Driver vehicle system

Report highlights

What this report is about

Transport for NSW (TfNSW) uses the Driver vehicle System (DRIVES) to support its regulatory functions. The system covers over 6.2 million driver licences and over seven million vehicle registrations.

DRIVES first went live in 1991 and has been significantly extended and updated since, though is still based around the same core system. The system is at end of life but has become an important service for Service NSW and the NSW Police Force.

DRIVES now includes some services to other parts of government and non-government entities which have little or no connection to transport. There are 141 users of DRIVES in total, including commercial insurers, national regulators, and individual citizens.

This audit assessed whether TfNSW is effectively managing DRIVES and planning to transition it to a modernised system.

Audit findings

TfNSW has not effectively planned the replacement of DRIVES.

It is now working on its third business case for a replacement system but has failed to learn lessons from its past attempts.

In the meantime, TfNSW has not taken a strategic approach to managing DRIVES’ growth.

TfNSW has been slow to reduce the risk of misuse of personal information held in DRIVES. With its delivery partner Service NSW, TfNSW has also been slow to develop and implement automatic monitoring of access.

TfNSW uses recognised processes for managing most aspects of DRIVES, but has not kept the system consistently available for users. TfNSW has lacked accurate service availability information since June 2022, when it changed its technology support provider.

TfNSW needs to significantly prioritise cyber security improvements to DRIVES. TfNSW is seeking to lift DRIVES’ cyber defences, but it will not achieve its stated target safeguard level until December 2025.

Even then, one of the target safeguards will not be achieved in full until DRIVES is modernised.

Audit recommendations

TfNSW should:

  • implement a service management framework including insight into the views of DRIVES users, and ensuring users can influence the service
  • ensure it can accurately and cost effectively calculate when DRIVES is unavailable due to unplanned downtime
  • ensure implementation of a capability to automatically detect anomalous patterns of access to DRIVES
  • ensure that DRIVES has appropriate cyber security and resilience safeguards in place as a matter of priority
  • develop a clear statement of the future role in whole of government service delivery for the system
  • resolve key issues currently faced by the DRIVES replacement program including by:
    • clearly setting out a strategy and design for the replacement
    • preparing a specific business case for replacement.

Fast facts

Executive summary

The DRIver VEhicle System1 (often known as DRIVES) is the Transport for NSW (TfNSW) system which is used to manage over 6.2 million driver licences and over seven million vehicle registrations in New South Wales.

DRIVES first went live in 1991 and has been significantly extended and enhanced over the past 33 years. DRIVES is a significant NSW Government information system — containing personal information such as home addresses for most of the NSW adult population, sensitive health information such as medical conditions, and biometric data in photographs.

Service NSW, part of the Department of Customer Service, is the NSW Government's 'one stop shop' for services to NSW citizens and businesses. It uses DRIVES when it delivers many transport-related services to NSW citizens such as licence renewals and checks the identity information stored in DRIVES as part of other services delivered to NSW citizens, such as a 'working with children check'.

DRIVES supports TfNSW's regulatory functions and the collection of more than $5 billion in revenue annually for the NSW Government. The system is also used by many organisations outside of the NSW Government including commercial insurers and national regulators, as well as individual citizens who access DRIVES for services such as 'Renew my registration' or 'Book a driver knowledge test'.

TfNSW owns and manages DRIVES. It intends to replace DRIVES with a modernised system to improve its cost, performance, and security.

The objective of this performance audit was to assess whether TfNSW is effectively:

  • managing the current system, and 
  • planning to transition DRIVES to a modernised system.

The auditee is TfNSW. We have consulted with the Department of Customer Service as a key stakeholder during the audit process.

Conclusion

TfNSW has not effectively planned the replacement of DRIVES. It has failed to learn lessons from multiple planning attempts over the last five years.

