Last updated 25 December 2020 - Average reading: 12 minutes
By definition, Identity Management is at the heart of any government's responsibilities to its citizens, empowering their existence and enabling associated rights.
Quite simply, establishing citizens' identification, delivering civil IDs, driving licenses or passports, and respecting the duty to care and protect this information, are perfect examples of the responsibilities that come with a State's right to sovereignty.
However, the development of secure and robust identity management systems is becoming ever more technically complex and requires increasingly significant investments.
Simultaneously, against in an international context characterised by high levels of public debt, governments must concentrate relentlessly on public service efficiency and make tough choices regarding the priorities they face.
Fortunately, financial markets have a real appetite for investment in projects brought by the private sector.
Therefore, private companies presenting sound business cases enjoy access to several sources of funding.
The good news?
This brings us to our next point.
PPP: definitions, benefits, models, KSFs
In this web dossier, we are going to present the key concepts, issues, and challenges that must be addressed by public authorities and private companies seeking to launch a successful PPP for Identity Management in the following five chapters:
- Standard terms and PPP definitions
- Main benefits offered by a PPP compared to traditional procurement processes
- Risks and responsibilities inherent in the implementation of such projects
- Key success factors (KSFs) for a PPP
- The role the public authority should play.
Two PPP examples of ID infrastructure development will illustrate the diversity of Public-Private Partnership models.
Let's get started.
1. What are Public-Private Partnerships?
There is no international consensus on the detailed definition of a Public-Private Partnership (PPP).
In practice, such initiatives take various forms, depending on both the prevailing legislation and the cultural characteristics of the stakeholders in the country concerned.
However, from a business perspective, a PPP is generally described as a long term agreement between a public authority and a private company (or consortium), whereby the private company administers some services that usually fall under the competence of the public authority.
The agreement defines common objectives and precise specifications of outputs related to infrastructure and/or public services delivery.
PPPs often include a form of project finance in which the private sector handles the upfront costs for public infrastructure provision.
Let's dig a little deeper.
There are two main types of agreement.
PPP agreement
A PPP agreement, whereby the public authority retains the public service mission, invites the private company to finance, build, renovate, operate, and maintain the infrastructure and/or supply a service.
Under this long-term agreement (typically 10 to 15 years), the private company generates its revenues via a fee charged to the public authority. These revenues are linked to performance objectives defined in the contract.
Responsibility for project financing falls mainly on the private company; however, the public authority can also participate, in particular via grants.
According to the terms of the contract and on a case-by-case basis, risks are shared between the public authority and the private company. In general, the technical and operational risks lie with the private company, the traffic risks* with the public authority.
*In the case of Identity Management, this is measured either by the volume of documents supplied or events on which the service's valuation is based (such as enrollment or number of border crossings).
At-a-glance: the PPP model
- Public authority pays for the service.
- Public authority keeps the public service mission.
- A private company acts as a supplier to the public authority.
Public-Private Partnership vs. Concession
A Concession, whereby the public authority (known as the "concession authority"), grants the private company (known as the "concessionnaire") the right to use its assets.
Under this arrangement, the concessionnaire is responsible for the operation of the infrastructure and the public services and bears the risks and costs related to the administration of the existing infrastructure and assets and any new facilities.
The concessionnaire bears responsibility for all the related investments and is remunerated by citizens.
Not surprisingly, a concession is a long term agreement. In the field of Identity Management, ten years constitutes a minimum to amortise investments and cover risks.
The public authority retains ownership of its assets. This ownership includes any assets acquired by the private company during the concession period.
At the end of the contract, the public authority recovers its assets in their correct State.
At-a-glance: the concession
- The private company acts on behalf of the public authority.
- The citizen pays the private company for the service.
- Public authority keeps control and benefits according to the concession contract.
What are Build Operate Transfer or Build Own Operate Transfer agreements?
Acronyms such as BOT (Build Operate Transfer) or BOOT (Build Own Operate Transfer) are commonplace in Public-Private Partnership models and concession agreements; however, they can create discrepancies and misinterpretations within the definitions provided above.
