machines' outputs] artificial colours, we combine gamma rays ... and then we use the neutrons to get a measure of the material class," Cutmore says. "A lot of different explosives are in a different material class, as are drugs."

The coloured picture a Customs officer sees is not a false-colour picture, but the real, unadjusted output of the device, he says. As for whether it will work in container-scanning applications, it's too early to tell, he says. "You can scale to that size, but what we need to look at with sea cargo is what additional benefits it gives you," Cutmore says.

The scanning technology, which is patented by the CSIRO, could be a real money spinner. But Cutmore says the commercial viability of good technologies isn't always predictable. "Technology always appears valuable to its inventors, but how valuable it is, is best judged five to 10 years later," he says.

But anything that can prevent an attack could be worth its weight in gold, literally. Athol Yates, a director of the Australian Homeland Security Research Centre, thinks he knows what's at stake if lax port security facilitates a terrorist attack.

Such an event in a Western country could have a dramatic impact on the world economy, he says. The reaction of the US government would be to close ports, in much the same way as they shut down air travel in the aftermath of the September 11 attacks.

"You could imagine the ramifications will be absolutely enormous," Yates says. "They shut down the airlines, they'll shut down the ports."

 

Keeping cyber-terrorists at bay

We've all seen the movies. Played by Hugh Jackman or Matthew Broderick, Hollywood computer hackers siphon unlimited sums of cash from bank accounts, rain radioactive death on us from above, shut down power plants and transform the world into a vision of the seventh layer of hell.

The reality is somewhat different, but perhaps not as far removed from the movie world as the government would like. That's why there are branches of government that are attempting to secure our vital infrastructure; everything from utilities' control systems to finance computers.

In the aftermath of the September 11, 2001, the government established the E-Security National Agenda "to create a secure and trusted electronic operating environment for both the public and private sectors". It's currently under review.

The federal government allocated AU$24.9 million over four years to fund the initiative in the May, 2002 budget, and a further AU$50.2 million in the 2004 budget. The money was split between several agencies, and lead to the establishment of the Trusted Information Sharing Network. It's a body designed to bring the private and public sector together to share information about protecting critical infrastructure from attack, cyber or physical.

It operates under the control of the Critical Infrastructure Protection Branch within the Attorney General's department. Within that group sits Steven Stroud, the director of the branch's National Information Infrastructure unit. With a background working for the Defence Signals Directorate, Stroud has been working in the field of computer security since 2001.

Is there a giant, national firewall controlled by a single government agency? Can Stroud hit a few keys on a master console to thwart a massive, catastrophic attack? Well, no. As things stand, the response to that type of event involves various agencies and groups -- the Defence Signals Directorate, the Australian High Tech Crime Centre, ASIO (Australian Security Intelligence Organisation) and AusCERT -- springing into action and doing the best they can. Will agency staffers run around their desks, arms flailing, shouting "Run away! Run away!"? Stroud says no.

He says NII's GovCERT unit is doing well to string together a response and coordination capability, but the concept is still a "work in progress".

"AFP, ASIO and DSD have an arrangement where they have agreed to share information and act in concert in response to an incident affecting [national infrastructure]," he said. "The nature of an incident will determine which of those three agencies takes the lead."

In such a scenario, it's GovCERT's responsibility to make sure information flows between the agencies.

Such attacks could consist of large, distributed denial-of-service attacks, targeted trojan attacks against government computers, or even a large-scale computer worm, he added. Each would require a different response.

One of Stroud's roles is creating detailed incident response strategies for infrastructure groups, private and public. "It's a full tilt policy role in that we're a policy agency, we're not in operations. What we have to basically do is figure out who does what, find the gaps and figure out who can fill them," Stroud says.

That means everything from establishing solid incident response strategies to helping infrastructure providers in assessing their risk profile. "One of the main activities that's going on here is the computer vulnerability assessment program ... the government providing up to half the cost of a vulnerability assessment for commercial operators," he says.

A vulnerability assessment by Attorney-General approved consultants helps infrastructure providers determine if they're at risk, Stroud says. So what are the risks? Can hackers access the control systems at a power plant or traffic light control centre?

