Single touch payroll Presented by Michael Karavas Program

Single touch payroll Presented by: Michael Karavas Program Director, STP March 2018

SBR 2 Service Improvement Presented by: Joe Maxymenko Digital Partnership Office March 2018

DSP Consultation– Workload Distribution Research SBR 2 Service Improvement: The ATO is continuing to execute its SBR 2 Service Improvement Strategy Where we left off and what we are doing? Re-architecture for resilience Phase 3 - Future Infrastructure and Platform investment Phase 2 - Now Migration to cloud From Performance and Operational improvements Phase 1 - Initial focus (current architecture) Improving performance and availability August 2017 • Reducing single point of failure • Introducing additional SBR 2 services offering in AWS Cloud. • Improving availability of backend systems. From Dec 2016 • Capacity modelling for PLS/STP/Super transaction loads • Implementation of increased capacity • Availability enhancements to shared, middleware and backend systems • Service Management and Service Operation improvements • Rigorous performance testing regime Re-architecting for improved resilience 2018 and beyond • Higher level of availability and resilience. • Turning capacity to align with demands, such as PLS, STP and Super Reform. Desired Outcomes • Feedback, are we on track? • Feasibility? Complexity? Cost? Preferred Timelines? 3

Remediation Options DSP Consultation– Workload Distribution Research Advantages Option 1: Current Two-URL configuration DSPs Current URL Load Balancer PROD 1 DSPs Current URL Load Balancer PROD 2 ü DSPs employ different URLS on the basis of payload being processed. ü Change is likely configurable. ü Can be used now. Option 2: Chatterbox (Workload distribution) ü DSPs New PROD URL PROD 1 Chatterbox* ü PROD 2 Additional SBR 2 platform instances can be incorporated with no impact to DSPs. Change allows for safe migration and process “long running transactions” Disadvantages • Business Continuity not supported for long running transaction (eg Push/Pull). DSP’s will need to support users in transition. • DSP will be required to make ongoing changes when new platform instance URLs are provisioned. • PROD-1 instance is not fully highly available, AWS is the DR site. • DSPs will be required to make a one-off URL change. • DSPs may not have capability to select gateways to process the payload. *Chatterbox is the name of the process/technology approach being taken by the ATO to enable workload distribution 4

DSP Consultation– Workload Distribution Research Universe Resource Identifier (URI) Field description The proposed URI change for chatterbox involves introducing 4 new identifiers (Name/Value pair) appended to the current URL. The conceptual structure is. Current – URL • ? Service=http. . Action=Submit Productid=xxxxxx Push. TS=yyyy-mm-dd. Thh: mm: ssss Service – variable selected with a future proofing intent. ATO might choose to route payload (DSPs) to different environments based on business intent of the DSP. The STP payload is the starting point with PLS, Super to be transitioned at a later date. o If ATO chose to subsequently go cloud native, it is very likely the ATO will initially do this initially for STIC & STP, i. e. two services with very high availability needs. • Action – this is a logical extension of the previous variable. It’s possible that the ATO may choose to host the “prefill” step of a service in a different environment to the “submit” as these two actions have very different characteristics (prefill may need a “cached” response, but submit will only ever be queued). • Product ID – enables configuring DSPs specific routing. It will allow us to choose which DSPs are ready ~ some DSPs may have unforeseeable sensitives (hopefully not) to environment, e. g. due to timing differences, return messages, etc. • Push. TS (Push timestamp, i. e. when was the first step in the exchange sent) – this is necessary to sustain the stickiness of the MEIG. That said, if a DSP can start sending their messages to AWS; this field will allow us to recognise the “new” messages that can go to AWS and the old messages that must still be serviced from on-prem. 5

Digital Identity Program OVERVIEW Presented by: George Afarian Digital Business Coordinator March 2018

Digital Identity and Govpass Background - ATO is working with other agencies including Digital Transformation Agency (DTA), Department of Human Services (DHS) and Department of Home Affairs (DHA) - Initial focus is on delivery of: o AUSid, an enrolment capability and a modern credential that securely identifies an individual o Relationship and Authorisation Manager (RAM), a solution that allows an individual or business to represent another business - We will be progressing via “staged” releases o The first release will enable AUSid for people representing a business for ATO/ABR services (without face verification) o A future “pilot” will enable AUSid for individuals applying for an TFN or using ATO and other whole of government (Wof. G) services (with facial verification enabled) o Later pilots/releases will expand AUSid to Wof. G business services and replacement of device AUSkeys - Existing solutions continue to be available in parallel (AUSkey, my. Gov, Cloud Authentication and Authorisation, Managing ABN Connections) - Consultations and user design have commenced - This is a complex Wof. G program of work and it will be subject to stage gate release processes. UNCLASSIFED – Digital Identity Program: DSP Strategic Working Group 7

