Category: CraigThomler

There’s been enormous coverage of the new Centrelink debt letters process, whereby the Department of Human Services has automated the process of matching data from the ATO and Centrelink to try to find overpayments (but not underpayments) in welfare benefits to Australia.

The automation has involved removing human quality assurance steps, which has led to the number of debt checking letters growing from 20,000 per year to 20,000 per week. Over 260,000 of these letters have been sent out to-date.

Now automated data-matching can be a fantastic thing when used well. It can reduce duplication in identification processes, find patterns and trends that inform polices and service delivery, and even identify inaccurate payments – as was the intention with this approach.

Gamification refers to the practice of making non-game activities more like games by incorporating achievement-based reward systems.

Under gamification, using government examples, when your project or mission is complete you might receive a ‘completion badge’ (such as a letter from the Secretary, an Australia Day Award, or a medal). Or when you attain a higher level of proficiency in a particular skill you’d receive an ‘achievement’ or rise on the ‘leaderboard’ (such as a bonus or a promotion).

From the examples above, there’s clearly already aspects of gamification at work. Rewarding achievement, success and skills acquisition is a standard part of business and forms the basis of merit-based advancement systems – not just games.

However the gamification process involves a much greater level of achievement-based recognition, than has commonly been used in organisations.

The Australian National Audit Office has just released a report ‘The Protection and Security of Electronic Information Held by Australian Government Agencies‘ based on a review of the approaches to information security by four agencies, the Office of Financial Management, ComSuper, Medicare Australia, and the Department of the Prime Minister and Cabinet.

Amongst other recommendations was one which has been much discussed on Twitter this morning, “emails using public Web-based email services should be blocked on agency ICT systems, as these can provide an easily accessible point of entry for an external attack and subject the agency to the potential for intended or unintended information disclosure.”

This reflects the recommendation in the Defense Signal Directorate’s Information Security Manual, the ‘bible’ for Australian Government agencies when it comes to ICT security, which states on page 100 that:

Agencies should not allow personnel to send and receive emails using public web-based email services.

The concerns are very clear and relevant – web-based email systems can easily be used, inadvertently or deliberately, to distribute large quantities of citizen’s personal information, or an agency’s In Confidence or other classified information rapidly and to large numbers of people, making it impossible to contain the spread of the information.

Web-based email is also a potential source of attacks against an agency, through viruses, worms and trojans in email attachments (which may not be able to be scanned at the same level as Departmental email can be) and through web-links in emails to compromised websites.

I don’t dispute these real concerns. They are concerns for corporations as well.

However, I do ask – what is ‘web-based email’?