PPPs and concessions are two types of agreements well defined by laws based on codes, such as the one in place in France.
Even if the same concepts and principles are used, under the system of common law, the priority lies in the parties' willingness to reach an agreement.
This willingness is behind many contracts that are built around such acronyms; they are "tailor-made," with their title presenting the main characteristics agreed by the parties involved: for example, Design, Build, Own, Operate, Finance, Maintain, Transfer, etc.
Biometric population enrollment or registration is often crucial in modern national identity management programs.
2.Key benefits of the PPP model for governments
In the field of national identity management, government should consider a public-private partnership model if it is convinced that partnering with a private company or consortium will realise better value for money than supplying, financing, and operating such services itself.
Let's consider the main benefits:
Improved public service efficiency
Partnering with a technological expert accelerates the modernisation of public administration.
There's more.
A delegation of operations such as implementation, operation, technical support, delivery, communication, and funding to an experienced private company will free up resources to improve the elements of the service that fall exclusively within government ownership.
And the best part?
These resources can be allocated to other vital services for citizens.
More rigorous budget management
Identity Management projects require a high level of investment to build a secured process that extends from enrollment to the delivery of documents and access to government services.
Moreover, they are difficult to launch because such investments are risky and impact the government's budget and debt level.
With a PPP model, these constraints are alleviated:
- No upfront investment is demanded of government. Instead, this is shouldered by private investors, stakeholders of the private company, or lenders. Costs are spread over the contract's lifetime, enabling government to plan the modernisation of its identity management programs more quickly.
- The private company takes implementation risks. Timetables are defined within the contract; any deviation must not be at a cost to the public authority.
- Operational risks also fall on the private company's shoulders. Indeed, this is the first commitment made within a PPP. The service level is agreed upon between the partners and must be adhered to throughout the contract's lifetime.
Broader economic development
Under a PPP, a private company makes a significant investment in the country's infrastructure - and manages it throughout a long term agreement.
Moreover, the private company does this by supplying its technology and providing experts to set it up and employing and training a local workforce.
In the process, these employees acquire a high level of skills that can subsequently be used to benefit other sectors.
The private company will also use local partners for implementation and operation, creating another channel for the diffusion of technology within the country and increasing diversification of the local economy.
Furthermore, a significant private company within a country provides the perfect platform for further synergies and the 'cluster effect': developing other businesses, making additional investments, and, ultimately, participating in and contributing to the country's overall growth.
Public-private partnership example #1 - The Swedish Police experience
In January 2012, Sweden launched a new generation of its electronic passport and national electronic ID (eID) card.
To enable this ambitious program, Thales was chosen:
- to manage the end-to-end delivery process, including the live enrollment solution in Sweden for the production of all secure ID and travel documents
- and the operated issuance services.
More specifically, the contract signed with the local authorities in 2011 encompasses the software for registering applicants' data, along with enrollment kiosks for instant capture of their photograph, fingerprints, and electronic signature. Thales provides the operated issuance services, ensuring document personalisation from its facilities based in the Stockholm area.
Notably, the same infrastructure and procedures are employed for both the National eID card and the ePassport. This model leads to significant savings in terms of equipment, processes, systems, and staff training.
The Swedish Police consider expertise to be of paramount importance in performing their service functions. Each citizen is treated as a customer to be served with the utmost competence and efficiency. And this is precisely what Thales offers via its operation centre in Stockholm.
The police's bottom-line objective of providing a quality service and optimising the use of taxpayers' money were the primary drivers for outsourcing.
But the police have also maintained the fundamental characteristic of its operations: authority and the control that such authority guarantees.
Outsourcing production and personalisation services to Thales based on a PPP model allow the Swedish Police to combine the latest technology with technical expertise. Moreover, it ensures that its resources are not bogged down by functions that do not enhance their core competencies - such as printing documents and managing the logistics required to distribute them.
Besides, the increasing complexity of the technical environment, the challenge of hiring qualified candidates, particularly for IT operations, and the lengthy procurement cycle necessary to upgrade technology also represented valid reasons for the Swedish Police to consider outsourcing to Thales.
