Seals US$34m e-ID card deal

bally certified to able for internagrity. o implement for a among a set of technologically ystems. The ID -5 of the ISO this card is also Civil Aviation l. So, that is the nly does it come with the highest level of ISO compliance, but it is also accepted by the International Civil Aviation Organization for international travel. As a result of that compliance, it brings with it technical and international standards that are met….”

The president added that the card also provides for solving the backlog of immigration issues. “… as you know, we have the new requirement for work permits; managing work permits, managing our immigration process, the resident card. All of these will be major issues that we will have to deal with. This card will allow us to deal with this electronically. Because through this card we will now be able to address the issue of work permit, [and] resident cards will be added onto the electronic ID system, and will be used to better document the immigrants working in Guyana,” he said.

“There isn’t an ISO 27001 certified data centre in Guyana to house this data. While the e-Governance unit subscribes to the NIST [National Institute of Standards and Technology], they do not follow NIST 800-53 guidance for security,” a United States cybersecurity expert who requested anonymity told Stabroek News, in an invited comment.

“Has this company and the solution been assessed, potential risks identified and mitigated?” the IT technician questioned while pointing out that Guyana has to carefully monitor to assess and remedy gaps.

One observer pointed out that while the US is among the countries that have implemented digital ID systems, to ensure the safety of citizens’ data, that country has enacted stringent laws.

“These laws include The Gramm-Leach-Bliley Act (GLBA), which mandates financial institutions to explain their information-sharing practices and safeguard sensitive data, The Health Insurance Portability and Accountability Act (HIPAA), which sets national standards for the protection of medical records and personal health information, The Children’s Online Privacy Protection Act (COPPA), which regulates the collection of personal information from children under 13, and The California Consumer Privacy Act (CCPA), which grants California residents the right to know what personal information is being collected and opt-out of its sale,” the observer explained.

“Unlike the US, Guyanese citizens lack comparable legislative safeguards against the misuse and breach of their centralized and easily accessible data,” the sources added.

Noted too was that “concerns about privacy and the potential for unauthorized access to the data collected by the system remain. The implementation of a national ID card system is also expensive, and the cost may be passed on to taxpayers. Some citizens who do not have the necessary documentation to obtain an ID card, such as refugees or stateless persons, may be excluded. Technical issues such as system failures, glitches, and errors can also cause inconvenience and frustration for citizens.”

Global advocacy organisation, EDRi 2, which “works tirelessly to defend fundamental rights in the digital age, to advocate for appropriate laws and policies, and to raise awareness of the key issues impacting digital rights,” has also listed a number of gaps eID systems bring and suggests that governments should implement strict security measures before these are rolled out.

“In the case of public-private partnerships, that is, access by private companies, use cases must be controlled strictly. Otherwise, identity theft and other identity-related crime and mischief cannot be avoided…,” it stated as it focussed on Austria’s plan to implement the system.

To implement the project from the technical side, there will be a central ID processing system, preenrollment and fixed enrollment stations, mobile stations and delivery stations. Features of the card include laser engraving and an Automated Fingerprint Identification System (AFIS) to access all of a user’s biometric information on a polycarbonate document with a chip. All of the features, according to Ali are tailored for this country. “The system allows the capture of biographical information, based on international standards and stores it to provide identity based services to individuals and other government offices.”

The president said that the contract with the company covers an in-country help desk and that they will train administrators and operations staff, after which there will be a one-year implementation period. The company also will provide an additional 60 months of support services.