(updated May 8 with new facts, events, and comments)
Back in December I wrote about Passport Canada and how most of its $300 million annual budget goes to pay (a lot of) humans to do poorly what less expensive systems can do much better.
Since then Passport Canada has been running around the country with “roving clinics” of people flown in and housed for a few hours or days to help clear backlogs in various cities. ”More people” seems to be the answer to a lot of challenges at this “special agency”.
In the last month or so, a few things have changed at Passport Canada.
First, they have a new CEO – M. Gérald Cossette has been replaced by Mme. Christine Desloge while M. Cossette heads up the G8 summit in July of next year. How do I know this? I received an auto-reply to an email I sent to M. Cossette advising him of a serious security problem in his forms. (more on the forms later).
So the CEO leaves and there is no press release, no backgrounder on the new CEO, nothing on their website. If an agency is “special” enough to have its own CEO, shouldn’t it be important enough to warrant a press release?
That brings me to number two – a press release on April 3rd warning Passport Canada customers to beware of and avoid “swindlers” – which in their definition seems to be anyone trying to offer more online resources to accurately and quickly submit a passport application. May 8, 2009: Update on “the swindlers” - Well, the swindlers either went away and or someone at PPTC fell asleep at the switch (likely). Mysteriously, the warning about us bad guys is still there but when you click on it you get the 404 error indicating the presence of incompetence. Wait! Maybe the swindlers took it. Hold. Let me check. Nope, we didn’t take it.Why are online service providers offering basic “fill in the blanks” services suddently the bad guys? Because Passport Canada just turned off its own online application preparation service!
That’s right, their online service is GONE. When was the last time you saw an organization go backwards by removing an online service in favor of paper? Rather than improving the online service (it was poorly designed) to make life easier for Canadians paying $87 for their passports, Passport Canada concluded that paper forms are better for you. They are now promoting what they call “a new generation of interactive forms” which have a “bar code” and are “more secure” and “easier to use”. Really? These forms are, to quote Shane Schick, Editor-in-Chief of IT World Canada, “a technique that was last considered innovative in 1998″.
Whatever is really new is obviously really hidden because the forms are nothing more than same unintuitive PDF forms they have been using for years, save for maybe a few more embedded tips and suggestions to help further clutter the already poor layout. You still have to print the things and show up in person if you want to achieve the shortest turnaround time of still two weeks, that is, of course, unless you want to pay a big premium for rush or urgent service.
Now, back to the so-called “secure” bar code. This bar code is anything but secure as my company ServicePoint recently revealed through our testing. The first problem is that it is not a “bar code”, rather a “QR Code”. QR stands for “Quick Read”, which is exactly why the code represents a serious security breach waiting to happen, if it hasn’t happened already. Bar codes typically contain static information such as a product or tracking number, not Canadians’ personal information.
QR Codes are essentially billboards that present information in a way that allows it to be read quickly by software. In fact, in some countries, the codes are actually billboard size and people capture pictures of the Code with their cell phones, where the picture is instantly converted into textual information. This is exactly what people can do easily with the “code” on your own Passport Canada form after you fill it out.
When Canadians fill out their passport application by entering information into the PDF document, some of their most personal information is stored in the QR Code that is printed on the form. Using simple, free, and widely available software, anyone who found this juicy little leftover from a torn up application or snapped a picture of your code from over your shoulder while in line at Passport Canada, could steal your personal information.
If you want to see a demonstration and explanation of this, check out the video and presentation we put together.
Strangely, back in March, Passport Canada said the information in the bar code was “encrypted”, then in early April they said it was secure, now on April 9th they stopped saying it was secure in their FAQ, but continued to say it was secure elsewhere on their site.
Update: Later in the afternoon on April 9th they changed their site again!
To see the evolution of their claims check this out.
So Passport Canada, does the “bar code” “secure” the applicant’s personal information? The forms haven’t changed over this period but Passport Canada’s statement’s about security, or the lack thereof, certainly have. Why can’t they just tell consumers in simple language that their personal information is represented in the “bar code” and it is not secure? In fact, if Passport Canada is concerned about being accurate, they should stop calling it a “bar code” because it isn’t a bar code, it’s a QR Code. Yes, many Canadians, if asked, would call it a bar code, but those same people wouldn’t think this seemingly innocuous little square of black and white blocks contains their personal information.