Since 2019, TfNSW has allocated over $60 million in funding, spent at least $36 million, and tried multiple times to prepare a robust business case to underpin a replacement program. It is now on its third iteration but has failed to learn lessons from its past attempts. TfNSW cannot clearly state why its previous attempts have failed or when DRIVES will be replaced. As a result, too much of its planning effort has been wasted and the agency continues to operate a system which should have been replaced in the 2010s.

TfNSW's current attempt to replace DRIVES is taking place at the same time as the NSW Government progresses its plans to produce state digital assets that can be used by multiple government agencies. One of these assets is the Licence NSW platform, developed by the Department of Customer Service for the management of customer and business licences, permits and registrations.

TfNSW originally viewed the Department of Customer Service as an arms-length potential service provider rather than another part of government which could deliver a common service. In mid-2023, TfNSW changed this positioning and now views the platform and its operator (the NSW Department of Customer Service) as central to its efforts to replace DRIVES.

TfNSW and the Department of Customer Service are now working together to determine how the Licence NSW platform and the DRIVES replacement will support the administration of a range of transport regulatory activities. How effective they are in defining and then implementing their respective services will significantly determine whether DRIVES is replaced or modernised this decade.

TfNSW has been slow to reduce the risk of misuse of personal information held in DRIVES.

TfNSW has a clear framework to control access to DRIVES. However, in conjunction with its delivery partner, Service NSW, TfNSW has been slow to develop and implement automatic monitoring of access to DRIVES. This is necessary to reduce the risk of misuse of personal information held within the system. Automatic monitoring was a key recommendation by the NSW Independent Commission Against Corruption as part of its May 2021 investigation of criminal misuse of DRIVES data.

TfNSW has not taken a strategic approach to managing the growth of the system over its long lifespan.

DRIVES first went live in 1991 and has been significantly extended and updated over the past 33 years. Outside of DRIVES, TfNSW has built web-based applications such as ‘Renew my registration’ which allow the public and users such as Service NSW, NSW Police, insurers, and others to update or view some of the information in DRIVES. The system has grown to become an increasingly important service for the NSW Government but DRIVES’ growth has not been well-planned by TfNSW which has lacked a strategy to guide its development. The lack of a strategy to underpin the purpose and development of DRIVES has resulted in it including some services which have little or no connection to transport.

TfNSW uses recognised system management processes for managing most other aspects of the existing DRIVES, but it has not kept the system consistently available for users.

TfNSW manages DRIVES using recognised management processes such as those set out in ISO27001 and the Information Technology Infrastructure Library (ITIL). It reports that it has protected the system from a leak of data or any other intrusive cyber-attack. However, it has failed to consistently keep DRIVES and many DRIVES-linked services available for users. DRIVES-linked services include web-based services which make DRIVES information available to the public and industry. In particular, these services were unavailable in early 2020 due to a distributed denial-of-service attack which impacted TfNSW more generally. Services were unavailable again during 2022 following TfNSW’s migration of technology support from a legacy datacentre to a hybrid public-private cloud service. The amount of service downtime is unknown because the agency lacks accurate, consolidated information on DRIVES availability since June 2022 when TfNSW changed to a new technology support provider.

TfNSW needs to prioritise improvements to DRIVES against the NSW Cyber Security Policy.

DRIVES is a significant government information system and is therefore subject to inherent cyber security risks which are exacerbated by its age, evolution, and large number of users. Based on the information provided to this audit, TfNSW has not demonstrated it has a cohesive and prioritised strategy to address these risks proportionately. TfNSW has advised that it is seeking to lift DRIVES’ cyber defences, but will not achieve its stated target safeguard level until December 2025. However, even then, one of the target safeguards will not be achieved in full until DRIVES is modernised, and that is part of the RegStar program, which itself does not have a target implementation date. In the interim, TfNSW must increase its focus and prioritise efforts to ensure effective cyber security and resilience measures are in place for DRIVES as a matter of urgency.

