362 VIEWS
Pinterest LinkedIn LINE

Last year, on November, I visited the Danish government. It was a follow-up to my reporting 3 years earlier, before the launch of OCES II [1]. My counterpart was Charlotte at the Danish Ministry of Finance, the same person as before.

As always, the Danish government’s approach is highly instructive. Its spiral process of trying something, correcting its shortcomings, and trying again works extremely well. The current OCES II has various problems, but they will surely correct them in the next cycle.

This visit prompted me to consider how I would redesign e-government in Japan today.

My requirements for e-government are as follows:

  • Dramatically reduce the direct, indirect, and time costs of government administration.
  • Catalyze higher productivity throughout the economy—and thus economic growth—through thorough specialization and greater exchange.[2]
  • Do not crowd out the private sector.

This led to the following 8 measures now in my mind:

  • Measure 1: Establish a Privacy Trust Framework
  • Measure 2: Integrate the Basic Resident Registration Network and introduce national-level identity management
  • Measure 3: Introduce a registered bank-account system
  • Measure 4: Introduce an electronic contact-information registration system
  • Measure 5: Abolish the current Public Personal Authentication Service and introduce an electronic credential registration system
  • Measure 6: Introduce an electronic mailbox system
  • Measure 7: Introduce bulk submission of structured data for filed documents and similar materials
  • Measure 8: Introduce periodic reviews

Ideally, I should discuss the current situation, an overview, and the benefits of each measure. But this work must be done in spare time, so it takes time, and would be too long for a blog post. I will therefore record only a brief outline of each here. Perhaps the details will eventually become an e-book.

Measure 1: Introduce a Privacy Trust Framework

When introducing a new institution or system, privacy considerations are unavoidable in a liberal society. From the outset of deliberations on the My Number system, the Supreme Court ruling on the Basic Resident Registration Network was treated cautiously; consequently, an independent body was established and PIAs were required. Its scope is too narrow, however, to support the bold measures described below. To transcend that ruling and pursue economic development through a personal-data economy, Japan needs a privacy trust framework centered on a stronger independent body.

In cyberspace today, most stakeholders perform authentication, authorization, personal-information management, and service delivery themselves, while data exchange between services is extremely limited. It is a primitive state with little specialization or exchange. Specialization according to comparative advantage[3] would plainly enable significant economic growth. That requires personal data to be transferred and used as needed. Accordingly:

  1. The sender transfers only the minimum personal data necessary.
  2. The recipient requests only the minimum personal data necessary.
  3. The recipient has security controls meeting a prescribed standard. (Level of Protection, LoP)
  4. The recipient gives the individual personal-data control meeting a prescribed standard. (Level of Control, LoC)

These and similar conditions must be met. Without a mechanism, individuals cannot know the level attained by each company or organization. Certification and suspension of certification—a trust framework—make that visible.

Specifically, a certifying authority issues certification guidelines based on requirements at internationally agreed levels. Assessors conduct assessments, and the authority certifies organizations using their results. Certification is promptly suspended when an organization is found noncompliant. Keeping personal-data flows among certified organizations then ensures a defined level of privacy.

Without this, releasing personal data held by government to companies would be impossible. A privacy trust framework must therefore precede the measures below.

Measure 2: Introduce National-Level Identity Management

Identity management—registration, updating, storage, deletion, and so forth—is fundamental to modern systems. Japan has neither a satisfactory institution nor system. The Basic Resident Registration Network is the next-best option, but the legacy of litigation makes expansion difficult. Its architecture is also old and costly. Indeed, House of Representatives minutes cite this figure:

  • Total annual expenses: approximately 19 billion¥36 million (excluding municipal system costs)

This seems excessive for a system managing only “4 information items comprising name, date of birth, sex, and address, plus the resident-record code and change information” for 100 million3,000 people. The cause is likely an old architecture tightly coupling systems distributed among 1800 municipalities nationwide through dedicated lines and communication servers.

Moving to a modern, loosely coupled cloud system using Web APIs should:

  • Reduce costs
  • Make expansion easier

A possible integrated design would include:

  • An IdM framework, such as ISO 24760-1
  • Appropriate information quality, such as ISO 29115
  • An appropriate identity-proofing process, such as the New Zealand government’s Evidence of Identity Standard
  • A core number—a hidden, universal, immutable number
  • Using the core number to manage:
    • Name at birth
    • Current name
    • Date of birth
    • Place of birth
    • Sex
  • Separate subsystems for:
    • Residence
    • Registered bank accounts
    • Electronic contact information
    • Electronic credentials
    • Electronic mailboxes
    • Facial photographs
  • A REST API enabling systems to be developed freely, protected with OAuth 2.0.
  • The Internet as the network, with mutual authentication and encryption. Mutual authentication follows ISO 29115.

This should enable a dramatically cheaper and, more importantly, more flexible system.

Facial-photo registration should be developed as part of this work. No current data link resident records or family-register data to a person’s physical body. Some biometrics must be recorded in a database; facial photos appear easiest to use rapidly during disasters. Registration cannot happen overnight, however: initial enrollment is an ideal target for impersonation. Drawing on standards such as New Zealand’s Evidence of Identity Standard, this must proceed as a 10-year project.

