One issue that all eEngagement processes face is that of the identity of participants in the process. While it is often difficult (or unnecessary) to determine the identity of individuals in physical meetings, the capacity for people to participate using ICTs from any location gives rise to public sector managers’ concerns about the potential for misrepresentation in the eEngagement process. Depending on the process being developed, this may be a significant issue (e.g. for an electronic voting system), or of little or no consequence (such as when collecting ad hoc comments online for a minor issue).
At the level of technical management, however, managing identity in online participation can be one of the most complex and difficult areas of decision-making associated with developing eEngagement approaches. The issue of identity has two dimensions:
The desirability of identity management for online systems is the first question that needs to be addressed in development of any approach to managing personal information in the online consultative, or participative process. The primary question that needs to be addressed here is, whether there is some basis for exclusion from the participatory process.
This may appear, on the surface, to reflect a negative approach, however, the question is underpinned by the following considerations:
While it may appear obvious that entry into the process will be controlled, it is not always clear that restrictions on participation need to be enforced. Exclusion from a participation process can be difficult to justify to affected persons or stakeholder groups, particularly if:
Overall, the question of eligibility can be broken into three levels:
Exhibit 20: Is This a Local Issue?
In the development of a citizen-based consultative process to develop alternatives to the official World Trade Centre re-development process, the America Speaks project team limited participation in the online forum to people living in and around New York. The team soon received requests to participate from across the United States and while these requests were politely declined, people from outside of New York managed to find their way into the process.
When asked, these people stated that the World Trade Centre was an American issue, not one simply for residents of New York and that they had strong personal feelings about how the site was being treated following the 9/11 attacks. They implicitly questioned the eEngagement managers notions of who had ‘legitimacy’ to participate in debate surrounding the redevelopment of what would be an iconic national project.
They were allowed to take part.
One of the important issues to remember in this early phase of decision-making, is how restrictions on participation (or the lack thereof) shape outcomes. In some circumstances, it may be considered necessary to apply controls whilst not discouraging broader participation. In such cases, a two-step process may be required that allows open participation in more ‘general’ forums, on the one hand (such as participation in a discussion forum), with restricted participation in deliberative forums (targeting individuals or groups falling under a specific category [citizens], or though a secondary sampling system, such as delegation to a group of elected spokespersons).
Following the determination of the necessary levels of eligibility and identity verification, the next question (and one which will shape the technology used for the consultative process), will pertain to the technical means by which identification can be assessed (either to manage access to the system, or as part of the pre-participation approval process).
While some computers have a fixed internet address which allows websites to identify them on an ongoing basis, most computers do not, making it difficult to identify a user from one visit to the next. To manage this difficulty many websites use ‘cookies’. A cookie is a small computer file placed on a user’s hard drive to record data about a previous visits to the website or service. The cookie allows a computer to be identified and information stored about that computer’s activities. Cookies can be useful in:
- storing preferences about how webpages should be displayed;
- storing user identification information to allow the user to ‘automatically’ log into a web service;
- retain a memory of the user’s activities or pages visited; and
- developing a usage pattern for users to improve the service or information structure.
While these advantages are significant, there are also problems associated with this approach:
- some users will not accept or use cookies, either because of concerns about privacy, because the computer they use is unable to accept them, or because they use a shared computer (such as a public access terminal);
- while some users secure their computer by using a personal password, not all do – authenticating via cookie only authenticates the computer, not the person using it. Allowing a cookie to automatically authenticate a user may allow a third party to impersonate the user; and
- cookies can identify websites that have been visited by the user, this may be undesirable if the issue is sensitive or the user is at risk (e.g. a consultation associated with family violence).
These technical questions are best undertaken in direct consultation with security and IT staff and must, at least, include consideration of:
This last point is particularly relevant where the administering agency uses pre-existing information about the participant and uses this to collect policy-related or personal information. In this case, privacy legislation will require physical or electronic separation between the corporate knowledge used to provide secure entry into a system and the information provided by individuals during the eEngagement process.
In addition, careful consideration of this approach will be necessary where the eEngagement process requires both user validation and user anonymity. This can mean either complete anonymity throughout the whole process, or levels thereof – such as anonymity within a discussion forum (between members of the public), but where the agency has the capacity to identify and follow-up on specific participants.
Overall, online identity management – to greater or lesser degrees – depends on issues that are outside the control of the agency (such as the ability of the users to ensure that they have a secure computing environment, or their capacity to remember and keep passwords secret, etc.).
While an agency may develop a robust security and identify verification approach, this can be undermined by users themselves. Security and identity supervision is about risk management and reducing the probability associated with fraud or impersonation.