As the Swedish Police's scope continues to grow, they have in place industry-best processes and the scalable model needed to ensure an on-going cycle of efficiency improvements.
3. Risk sharing in PPPs
Deploying a physical and digital Identity infrastructure and operating it efficiently are significant challenges. But with the PPP model, public authorities can transfer some of the risks involved in a private company with the skills and experience to better handle them.
Indeed, the concept of risk-sharing constitutes the very essence of the partnership. Ultimately, only risks related to the execution of the governmental responsibilities remain with the public authority.
4. Key success factors for a PPP
A PPP starts with a business model then grows into a partnership. Public authority and private companies must act as partners. To achieve this close relationship, both parties must build trust based on each partner's credibility.
The right experience and skillset
Managing an Identity Management service in PPP mode demands implementing all the related infrastructure and operating it throughout the contract. This process requires technical skills and in-depth field experience to guarantee nationwide deployment efficiently and timely.
References are vital to providing the public authority with confidence in its future partner.
Furthermore, the public authority must pay careful attention to the profiles of all the employees who will manage the service in the future, in particular, the technical staff.
Why?
That's because they represent the first level of control to warrant those operations throughout the service chain are always undertaken securely.
Robust financial capability
Assuming that the business case proposed by the public authority is profitable, such an opportunity should attract a private company or consortium willing to implement and operate the project.
They must demonstrate their capability to manage the local entity, its cash flow in the local currency, and all the financial and legal steps related to such processes.
It is then likely that the private company will ask several investors to participate and invest in the project via equity or various other types of loans.
It is also essential to verify that this group of investors and lenders is genuinely dedicated to the project's success in the good times and the bad, which may be encountered from time to time throughout any contract.
A sound and securely funded company is undoubtedly one of the critical ingredients for a successful PPP.
Even when a business proposed by the public authority is credible and wins support, long-term contract challenges and problems may arise. Partners can overcome such hurdles, but this may well involve protracted negotiations.
Above all else, the project must continue to run; any compensation necessary can be settled later.
Public-private partnership example #2 - Senegal
Traffic in Dakar, capital of Senegal
The Senegal government has handed Thales responsibility for the design, implementation, and management of a comprehensive modernisation of the country's driver and vehicle licensing and registration programs.
Thales, working with local partner Face Technologies, has signed a multi-year Concession Agreement with the Ministry of Infrastructure, Land Transport and Disruption that includes migration to advanced eDriver and eVehicle licenses with new road transport licenses, secure registration plates, and mobile verification terminals for the police.
Dramatic improvements in the security and efficiency of enrollment and issuance are to be achieved, cutting fraud and optimising government revenues.
Awarded in 2017 after an international tendering process, the agreement is part of the Senegal government's ambitious reform strategy and will support the Program of Improvement for Transport and Urban Mobility.
Thales' end-to-end solution incorporates financing, design, realisation, operation, maintenance, management, and training to transfer competencies to governmental agents.
Starting in September 2018, Thales is supplying and managing the entire lifecycle of a series of advanced electronic documents, including:
- eDriver Licenses – with a microchip to store the holder's personal and biometric data
- eVehicle Licenses – also with an embedded chip and advanced security elements
- Road transport agreements – freight transport, private passenger transport, etc.
- Secure vehicle registration plates - with a windscreen barcode label to facilitate verification
- 850 new tablet-style terminals to enable on-the-spot checks by police
To optimise customer service, Thales has modernised and will operate 13 enrollment and issuance centres in existing offices.
There's more.
Four new locations have also been created, including the main centre in the country's capital, Dakar, where documents are personalised. Key functions include biometric data capture, identity verification, and revenue collection on behalf of the government.
A modern, scalable IT platform has been deployed, with a central database providing an accurate real-time record of the country's drivers and vehicles. Reflecting on the project's scale, Thales has already recruited and trained 50 local agents to manage citizens' requests.
In-depth understanding of the local environment
Secure Identity Management is often viewed as the type of standardised service that can be replicated in every country with little customisation.
But here is the rub. It's not the case.