To help you understand the issue, check out the presentation and video available at this page which describes and demonstrates just how insecure we think their “new” and “more secure” forms really are.
Why can they operate this way? The simple answer is because we let them. Seriously, it takes a real concerted effort to even get their attention. Just read the many bloggers online complaining about the lack of response to even the most simple things – like finding out who runs various regional offices. This is not the way a $300 million “company” with a “CEO” should be run.
Speaking of the CEO, specifically their former CEO, Gerald Cossette, I refer to an interesting letter I received from him in July 2008. It is posted here. The reason I received this letter is because my company, ServicePoint Inc., had developed and introduced to Passport Canada a completely integrated self-service kiosk that would facilitate the preparation and submission of a passport application in one 10 minute session. These kiosks were so inexpensive they could be deployed in hundreds of locations across Canada, essentially eliminating the need to go a passport office. To cut to the chase, after six months of trying to get Passport Canada to even look at the kiosk in person and test it, I got the letter from the CEO which essentially said ‘go away’. Some will find the rhetoric and my response an interesting read as it provides some insight into how the government ‘thinks’. If you want the details about the kiosk and our subsequent work to develop our online service, Passport Wizard, read on. You might find that interesting too.
Introducing the “Avro Arrow” of Passports – the ServicePoint Kiosk
The “ServicePoint” kiosk addressed one of the biggest problems in the passport application and submission process which is the acquisition and submission of the applicant’s passport photo. The kiosk was able to take a digital passport photo, instantly display it to a centralized photo adjudicator (to make sure it was compliant), then accept the submission from the applicant.
As many people are aware, passport photos are one of the most common reasons applications are rejected by Passport Canada. The logical approach was to make sure the photo was compliant at the point it is taken, not when the applicant gets to the service counter after waiting in line. Further, in the age of digital photography, it makes absolutely no sense to continue the
process of taking a photo, printing it out on paper, taking it to Passport Canada only to have them scan the photo back into digital format. Not only is this highly inefficient, the photo quality is compromised when it is scanned. Also, as the passport is suppose to be a highly secure and reliable ‘breeder’ document, leaving the applicant in trusted control of the photos creates the potential for tampering.
The development of Passport Wizard
Without the cooperation of Passport Canada the kiosk was not feasible, as it relied on electronic photo and data submission, so we decided to try and salvage our efforts without their cooperation by developing an online preparation service called Passport Wizard (available at www.passportwizard.ca). The service helps Canadians prepare their passport renewal (60% of applications are renewals) and it also directed people to a nearby passport photo provider. What does Passport Canada think of Passport Wizard you ask? They have never contacted us directly about it, but they did post that nasty notice “Don’t Get Swindled” on their site in early April, calling any outside parties aiding Canadians with preparing their passport applications “swindlers”. As I said in my letter to news site www.soonews.ca, ““what looks to be more criminal is Passport Canada getting away with charging Canadians $87 to renew their passport using outdated, expensive, manual processes that are keeping thousands of Canadians employed in government jobs doing basic administrative tasks.”
It is important to mention that Passport Canada has never had an online service that assisted Canadians in preparing or submitting a request for a passport renewal, although they did (past tense) have a way to a prepare a completely new application. This, of course, makes absolutely no sense as those renewing their applications have previously had their identity and citizenship verified, so the application process should be little more than submitting updated photos. Strangely, it costs the same $87 fee to renew a passport as it does to apply the first time. And for those of you who never used the Passport On-Line service, it was simply a way to fill out your passport application and submit the information to Passport Canada. You still had to show up in person at one of the few Passport Canada offices across Canada, with the printed version of the form and present proof of citizenship and identity and, of course, your passport photos. The benefit of using Passport On-Line was that you were put in the so-called “fast lane” at the passport office, and when you finally got to the counter, processing was speedier, because your application was already in ‘their system’. That’s now gone.