1. Key findings

DRIVES has grown to be a core system for the NSW Government, but its growth has not been planned strategically and its role in whole-of-government service delivery is neither fully defined, nor is it supported by an effective and comprehensive service management framework

TfNSW has lacked a strategy that provides guardrails or an overarching logic to guide the development and expansion of DRIVES. As a result, DRIVES includes some services which have minimal or no links to transport. For example, people licenced to own a firearm are recorded in DRIVES while most other non-transport licences (and the remaining details of the firearms registry) are recorded in the Government Licensing Service run by the Department of Customer Service. DRIVES also plays an important role in identity management, as Service NSW uses DRIVES to check identity information during many citizen services such as the ‘working with children check’.

Many of the additions to DRIVES may have reflected reasonable decisions at the time they were made. However, DRIVES has moved from a database that was wholly focused on managing transport regulatory activities to a service that is increasingly important across government. DRIVES now supports the collection of revenue of more than $5 billion annually and has 141 user organisations including commercial insurers, national, state and local government agencies, Revenue NSW, National Heavy Vehicle Regulator, Austroads and the NSW Police Force.

TfNSW has responded to DRIVES becoming a critical part of the NSW Government’s overall service delivery architecture by implementing management practices, such as memoranda of understanding and access and use agreements with partners such as Service NSW, law enforcement agencies and regulatory bodies. However, TfNSW has not supported DRIVES’ expansion with a clear statement of its role in whole-of-government service delivery, nor has it implemented a comprehensive service framework that ensures users views are heard and can influence the service.

DRIVES is not an easy system to use and is expensive to maintain

The DRIVES user interface retains the look and feel of a system built 33 years ago. The interface is not intuitive for contemporary users, being wholly text-based with green font on a black background. This results in lengthy lead times, increased errors, and a sub-optimal staff experience.

DRIVES is complex, not easy to adapt or scale and includes components which have reached the end of their life. TfNSW has estimated that it has spent $146.6 million to support DRIVES over the past five years. TfNSW is also finding it difficult to source software specialists to manage DRIVES and has estimated that it incurs more costs to support DRIVES than it would if it replaced DRIVES with a contemporary system. In May 2023, TfNSW estimated that it would save $31 million over ten years in technology support costs if it implemented a modern system. This was a net saving which considered access costs such as licencing costs and resourcing costs to maintain and change the system.

Progress has been slow on the implementation of automatic monitoring to reduce the risk of misuse of DRIVES data

DRIVES includes important personal information such as home addresses for most of the NSW adult population and other information which should only be accessed in accordance with the Privacy and Personal Information Act 1998. TfNSW has policies and procedures to control access to and use of DRIVES which aim to reduce the likelihood of misuse of DRIVES data. However, people with access to DRIVES can still misuse personal information held in the system in ways similar to those investigated by the NSW Independent Commission Against Corruption in May 2021 (Operation Mistral). The ICAC recommended that Service NSW should implement a risk-based system to improve the detection of unauthorised access of personal information.

TfNSW and its delivery partner, Service NSW, are targeting March 2024 for the implementation of a capability to automatically detect unusual or anomalous patterns of access to DRIVES. This is nearly three years after the ICAC recommendation was made. This is a slow response particularly considering the detection capability was estimated to cost only $200,000 to $300,000, and require approximately six months to implement.

TfNSW has not kept DRIVES consistently available for users, and since mid-2022, TfNSW cannot demonstrate that it has been accurately monitoring DRIVES service availability

TfNSW has not kept DRIVES, and many closely linked systems, consistently available. Services were unavailable for significant periods of time in late 2019 and early 2020 due to network instability and a distributed denial-of-service attack which impacted TfNSW more generally and caused the unavailability of some internet-connected services that are closely linked to DRIVES. TfNSW advised that they have subsequently implemented software designed to automatically protect against denial-of-service and other cyber-attacks.

TfNSW has set a target for DRIVES to be available to users for 99.99% of the agreed service hours. As DRIVES is intended to be available 24 hours a day for 365 days a year, the target can only be met if unplanned downtime each month is less than 4 minutes 32 seconds. However, TfNSW cannot accurately and quickly report its performance against this target since June 2022. This is because its management information:

  • incorrectly records the service as experiencing unplanned downtime during periods of planned downtime
  • incorrectly records the service as being unavailable when the service switches to a different datacentre, and the service to users continues to be uninterrupted.