The processes involved are derived from prevailing laws and the characteristics and strategy of the local administration. As a result, in-depth knowledge of the local ecosystem is essential for successfully implementing a PPP project.
Stay with us for a moment.
- First of all, the technical infrastructure installed must support the service throughout the country.
- Secondly, the behaviours and attitudes of citizens must be assessed thoroughly to propose the most suitable solution.
- Finally, the impacts of the project on the local administration must be anticipated and taken into account to enable the PPP project to be deployed efficiently.
5. What role should the public authority play?
Respecting regulations and winning citizen support
Responsibility for Identity Management always lies with the State.
A PPP will only delegate the operation of such a service. Ultimately, the government will always be held responsible for Identity Management by its citizens. Therefore, laws and related regulations defining the scope of the delegated service, the roles and responsibilities of each partner, and their limits, must be clear.
Information about the project and its benefits for the citizen must be communicated to, and supported by, the population.
In other words, the legal framework and citizen-oriented communication constitute the basis of the project business plan.
Getting the specification right and avoiding implementation delays
The specification must be reasonable and adapted to the local infrastructure. Focusing on the outputs that define the service is, by far, the best way to get a satisfactory solution.
The essence of an effective partnership is to let the provider propose a solution that satisfies such requirements, one that combines the optimum quality of service with the lowest possible cost.
At the selection phase, government will have the opportunity to compare and select the most attractive offer.
Project implementation should never be rushed. The resources required for a digital infrastructure are complex and must be managed with mutual trust.
Sadly, too much pressure on project implementation planning constitutes the first potential cause of PPP failure; it creates tension and conflict between partners at the very outset of the project.
Taking a long term strategic view
Government must always bear in mind that digital technology moves fast. A Public-Private Partnership project will succeed for government if the infrastructure installed can evolve and be reemployed effectively at the end of the contract.
The first step to achieving this is to ensure compliance with international standards.
Government should also put in place a strategy for the country's Identity Management that encompasses plans for mid-term developments.
It is maintaining control and cooperation.
For the private company, the public authority remains a customer as well as a partner.
As such, consistently controlling the quality of service and the performance of the delegated operations constitutes a significant role for the public authority.
Furthermore, a PPP is a long-term collaboration; it is simply impossible to anticipate all the issues that might arise throughout its execution. Several arrangements might have to evolve.
Therefore, both partners must retain a deep understanding of where the project stands and have confidence in each other's ability to make the necessary adjustments and maintain momentum within the partnership.
Public-Private Partnership challenges
PPP constitutes an extremely cost-efficient means of accelerating the modernisation of a country's Identity Management program.
However, it is a partnership. Success will only be here if both parties are committed for the long term.
Above all else, the critical factor for the public authority is to establish a sound contractual scheme, endorsed by relevant laws and supported by citizens.
Beyond that, it must give its private partner the freedom to propose what it can do best, ensuring that any constraints or performance requirements are focused on the outputs, rather than the means of achieving them.
Finally, in the event of the proposed plan not unfolding as initially anticipated, the public authority must be willing to share any pain, and the need to make adjustments.
For its part, the private partner should deploy all its expertise to build and operate the promised system, and ultimately transfer it back to the public authority in good shape.
Choosing the right partner remains a critical challenge.
Proven expertise, knowledge of the country, and long-term financial credibility constitute an ideal candidate's defining features.
Where do we fit in?
Thales' contribution to Public-Private Partnership (PPP) projects provides us with outstanding capabilities in terms of a culture of services, processes, resourcing and project financing, all of which are essential for creating trust between partners.
Thales' know-how in providing end-to-end solutions and services has been proven in over 200 projects worldwide. Typically our customers have renewed their confidence in Thales'solutions and expertise by commissioning further projects.
Recent examples include the Oman National Registry, eID and ePassport, the Swedish eID, ePassport and driving license, and voter registration infrastructures in Gabon, Burkina Faso, the Democratic Republic of Congo, and Benin.
With over 30 years of experience in identity solution integration, Thales represents a stable and reliable system integrator for your identity project; above all else, our purpose is to serve and support your transformation.