There were some obvious issues and limitations with their online system. First, it discriminated against anyone who wasn’t within a reasonable drive of a Passport Office. The former CEO of Passport Canada claimed (in his letter to me) that 95% of Canadians are within 50kms of a Passport Canada office. The next problem was that you needed a Government of Canada ‘epass’, before you could proceed to use Passport On-Line, and getting an epass was a separate and daunting process, full of techno-bable and dire warnings. As a result, people took one look at it then bailed, – according to a Passport Canada spokesperson, only 1% of people applying for passports used the service. No wonder. And finally, probably the biggest issue, it was only for new applicants. People renewing their passports using the “simplified renewal” method couldn’t use Passport On-Line. So, when the PR pros at Passport Canada throw out impressive statements and statistics like “only one percent of applicants were using Passport On-Line” and “it wasn’t as convenient as the paper forms”, you should turn your head from side-to-side.
If you want my opinion, whether by design or accident, Passport Canada designed their online service to fail. Remember, they have a huge $300,000,000+ budget that they have to burn through, they need a lot of offices, people and infrastructure to eat up that much of your money.
As many Canadians have correctly speculated, “there must be a better way.”
There is a better way to apply for a new or renewed passport but it isn’t necessarily the labour-friendly way. The structure, policies and service levels of the current system as defined by Passport Canada are masterfully designed as if the intent were a make-work project. The reason that the majority of applicants show up in person is because doing so achieves the ‘shortest’ turnaround time of two weeks. Delivering your application to Passport Canada by any other means results in at least double the processing time. Other means including dropping off your application at one of the 150+ “Receiving Agents” (like Canada Post and Service Canada), and, incredibly, also for the ‘mobile passport clinics’ they wheel around the country. Yep, Passport Canada has made the process so complicated and cumbersome that they needed to deploy an outreach ‘clinic’. It is important to point out that there is no requirement to show up in person to apply for a passport, but if you want the fastest turnaround time, you do need to visit a nicely appointed, inconveniently located, Passport Canada office.
Another non-obvious contributor to the volume of people showing up in person is the need by many applicants to retain their original identity and citizenship documents, rather than sending them in the mail and hoping they don’t get lost. In the case of people renewing their passport, they don’t have to have their identity or citizenship verified again but they do have to surrender their existing passport or have it invalidated by cutting off a corner. This one little policy creates a massive amount of workload and lost productivity. IF Passport Canada removed this requirement, huge savings would be in order all around. There are many reasonable approaches to dealing with this, one of which is being trialed in Peter MacKay’s constituency. (Peter is the Minister of Defense). Specifically, in New Glasgow, Nova Scotia, the Service Canada office has ‘special’ powers that allow them to verify identity and citizenship documents and then return them to applicants on the spot, alleviating the applicants from surrendering t
he important documents to Passport Canada. Could it be just a coincidence that Passport Canada just happened to try this in the riding of a Minister?
he important documents to Passport Canada. Could it be just a coincidence that Passport Canada just happened to try this in the riding of a Minister?
Oh, and if you are wondering what Passport Canada’s response has been to the media attention we have brought them, this is the best most scandalous part of this whole saga. Shortly after we brought the bar code issue to their attention last week I noticed an odd entry in the web logs of my web server that serves up the pages at mcmullin.ca. Someone inside the walls of Passport Canada initiated a Google search for the words “bill mcmullin bad news”. Below is the log file verbatim to prove it. The IP address resolves to Passport Canada as you can see below. Why would someone inside Passport Canada be searching for such information???
198.103.211.131 – - [06/Apr/2009:17:54:01 -0300] “GET /2009/03/the-bad-news-blog.html HTTP/1.1″ 200 33459 “http://www.google.ca/search?hl=fr&q= Bill+Mcmullin. bad+news&meta=” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)”
NSLOOKUP Result for 198.103.211.131
131.211.103.198.in-addr.arpa name = int1.pptc.gc.ca.
131.211.103.198.in-addr.arpa name = int1.ppt.gc.ca.
I think the entire area of government services from passports to driver’s licenses– it’s all a bunch of bull. I read the article on the Sault Ste. Marie news site and the fragment of the letter that was mentioned was ridiculous. If at all possible I would never both with this apparent more personal touch to the passport process. Those people at government offices are so rude and obnoxious that it pains me to even think of having to renew my passport.