Catherine Murphy (Kildare North, Social Democrats)
Link to this: Individually | In context | Oireachtas source

1218. To ask the Minister for Employment Affairs and Social Protection the country and location that the mobile phone code verification numbers are sent from in the context of the public service card application process stage whereby a person is asked to verify his or her mobile phone number and receive a MyGov verification code; if the host +1 425 prefix code and accompanying number is compliant with data protection laws here; the name of the service provider; and if she will make a statement on the matter. [46157/17]

Regina Doherty (Meath East, Fine Gael)
Link to this: Individually | In context | Oireachtas source

A MyGovID account is a secure online account for accessing public services. The process for registering and using a MyGovID account proves in the online environment that the person has had their identity verified to the SAFE 2 standard. In the context of the SAFE/PSC/MyGovID infrastructure, my Department utilises three mobile verification processes as follows –

(a) when an individual’s phone is verified face-to-face as part of the SAFE 2 registration process,

(b) to facilitate MyGovID registration prior to receipt of a PSC and

(c) as part of the two factor authentication for MyGovID verification/transaction processes.

As regards (a) and (b), the text messages are generated on the Department’s internal systems and relayed through Vodafone’s Irish network via a direct link for onward transmission to the relevant phone number.

As regards (c) above, the Department seeks to ensure that a person’s MyGovID account is not used by another person. This is done by employing two-factor authentication each time the person uses the account. This means that, in addition to requesting a username and password (something they know), a one-time verification code is sent to a person’s verified mobile phone (something they have) which they must also provide when logging in. MyGovID is developed on the Microsoft Azure platform and utilises the in-built Azure text message Multi-Factor Authentication which is Microsoft's two-step verification solution. Microsoft provides the text messaging two-factor authentication service on behalf of the Department and guarantees 99.9% availability of Multi-Factor Authentication. For this service, Microsoft avails of bundled low-cost text messaging services worldwide. The origin of each message depends on the location of the lowest rate available at the time.

It is important to note that no personal information is shared in the provision of this service.

I hope this clarifies the matter for the Deputy.