Exclusive: Memo seen by Guardian Australia removed Medicare card from list of documents allowed for identity checks

This article is more than 3 years old

This article is more than 3 years old

The Australian Tax Office temporarily suspended Medicare cards from use as proof of identification documents but quickly withdrew their suspension, signalling confusion within the federal government over how to respond to the sale of Medicare details on the darknet.

An investigation by the Guardian revealed on Tuesday that a darknet vendor on a popular auction site for illegal products claimed to have access to any Australian’s Medicare card details and could supply them on request.

At least 75 Australians’ personal details appear to have been sold on the site. The Department of Human Services has referred the matter to the Australian federal police for investigation.

Medicare breach: it just got a whole lot harder to trust government with our data | Ellen Broad Read more

The human services minister, Alan Tudge, has sought to downplay the seriousness of the breach, saying it was the result of “traditional criminal activity” and was not a widespread breach.

But the ATO issued a brief advisory to staff on Wednesday that said it had suspended the use of Medicare cards for the purposes of identification verification for Australians’ tax matters.

The move suggested the ATO held concerns about the integrity of Medicare cards as a valid form of identification for Australians.

An internal memo circulated to ATO staff on Wednesday said: “As a result of recent media coverage on Medicare card details being sold on the ‘dark web’, the Medicare card has been removed from the list of DVS (document verification service) documents until further notice.

“Effective immediately, do not accept this item of proof as of the PORO (proof of record ownership) process.”

The DVS process is managed by the attorney general’s department and would have affected a range of different government agencies if it were implemented.

But, later on Wednesday, the ATO withdrew the advisory without explanation, instead telling staff that Medicare cards could continue to be used for identity checks. They were told a further formal communique would be released in coming days.

When contacted by the Guardian about the change in policy, Tudge said: “I’ve had assurances from the Australian Tax Office and the attorney general’s department that Medicare cards will continue to be accepted as proof of identification through the document verification service.

Medicare data breach: Alan Tudge admits department unaware darknet vendor selling card details Read more

“Medicare cards remain part of the range of documents that can be verified by the document verification service.

“Users can continue to use the system to verify information on Medicare cards to help prevent identity crime.

“As is standard practice, the attorney general’s department assists users of the DVS to ensure the ongoing integrity of their operations.”

As part of the ATO – and many other government agencies – identification checks, Medicare cards can be used towards 100 ID points. Many Australians who engage with the ATO as part of identification checks use Medicare cards, which can be used for 25 points.

Guardian Australia contacted the ATO and DHS to ask them about the basis for the change but both declined to comment.

The government is continuing to face pressure over the breach. Tudge was forced to acknowledge on Wednesday that his department only became aware of the breach when contacted by the Guardian, despite the information being available for sale on the darknet since October 2016.

It has also emerged an Australian National Audit Office from three years ago warned the department about flaws in the handling of Medicare information and the ease with which customer data could be accessed. It said: “Human services can significantly improve its management and monitoring of access to a key Medicare database that holds the personal Medicare details of Australians.”

The Department of Human Services declined to comment on the audit. At the time they said they had adopted all the recommendations in the report.

Catherine King, the shadow minister for health, and Linda Burney, the shadow minister for human services, previously said the breach was “incomprehensible” and have called for Tudge to explain the full circumstances that led up to the breach.

Contact Paul Farrell securely using the Signal messaging app on +61 457 262 172