Services Australia used Home Affairs face-matching database for bushfire relief

The Department of Home Affairs (DHA) is currently responsible for the operation of a central hub of a facial recognition system that will link up identity-matching systems between government agencies in Australia.

The Australia-wide initiative will allow state and territory law enforcement agencies to have access to the country's new face matching services to access passport, visa, citizenship, and driver licence images from other jurisdictions.

The initiative comprises two parts: The Face Verification Service (FVS), a one-to-one image-based verification service that will match a person's photo against an image on one of their government records, while the Face Identification Service (FIS) is a one-to-many, image-based identification service that can match a photo of an unknown person against multiple government records to help establish their identity.

The Parliamentary Joint Committee on Intelligence and Security (PJCIS) in October declined to recommend the passage of Australia's pair of Biometric Bills, with a bipartisan agreement being reached that the privacy safeguards were not sufficient in their current form.

The committee instead requested the Identity-matching Services Bill 2019 be completely redrafted.

While the Bill is back in the workshop, DHA is chipping away at having its biometric database ready to go, in anticipation of being able to use its additional surveillance powers.

See also: Why Australia is quickly developing a technology-based human rights problem (TechRepublic)

During Senate Estimates this week, it was discussed how the state governments of South Australia, Tasmania, and Victoria have given Home Affairs copies of driver's licence images for the database already.

While DHA deputy secretary of Security and Resilience Paul Grigson was unable to say when those three states gave the images, he said the data is currently "being held in the department, but within a system that is contained, because it's not yet operational".

After questioning from co-deputy leader of the Greens Senator Nick McKim, it was decided there was around 410,000 images in this new database from Tasmania alone.

With Victoria being substantially more populated than Tasmania, DHA was asked if many of the assumed "hundreds of thousands" of images in the database were provided without permission of the people involved.

"The arrangements we had with the states were that they would deal with consent issues as the images are provided to us, so I would need to check for Tasmania on what the circumstances were around their provision," Grigson said.

"It will operate as a hub. When it becomes operational, if we get the required agreements, it will operate as a hub. State agencies will interact with it and Commonwealth agencies as well."

The images have been rendered into a form that can be used by the hub, if it becomes operational.

See also: The growing legal and regulatory implications of collecting biometric data

While DHA denied non-government organisations had accessed any of the photos or biometrics relating to those photos, it did reveal Services Australia got its hands on the information.

"Services Australia has been trialling using some South Australian and Victorian images for the provision of services to people affected by bushfires with their consent," Grigson said of the FVS access.

"Let's assume that they lost everything in a house fire, came into Services Australia and said, 'I've lost everything.' Services Australia would ask for their consent to use a face to identify them and, if a match comes back, that would help Services Australia provide those individuals with services. Apart from that, they're not generally available."

Grigson said Services Australia was responsible for asking the person for their consent to have their image matched.

He wasn't sure what the process is if someone was to deny consent.

Previously, the Department of Human Services, before being rebranding to Services Australia, told the PJCIS access to Australia's identity-matching database would allow it to ensure the right people are getting the right assistance, as the department responsible for issuing welfare could use it to verify people's identities.

According to the department responsible for the robo-debt data-matching initiative, access to such services would also "modernise" the measures the department uses to thwart fraud, as it would enhance its capacity to confirm customer identity.

"The availability of the [Identity Matching Services] as proposed under the Bill, and specifically the FVS, will make it easier and quicker for the department to verify the identity of its customers (particularly those who are vulnerable) and ensure they receive the right payment and service when they need it," the department wrote at the time.  

Grigson confirmed the document verification service -- in operation for a number of years -- is used by businesses under controls, and said DHA would need to consider having businesses use the FVS, but not the matching service.

Regarding the redrafting of the Bill, Grigson said DHA provided "some advice" to the government both at the end of last year and also this year.

RELATED COVERAGE

• Committee orders complete redrafting of Biometric Bills as privacy safeguards are deemed inadequate
• Home Affairs exempt from disclosing Face Identification Service provider
• Committee asks for more transparency over Australia's face-matching system
• Victorian driver licence info to be stored in federal database
• Home Affairs denies mass surveillance capabilities of face-matching database
• Australia's surveillance laws are hitting the social license problem
• Home Affairs pushes back against encryption law proposals