Measure 3: Introduce a Registered Bank-Account System

Denmark and other Nordic countries have registered bank-account systems. Tax refunds and various benefits are paid into the registered account. In Japan today, citizens must provide a payment account separately for every program, imposing large direct, indirect, and time costs on both civil servants and citizens. A registered-account system would dramatically reduce these costs.

Another advantage is that banks will promote it themselves without the government doing so. Public education and adoption efforts must not be neglected; this adds considerable value.

Measure 4: Introduce Electronic Contact-Information Registration

When the Basic Resident Register was created, postal addresses were the main contact point and were therefore recorded. Today, Internet addresses—email, SMS, and others—have replaced them. They cannot necessarily receive large data volumes, but can naturally receive notifications. They could replace current government notification work, making notices extremely inexpensive and rapid. The electronic mailbox described below would also use these notifications.

Measure 5: Abolish the Current Public Personal Authentication Service and Introduce Electronic Credential Registration

The current service suffers three burdens: barriers to acquisition, barriers to use, and quality limitations. Ideally Japan would implement the equivalent of Europe’s Qualified Certificates, but that is difficult because (1) no identity-proofing standard exists, (2) the underlying databases are low quality, with much self-reported data, and (3) there is no way to bind data to a physical person. Individuals rarely conduct transactions requiring credentials at this level, so they are not cost-effective.

The current Public Personal Authentication Service should therefore be abolished for now[4], and credentials from banks and others made usable for e-government access.

A trust framework should also ensure credential quality, or Level of Assurance (LoA).

Competition among multiple credential providers should improve service.

Registration would use the electronic contact information from Measure 4.

Measure 6: Introduce an Electronic Mailbox System

In digitization and e-government, converting documents to PDF is often treated as digitization. It is better than nothing, but far from ideal. Data should be delivered in reusable, structured form.

An electronic mailbox system would provide storage for this structured data.

Here, each person’s electronic mailbox is structured storage from which various data can be extracted at the individual’s direction.

Multiple private providers would offer mailboxes through standardized APIs, while third-party applications would access them to provide value-added services. This would be the heart of the personal-data economy. Multiple providers create competition and continuous improvement while reducing government costs.

Using this development as a catalyst, after a transition of about 5 years, government-issued paper documents would be eliminated and everything digitized. The digital divide would be addressed by certifying private services, such as document preparation and printed delivery, and subsidizing them when necessary.

Measure 7: Introduce Bulk Submission of Structured Data for Filed Documents

Japan’s 1800 municipalities currently prescribe many of their own formats for employee-related and other documents required from companies. Companies inefficiently reformat submissions for every destination. If these documents became structured data sent once to the national government and distributed to municipalities as appropriate, corporate burdens would fall substantially, contributing to economic growth through greater efficiency.

Standardizing, structuring, and electronically issuing receipts at the same time would also have major benefits.

Measure 8: Introduce Periodic Reviews

No matter how deliberatively a system or institution is introduced, problems remain and technological progress makes it obsolete. Rather than treating past creations and precedents as inviolable, we need a mechanism for continuing change every 3 to 5 years. Bureaucracies are probably worst at this, so the mechanism itself must be institutionalized to keep the PDCA cycle moving.

Conclusion

These 8 measures deliberately exclude commonly discussed services such as pre-filled tax returns. That is an application service, merely one application built atop the platform created by the 7 measures above[5]. Once the platform exists, such application services will proliferate, as Facebook applications and Apple’s App Store demonstrate.

Japanese e-government must now shift from application orientation to platform orientation. This is what is called Gov 2.0.

 

[1] The Danish government’s electronic-signature and authentication initiative. OCES I began in 2003. According to an interview with the Danish Ministry of Finance conducted on 2012/11/22, OCES II is now provided through banks as Nem ID/Nem Login (Easy ID/Easy Login). Among citizens aged 16 or older, 4.5 million people in total, 4 million are active users; public awareness is 100%, and 96% of holders are satisfied.

[2] On this point, Matt Ridley’s “When Ideas Have Sex” is highly suggestive.

[3] Those unfamiliar with this should see [1], “When Ideas Have Sex”. Without reading an economics book, you can grasp the point in only 10 minutes.

[4] Abolish the rule requiring Public Personal Authentication for e-government access. Discard the fiction that the current service is LoA4, confront the reality that it is at best LoA2, and restart it as a long-term project aiming for LoA3 or 4. First establish an identity-proofing standard and issue LoA4 certificates to civil servants. To build the system efficiently, create chains of trust and enroll identities and distribute credentials by leveraging employment relationships (civil servant → executive → employee → family) and school relationships (civil servant → teacher → student). Without reliability and coverage, services face duplicate investment of 2 and no ROI, so they will not adopt it; individuals then have too few places to use it and gain no benefit. Good distribution could achieve substantial coverage within 3 to 5 years, so planning should proceed toward 70% coverage. (Added on 2014/8/26 to clarify “current.”)

[5] A system that aggregates statutory reports submitted by companies and electronic receipts obtained by individuals, deposits them in individuals’ electronic mailboxes, and notifies their electronic contact points. With the platform above, it could be built inexpensively.

Related posts