For this audit, TfNSW manually calculated the unplanned downtime for October to December 2022 and found that DRIVES was unavailable for 157 minutes and DRIVES-linked systems were unavailable for 2,847 minutes. The Audit Office of New South Wales asked TfNSW to manually recalculate all unplanned downtime for DRIVES since mid-2022. However, TfNSW did not do this, stating it would require 14 working days to complete the calculation.

TfNSW stated that the poor availability from October to December 2022 was significantly caused by temporary transition issues associated with its adoption of a cloud computing service. TfNSW advised us that it has put in place a service improvement plan to improve its reporting of DRIVES downtime.

TfNSW manages DRIVES using recognised management practices and follows a clear process when it upgrades or changes DRIVES

Over the life of DRIVES, TfNSW has upgraded or changed the system many times to respond to changes in technology and legislative and policy developments, as well as to address customer needs or to fix faults or weaknesses in the system. TfNSW has a clear process to manage risks associated with upgrading or changing DRIVES. This includes forward work plans, business and customer impact evaluation, communication, testing and decision gates.

TfNSW has implemented management practices that are designed to protect information held in DRIVES and ensure technology services are aligned with business needs and meet service standards. TfNSW holds current certification against the ISO27001:2022 standard (the international standard for the protection of information) and has implemented practices set out in the information technology infrastructure library (known as ITIL).

TfNSW needs to do more now to ensure that it is effectively managing DRIVES’ cyber security and resilience

DRIVES is registered with Cyber Security NSW as one of TfNSW’s ‘crown jewels’. TfNSW recognises that the age, evolution, and the number of system users of DRIVES, means that its defence against cyber threats needs to be strengthened.

TfNSW has advised that it is seeking to lift DRIVES’ cyber defences, but will not achieve its stated target safeguard level until December 2025. However, even then, one of the target safeguards will not be achieved in full until DRIVES is modernised, and that is part of the RegStar program, which itself does not have a target implementation date.

In the meantime, there is limited evidence provided to the audit that there are sufficient cyber security and resilience safeguards in place for DRIVES, nor a cohesive strategy to lift defences going forward on a sufficiently timely basis. Our observations here are consistent with those made in our 2021 report on Managing Cyber Risks in TfNSW.

TfNSW’s leadership must increase its focus and prioritise efforts to ensure effective cyber security and resilience measures are in place for DRIVES as a matter of priority.

Despite five years of effort, more than $60 million in funding, and spending at least $36 million—including over $14 million with three separate consulting companies—TfNSW does not have an approved business case for the replacement of DRIVES

TfNSW has dedicated a significant amount of time, allocated over $60 million in funding, spent at least $36 million and tried multiple times to prepare a robust business case to underpin a replacement program.

In 2018 and 2019, TfNSW first attempted to define a program to replace DRIVES when it started but did not complete a strategic business case. In 2021, TfNSW completed a further strategic business case for a DRIVES replacement program. It then completed preparatory work for the program while, in parallel, it worked on a more complete business case. In 2022, TfNSW completed a ‘bronze’ full business case (so described because TfNSW considered it was complete but not yet a ‘gold’ document ready for submission to NSW Treasury). Total program costs under the bronze business case were estimated to be $498.8 million. In 2023, TfNSW paused work on this business case and developed a new strategic business case for its DRIVES replacement program. This new business case included $114 million of financial benefits from an expected improvement in cyber security (which had previously been modelled as a non-financial benefit only) but removed $536 million of financial benefits that TfNSW had previously forecast due to an expected increase in safety on NSW roads.

TfNSW has used three major consulting firms to support its planning to transition DRIVES to a modernised system, spending over $14 million. It used competitive tender processes to appoint each of the three firms but then varied the underpinning contracts on four occasions, adding a total of $11.1 million to the agreements. The audit team has seen no evidence of market assessments for any of the contract extensions reviewed for this audit.