Stroud says that process control systems (SCADA, or Supervisory Control And Data Acquisition) are being meshed into corporate IP networks, which could theoretically allow an attacker to compromise them, but it's not as scary a scenario as some might think. "In the olden days SCADA systems were standalone systems. Nowadays, for good business reasons, increasingly they're migrating to commodity hardware and software," Stroud told ZDNet Australia. "They're being connected to business systems ... the problem there is that business systems are in turn connected to the Internet."

The upside, Stroud says, is that by moving away from custom solutions and chopped down operating systems and on to standardised platforms and full-blown operating systems like Microsoft's Windows, security problems are more easily fixed.

The systems are not easy to compromise or even to "get to", he says, but SCADA is an area where care needs to be taken when implementing and operating the systems that control our daily lives. "That doesn't mean that the path to the SCADA systems is by any means easy and anyone can just waltz on through, but there is path," he said. "What we want to do is [ensure] that businesses consider the risk. In the main they have to because it's in their own interests, too."

In this special report, we've already heard from Dr Eugene Spafford, who discussed wiretaps on day two -- The spying game. As an expert who's advised two US presidents, Clinton and Bush Jr, he's spent a fair amount of time considering the risks to networks from terrorism. Have there been instances where fundamentalist groups have launched a cyber attack? Yes, he says. What are the details? He can't say -- it's secret.

But Spafford says the paranoia over cyber-attacks are somewhat overblown. Fundamentalist groups are using the Internet to communicate, coordinate and spread propaganda, he says, but cyber-attacks just aren't sexy enough for the average terrorist to get interested in. "They release videotapes to the west to appeal to the masses," he says. "They're trying to incite an Islamic revolution and portray themselves as leaders in the field, and the technology aspects are not going to highlight that."

Terrorists, it seems, want to fight the infidels with AK-47s and RPGs, not TCP/IP packets. There is, however, anecdotal evidence to suggest terrorist groups are using Internet scams to raise money which can be used to arm and train recruits.

AusCERT general manager Graham Ingram told ZDNet Australia a national priority for Australia should be the establishment of a national Internet monitoring scheme. "This is one of the things we've suggested in the E-Security national review," he says. "We've been talking about setting up better monitoring and detection systems."

Some Asian countries, like Korea and Malaysia, have outstanding monitoring capabilities, Ingram says. He regards securing the Internet from a large-scale attack a priority. "Some [attacks] are annoying, some of them are not of great concern, but some of them by sheer scale ... are increasingly of concern and getting to the point of a national security issue," he adds. "The real weakness is the Internet is not as robust as people would like it to be and it is not secure. Trying to maintain the security of transactions on a medium that is fundamentally not secure is a challenge."

 

Don't mention the Australia Card

While the idea of a national identity card in Australia has always been controversial, the case for introducing one on security grounds has never been stronger. The federal government is proposing virtually all Australians be issued with a card -- a biometric equipped smartcard, no less -- to cut welfare and Medicare fraud.

The card, which will have the holder's photograph printed on it, will also have a biometric scan of the photo stored on its chip. But can a national ID card protect Australians against terrorist attacks?

Many Australians remember the debate that raged over Prime Minister Bob Hawke's proposed Australia Card in the '80s. The public's reaction to the proposed scheme was severe enough to see the idea labelled Orwellian and binned for good.

At the time, the Liberal opposition passionately opposed the Australia Card legislation, eloquently countering the argument -- the same argument used by John Howard's government today -- that a national card will stamp out welfare fraud. As one Liberal member put it at the time:

"On each and every occasion it is a question of balancing the public interest against the private right. But, unlike the Australian Labor Party, I start from the assumption that the private right is superior to the right of the state. That must always be the starting assumption. Anybody who seeks to erode the private right must carry the onus of proving that there is an overwhelming public benefit in that private right being eroded. It is just not good enough, as this proposal assumes, to say to a government, 'We have a problem. We cannot collect enough tax', or 'We cannot stop enough welfare cheating'. In other words ... we have a systems failure under the present system so we have to turn everybody into a card subject to deal with that systems failure."

The member in question was John Howard, speaking at the second reading of the Australia Card Bill in the House of Representatives in 1987. "The Australian Federal Police, who have the heavy burden of trying to do something about white collar crime in this country, are very sceptical about the benefits [of the card]," he added.

