How should the Australian Government balance accessibility of the myGov portal with enhanced security measures that may create login barriers for some users?

Introduction

The Australian Government faces a critical trade-off between accessibility and security for the myGov portal. This challenge requires balancing user-friendly access with robust protection of sensitive citizen data. I'll analyze this trade-off, propose metrics, design experiments, and recommend a strategic approach.

Step 1

Clarifying Questions (3 minutes)

• Context: I'm assuming myGov is a critical digital service platform. Could you confirm the scope of services offered through myGov and its current user base size?

Why it matters: Helps gauge the impact and scale of any changes Expected answer: Comprehensive platform for multiple government services, millions of users Impact: Would influence the urgency and scale of potential solutions

• Business Context: I'm thinking security breaches could have severe consequences. What's the current security incident rate, and how does it compare to industry standards?

Why it matters: Helps quantify the security risk we're addressing Expected answer: Low incident rate, but high potential impact Impact: Would determine the level of security enhancement needed

• User Impact: Based on the accessibility concern, I'm guessing there might be specific user segments struggling with current security measures. Can you share any data on user complaints or drop-offs related to login difficulties?

Why it matters: Identifies the scope of the accessibility problem Expected answer: Certain demographics (e.g., elderly, rural users) face higher barriers Impact: Would guide targeted accessibility improvements

• Technical: I'm assuming there are technical constraints in implementing new security measures. What's our current authentication system, and are there any limitations in upgrading it?

Why it matters: Determines the feasibility of potential solutions Expected answer: Legacy system with some flexibility for upgrades Impact: Would influence the types of security enhancements we can consider

• Timeline: Given the critical nature of myGov, I imagine there's pressure to address this quickly. What's our timeline for implementing changes, and are there any upcoming policy or regulatory deadlines?

Why it matters: Helps prioritize short-term vs. long-term solutions Expected answer: Phased approach over 6-12 months with key milestones Impact: Would shape the rollout strategy and experimentation approach