Keynote Speech by Mr. Tony Wong, JP, Deputy Government Chief Information Officer, at the “Access Hong Kong 2022” Conference (with photos)

Jeffrey (Mr. Jeffrey TEH, CEO of the TEH Group), distinguished guests, ladies and gentlemen,

Good morning! It gives me great pleasure to join you all today at the Access HK 2022 Annual Conference. I would like to express my sincere thanks to the TEH Group for organising this conference, which provides an excellent platform for all of us to meet and exchange views on digital identity and security. What I am going to share with you today is the work that the Hong Kong SAR Government has done in respect of “Advancing Digital Identity in Hong Kong”.

The Government is committed to developing Hong Kong into a smart city, and a secure and reliable digital identity is instrumental to such development.

Challenges on Identity Security

Nowadays, cyber threats are increasingly complex with ever more sophisticated techniques. Cyber criminals and attackers use various methods to exploit vulnerabilities of online services and get unauthorised access.

To address the security risks, my office (the Office of the Government Chief Information Officer, OGCIO) has made available an electronic authentication framework for government departments to choose the most appropriate authentication method for their online services, having regard to their security, operation, legal and business requirements.

Introduction on “iAM Smart”

People using different online services will have to manage different groups of usernames and passwords or even have to carry multiple secure tokens. To facilitate more convenient online services and promote smart city development, the Government launched the “iAM Smart” in December 2020 as a one-stop personalised digital services platform. “iAM Smart” enables Hong Kong residents to use a single digital identity to log in and use a wide range of government and commercial online services in a simple, convenient and secure manner. “iAM Smart” stands for “internet Access by Mobile in a Smart way”. It may also be regarded as a short form for “identity and Access Management in a Smart way”.

More than 1.4 million users have registered for “iAM Smart” in just one and a half years, and over 18 million usage counts have been recorded so far. “iAM Smart” account comes in two versions, namely “iAM Smart” and “iAM Smart+”. “iAM Smart” provides authentication, “e-ME” personalised data store and auto form-filling, and personalised notification functions, while “iAM Smart+” provides an additional digital signing function with legal backing.

Registration for “iAM Smart” can be done easily online. It is as simple as taking photos of Hong Kong Identity Card and then selfie with the “iAM Smart” mobile app. The system will check the security features on the Identity Card to ensure that it is genuine, and that the selfie photo is taken from a real person. Data captured from the Identity Card and the selfie photo will be checked against the trusted source, that is, the master records stored in the Immigration Department. Just a few minutes upon successful identity verification, an “iAM Smart” account will be created and bound to the applicant’s mobile phone immediately. Users can then log in various online services wherever they are by using the biometric function which comes with the mobile phone, either face ID or fingerprint.

“iAM Smart” Usage and Adoption

More than 210 online services from the Government, public and private organisations are currently accessible through the “iAM Smart” platform. Many users choose to use “iAM Smart” to regularly check their COVID-19 vaccination and testing records, login eHealth, eTAX and Leisure Link, renew their vehicle licence, and access many other services provided by both public and private organisations.

“iAM Smart” also plays a vital role in the fight against the pandemic and the recovery of the economy. Services such as online booking for COVID-19 community testing and vaccination, health code registration, the Return2hk Scheme, as well as registration for Consumption Voucher, are all backed by the “iAM Smart” infrastructure to check users’ identities against records of the Immigration Department in a fast and accurate manner, thus saving the time required to develop individual identity verification functions.

Apart from the Government, “iAM Smart” have been adopted for service login, identity authentication or digital signing by private organisations from different industry sectors. They include public utilities such as electricity and gas companies, financial services, telecommunications, and healthcare.

In the financial sector, some banks, insurance companies and financial institutions have adopted “iAM Smart” in the electronic know-your-customer (eKYC) processes, allowing their clients to complete online account registration by using “iAM Smart” for identity verification. Financial regulators including the Hong Kong Monetary Authority (HKMA), the Mandatory Provident Fund Schemes Authority (MPFA), the Insurance Authority (IA) and the Securities and Futures Commission (SFC) have all issued circulars to encourage relevant authorised institutions to adopt “iAM Smart” in their business workflow. As the remote eKYC on-boarding process can be completed anytime and anywhere, “iAM Smart” facilitates financial companies to reach out to Hong Kong residents across the territory and even outside Hong Kong.

The MPFA has adopted “iAM Smart” for MPF intermediaries to log in to the MPFA’s eService since December last year. The eMPF Platform, which is being developed, will adopt “iAM Smart” as well. It is expected that about 4.6 million scheme members can use “iAM Smart” to access the eMPF Platform progressively when it is ready by 2023.

Future development of Fintech initiatives

As I said earlier, “iAM Smart” has an “e-ME” auto form-filling function, which allows users to store ahead their general personal data so that they do not need to fill in the same information repeatedly when using online services in the future. Having regard to the views of the financial sector, a new address data function has recently been added to the “e-ME” that enables users to store the utility bills (such as water, electricity and gas services) as address proof for applying for the services provided by the Government, public and private organisations.

The Government has also been studying the cooperation of “iAM Smart” with authentication systems of other regions, for example through the mutual recognition of electronic signature certificates issued by Hong Kong and Guangdong. This will facilitate the development of cross-boundary e-commerce and e-services delivery.

To promote the adoption of “iAM Smart”, we have collaborated with Cyberport to run a sandbox programme for organisations to conduct proof‑of‑concept tests and develop application solutions adopting “iAM Smart”. The sandbox programme also provides programming training for developers which allows them to get hold of the technical details of the “iAM Smart” application programming interfaces (APIs) more quickly and comprehensively, so as to expedite their development of “iAM Smart” enabled online services. Currently, over 320 companies have joined the sandbox programme. You are all welcome to take advantage of the sandbox programme to deliver more user friendly e-services through the use of “iAM Smart”.

Digital identity plays a pivotal role in the identity and access management. A trustworthy and widely recognised digital identity will definitely help organisations to operate more efficiently by reducing the effort, time and money that would be required to manage access to their services; minimising the risk of internal and external data breaches; and facilitating better compliance with government regulations such as the Personal Data (Privacy) Ordinance. Let’s make good use of digital identity to gain competitive advantages for your business and bring better user experience to customers.

In closing, I wish you all a very fruitful conference today. Thank you.

- ENDS -