There was outrage in the '80s, but it's a different world today. Millions of Australians tune into a show that is actually named after Orwell's Big Brother from his masterpiece 1984, and the public's anxiety about a possible terrorist attack is palpable. So it's not surprising that the reaction to the government's proposed access card, thus far, has been somewhat muted by comparison to the outrage at Hawke's proposed scheme. "Twenty years ago when the Australia Card was knocked over, we didn't know of Osama bin Laden; we hadn't had the 11th September; and we didn't live in such a globalised world economy," Howard told ABC radio this year.

Despite Howard's comments, the government now insists that the proposed card, to be issued to every Australian who wants to claim a Centrelink benefit or Medicare rebate, is not a security measure. It's designed to stamp out Medicare and welfare fraud, the same objective Howard dismissed in 1987 as pointless and unjustifiable from a civil rights perspective.

While Government papers on the card describe it as an "access card", and most definitely not an "identity card", it's clear the devices are to be used to authenticate identity. A spokeswoman for Human Services Minister Joe Hockey laughed and coyly explained the distinction when ZDNet Australia asked for an interview about the proposed project. It's not an identity card, she explained, it's an access card that's used to authenticate identity.

Despite most welfare fraud being related to overpayment and over servicing -- not identity crime -- there are some clear benefits, she says. A card with a photo on it will ensure "you're not someone who's come from overseas and borrowed your cousin's Medicare card to go to the doctor".

Six hundred thousand people are turned away from Centrelink each year because they don't have the appropriate ID, she added, so the card will make life easier for people who deal with the government. While the spokeswoman said it will be illegal for private sector organisations to demand the new card be shown for identification purposes, citizens will be allowed to use the card to identify themselves to private organisations, like banks. This being the case, there's little doubt these biometrics-equipped cards will become the new de facto ID for Australians.

While the government denies the card is being introduced as a security measure, there are some who say such a measure will bolster national security. Take this from Oracle CEO Larry Ellison: "The single thing we could do to make life tougher for terrorists would be to ensure that all the information in myriad government databases was integrated into a single national file," he wrote in an opinion piece for the Wall Street Journal four weeks after the 9/11 attacks. "Today, every federal intelligence and law enforcement agency and all manner of state and local bodies maintain their own separate databases on suspected criminals. All these separate databases make it difficult for one agency to know about and apprehend someone wanted by another agency."

Australia National University's Clive Williams, a terrorism expert, tells ZDNet Australia a similar story. "The reality is that ID cards will not prevent terrorism," he says. "What they should be able to do is make it more difficult for prospective terrorists to move around and adopt multiple identities."

As we discovered in Follow that face on Day One, the Australian Federal Police is working hard to bolster confidence in identity documents. A government-issued smartcard with a biometric capability would almost certainly be welcomed by enforcement agencies.

But civil libertarians are far from impressed. Irene Graham, the executive director of Electronic Frontiers Australia, an online rights advocacy group, is appalled. "It's been a while since we've been completely opposed to something ... there's no justification for this," she says. "It will be the equivalent of the Australia Card."

She's also sceptical about the government's claims of massive savings in fraud, and says a KPMG report commissioned by the government has done little to sell her on the plan. "It does not at all justify the claim that this money can be saved," she says. "The KPMG case, although it claims those figures, it's been censored, there's huge sections that have been ripped out."

Minister Hockey's spokeswoman said the KPMG report had to be censored so the tender process wouldn't be prejudiced in the future.

New-York based Ben Rothke, the director of information security with financial services firm AXA, has experience with Public Key Infrastructure, the cryptographic technology that underpins the smartcard system. While the technology is robust, it's not without its problems, he concedes. "One of the issues is that there's far too much expectation put on these cards," he says. "They can be forged, nothing's unbreakable."

Furthermore, managing large-scale PKI deployments is relatively new territory, he says. "These are the devils in the details. PKI takes a lot of management and we don't have a lot of experience rolling out tens of millions of cards and dealing with that," he says. "We don't have many mega-deployments, most of the successful deployments have been smaller, closed loop deployments."

There are a lot of "gotchas" when you take the technology out of the lab and into the real world he says, with cryptographic key revocation (in the case of a lost or stolen card) being a tricky technology problem.

Rothke is sceptical about the card's potential to eliminate terrorism, and says a strong business case needs to be put forward to justify such a massive roll-out.

"I've seen PKI work and I've seen it fail, and I think it's a great technology. It's powerful, but ... I would ask people when they were looking to deploy PKI, what is your problem, and how do you expect PKI to solve it. And a lot of people can't answer that question," he says.