Digital ID: Land of the Hornbills goes virtual

This article first appeared in Digital Edge, The Edge Malaysia Weekly, on May 31, 2021 - June 06, 2021.
“We want to know who we are dealing with in the virtual world, without our having to do the forensic work. Ultimately, we want to reduce fraud.” - Zaidi

“We want to know who we are dealing with in the virtual world, without our having to do the forensic work. Ultimately, we want to reduce fraud.” - Zaidi

-A +A

While the national government has been planning to introduce a digital identity (ID) for years, the Sarawak government went ahead and launched its Sarawak ID in 2018.

Since then, it has integrated it into 50 government applications in the state and registered more than 600,000 users, according to the Sarawak Multimedia Authority (SMA). 

Digital IDs are used to authenticate a person’s identity online. It could be tied to a national identity card (card-based) such as the MyKad or to SIM cards (mobile-based). 

The Sarawak ID is linked to the MyKad and provides a single point of authentication for users across platforms, so they need not create multiple accounts to use various services. 

“If a user has to log into five systems, he or she would need to memorise five usernames and passwords. Our staff at the back office often have to answer queries about forgotten passwords for government services,” says SMA general manager Dr Zaidi Razak.

The state began introducing online systems for people to use in the early 2000s, he observes. By 2017, it realised that there were too many accounts for people to remember. A unified digital ID to access all the systems seemed like a good idea.

Now, the Sarawak ID can be used for scholarship and government job applications, bill payments, application for welfare services and aid, as well as the state’s e-wallet service Sarawak Pay.

“By having a single online profile, the government can better manage welfare distribution and avoid duplication, so we can reach out to those who genuinely need the aid or service,” says Zaidi. 

Last year, Sarawak set up Very Small Aperture Terminal (VSAT) stations to provide internet connections to the rural population in the state while infrastructure to improve connectivity in rural and suburban areas is being built. To access the service, users need to use their Sarawak ID or verify their identity via a one-time password sent to their phones. 

Last year, SMA also introduced the e-Know Your Customer (e-KYC) feature in Sarawak ID, which allows Sarawak Pay users to conduct cross-border payments. Users are required to verify their identity with a photo of themselves. The Sarawak ID already has more than 10,000 e-KYC verified users. 

Users only need to register for their Sarawak ID once. Digital ID usage will become the norm, as all new systems funded or developed by the state will require the use of the Sarawak ID, says Zaidi. 

The digital ID is also open to private companies to adopt for free. “For instance, a start-up introduced a smart parking system in the state. It didn’t have to invest in making a log-in module. It just used Sarawak Pay, which automatically gives it access to more than 600,000 registered users,” says Zaidi. 

Sarawak ID is still not integrated with the Inland Revenue Board or Employees Provident Fund websites, but Zaidi says SMA has engaged with these national entities. Further collaboration is needed if the Sarawak ID is to be used outside the state government’s online services.

Why a digital ID? 

Digital IDs are gaining popularity globally as a solution to increase access to online services and reduce identity theft. The World Bank is promoting digital IDs as a way for vulnerable groups without basic identity documents to access crucial services such as healthcare. 

Other than the convenience factor, Sarawak introduced its digital ID also to understand how its citizens use online services.

“We want to know who we are dealing with in the virtual world, without our having to do the forensic work. Ultimately, we want to reduce fraud,” says Zaidi.

According to McKinsey, digital IDs can improve risk management for banks through a streamlined KYC process. It can also save costs. The use of a digital ID-enabled e-KYC process in India from 2016 and 2017 reportedly reduced the cost of KYC verification for financial institutions from US$5 to US$0.70 per customer.

Estonia, Denmark and Sweden have implemented digital ID systems with high adoption rates, the consulting firm adds. 

One of the outcomes for SMA is a more civil online environment, Zaidi observes. “We have apps for the public to submit complaints. Previously, without the Sarawak ID, people would submit all kinds of low-quality complaints. But now people are more responsible with what they say [because the complaints are linked to their IDs].”

The data collected regarding user behaviour will also inform the state’s services. “We want to see the utilisation of the apps in our system. Is it for social or economic activities? A lot of insights can be derived from the big data,” says Zaidi.

SMA has big plans for the future. It is thinking of using the Sarawak ID for digital signatures by 2023, supporting cross-border trade and investments, and expanding its applications in collaboration with communities or the private sector. 

“We will also introduce the corporate ID feature so that organisations can have a single recognised profile online. These are the building blocks to allow businesses to be registered online quickly and seamlessly,” says Zaidi.

How did Sarawak push ahead of the rest of the country to launch its own digital ID? Zaidi says there was a strong push from the state leadership.

“We are constantly looking into ways to enhance the platform’s level of assurance by exploring emerging technologies, including blockchain, to further solidify the trust and integrity of Sarawak ID. With that, we can create a fair ecosystem for taxation online.”

With a single sign-on service, data security becomes even more important. According to Zaidi, the data is encrypted and stored at the Sarawak Government Data Centre, which is certified with the Information Security Management standard. “It is a Tier-3 data centre, which currently has the highest level of security and privacy in Malaysia.”

What about user privacy? Zaidi says an audit trail for users’ personal data will be logged in the system, much like how Estonia does it. “This means users have to grant permission before any of their personal data can be accessed.”