Why does ATO need a contemporary & secure Digital Identity solution The need for a strong identity and credential is more important than ever. The ATO has a number of commitments and priorities that are dependent on secure online digital identity solutions: Increased Trust and Certainty of identity • Increases strength for enrolment and credential • Reduces risk of identity theft • Delivers on key Operational Framework objectives • Enables new cyber security monitoring capabilities Enabler of key outcomes on the ATO program of work • Single Touch Payroll (e. g. employee & employer) • Tax agent services (e. g. Enables mobile optimised access to new ATO Online services for Tax Agents) • Operational Framework requires enhanced identity Offers end-to-end digital (enrolment to consumption) • All applicants are digitally enabled from enrolment • Supports growth in digital adoption • Complements next generation mobile apps • Supports e-commerce services (e. g. software services) Fulfils requirements for multiple taskforces • Black Economy and Phoenix • Serious Financial Crime Taskforce Replaces legacy technologies • AUSkey is reaching end of life (March 2020) • Password technology (weak) • SMS codes are increasingly vulnerable Improves management of Authorisations • Improves client experience • Enables transparent authorisation across channels • Consumable across agencies and channels (e. g. mobile app) UNCLASSIFED – Digital Identity Program: DSP Strategic Working Group Digital Identity Improves integrity of Business Registers • Greater confidence in identity for associates of all entity types (primary enabler for Registry Modernisation) • Primary enabler for Director Identification Numbers (DIN) Reusable in Business to Business (B 2 B) interactions • TBC 8

What is Digital Identity? Establishing confidence in a user’s identity The combination of identity enrolment strength and credential strength, provides the overall level of confidence that a person is who they say they are. • Level 4 Requirements for level 3, Identity An established set of attributes related to an individual ü Name ü Address ü Date of birth Authentication The process of verifying a known identity plus in-person interview • Level 3 Verification of identity attributes through DVS. Facial verification through FVS • Level 2 Verification of identity attributes through DVS • Level 1 anonymous or pseudonymous identity (i. e. contact details used) ü Proof of Record Ownership ü With the use of a credential* (my. Gov username and password or AUSkey) *A credential is the “technology” used by a user for authentication Authorisation Permission to view information or perform functions on behalf of an individual or organisation. • Level 3 Multi factor authentication (incl. trusted device and asymmetric keys)* • Level 2 Two factor authentication (combination of something the person knows and has) ü Associate / employee representing a business ü Authorised contact representing an individual • Level 1 Single factor authentication *Trusted device: A device which has been confirmed as a device the person holds. Asymmetric keys: Public / private keys paired for secure transmission of data. UNCLASSIFED – Digital Identity Program: DSP Strategic Working Group 9

Future Digital Identity Experience phone AUSid Bob TFN: 123 456 789 – Bob Smith ABN: 12 345 678 910 – Bobs Cafe TFN: 123 456 781 – Jane Smith ATO Bob TFN phone on-line Bob L retodge urn Credential Suite U depdate tai ls ac View de coun tai t ls Jane (spouse) Password Bob’s identity SMS code Voice on-line Jane TFN ABN (A) mobile ABN (B) PKI mobile Others Authorisation Matrix Bobs Café & Catering Bob establishes identity once & is enabled for ATO & other agencies UNCLASSIFED – Digital Identity Program: DSP Strategic Working Group Bob can use a suite of credentials that enable portability when accessing services An authorisation matrix determines what Bob can access and do. He can view/manage access & credentials in one place Bob can choose separate credentials to access individual and business services Bob authenticates once to access all his roles through any channel 10

Wof. G Digital Identity Govpass Program Components Australian Business Register Document Verification Service (DVS) Identity Proofing Providers (Id. Ps) RAM AUSid Id. P Facial Verification Service (FVS) Other Government Id. P ? The “Exchange” Australia Post Id. P? VISA Australian Passport Drivers Licence Private Id. P? ATO Services (e. g. Online Services, ATO App, TFN Application) Other Commonwealth Agencies State Agencies Other Wof. G services (e. g. my. Gov Portal, Inbox, TUO) Other Government Agencies Private Sector (e. g. Digital Service Providers, Banks) UNCLASSIFED – Digital Identity Program: DSP Strategic Working Group 11

Digital Identity Working Group - A Digital Identity Working Group has been established to consult with DSPs - The working group is comprised of representatives across the DSP industry - On 16 March the group held their inaugural meeting - Look out for progressive updates and key outcomes on the software developer website and in the DSP newsletter UNCLASSIFED – Digital Identity Program: DSP Strategic Working Group 12

Managing Adoption and Transition Risks Soft Launch – No ‘Hard’ Cutovers during 2018 - Co-design underway with businesses, testing prototypes and iterating design - Commence with a limited user group in a private beta to obtain feedback - Public release will allow business representatives to choose between AUSid (or continue to use AUSkey for portals) Continued support for existing credentials - AUSkey and Cloud Software Authentication and Authorisation solutions continue to work in parallel with existing support arrangements - No direct impact to your use of software in 2018 Phased transitions - The solution won’t work for everyone on day one. Features and support will be added over time - AUSid may be available in software in the future, but initial focus is on the services (ATO Online, mobile app, portals) UNCLASSIFED – Digital Identity Program: DSP Strategic Working Group 13

Web-service Update Information and artefacts available on Software developers webpage: e. Commerce Schedules and Scope Presented by: Michael Ferris Project manager, DWS March 2018

Tiering Model Presented by: Doipayon Halder DPO Account Manager March 2018