TfNSW does not have reliable information on its spending for the DRIVES replacement programs over the full five-year period covered by this audit, but it reports that it has spent at least $36.44 million to plan the transition of DRIVES to a modernised system. This understates the true amount of expenditure by an unknown amount as TfNSW did not record the cost of employees who were working on DRIVES replacement programs until the RegStar program was formed in 2021.

TfNSW has failed to learn lessons from multiple attempts to plan the transition of DRIVES to a modernised system

TfNSW is now on its third iteration of a DRIVES replacement program but cannot clearly state why its previous attempts have failed or when DRIVES will be replaced. TfNSW’s bronze full business case presented an opportunity for TfNSW to set out the program’s history and learn lessons from previous delays or changes to the program’s strategic direction. However, TfNSW did not take this opportunity and executives currently responsible for the program could not clearly articulate why previous iterations of the program (which took place before their appointments) were not progressed.

TfNSW’s positioning of the Department of Customer Service as an arms-length potential provider rather than a partner has been one of the causes of delays to the program

TfNSW’s current attempt to replace DRIVES is taking place at the same time as the NSW Government progresses its plans to produce state digital assets that can be used by multiple government agencies. One of these assets is the Licence NSW platform, which was developed by the Department of Customer Service for the management of customer and business licences, permits and registrations.

In August 2021, the Department of Customer Service required agencies to consider the use of the Licence NSW platform as a condition of receiving relevant funding from a whole-of-government digital fund. However, TfNSW evaluated the Department of Customer Service as a potential provider as if it was an external supplier to government rather than another part of government which could effectively deliver a common service.

In mid-2023, TfNSW redirected the DRIVES replacement program towards much closer cooperation with the Department of Customer Service. TfNSW and the Department of Customer Service are now working together to determine how the Licence NSW platform and the DRIVES replacement will support administration of a range of transport regulatory activities.

TfNSW needs to resolve several key issues, including DRIVES’ role in whole-of-government service delivery and the potential cost to replace it, before it can progress the DRIVES replacement program

TfNSW has an established program team, prepared extensive program documentation, and completed considerable preparation for the replacement of DRIVES. However, to progress further, TfNSW must urgently resolve several key issues including:

  • how the replaced DRIVES supports the NSW Government identity strategy and what role it might have in issuing or verifying digital identities
  • how the replaced DRIVES works with the Licence NSW platform including which licensing and regulatory administration activities should be carried out by TfNSW, and which should be carried out by the Department of Customer Service
  • what should be the detailed technical design of the replaced DRIVES considering its relationship with the Licence NSW platform and its role in managing digital identities
  • how to lower the cost of the DRIVES replacement program.

2. Recommendations

By June 2024, TfNSW should:
  1. implement a service management framework which ensures it has insight into the views of DRIVES users (internal and external to government) and which ensures DRIVES users can influence the service
  2. ensure it can accurately and cost-effectively calculate when DRIVES is unavailable due to unplanned downtime
  3. ensure the implementation of a capability to automatically detect unusual or anomalous patterns of access to DRIVES
  4. ensure that it has appropriate cyber security and resilience safeguards in place for DRIVES as a matter of priority
  5. develop a clear statement of the future role in whole-of-government service delivery for the DRIVES replacement, in consultation with the Department of Customer Service.
By December 2024, TfNSW should:
  1. resolve key issues currently faced by the DRIVES replacement program including by:
    1. clearly setting out a strategy and detailed technical design for a replacement system that considers its interrelationship with other systems—including Licence NSW—in whole-of-government service delivery and in managing digital identities
    2. using lessons from previous attempts, preparing a specific business case for system replacement, including a robust assessment of costs, benefits and risks.

1. Introduction

1.1 DRIVES

DRIVES is the Transport for NSW (TfNSW) system for recording and managing NSW driver licences and vehicle registrations. DRIVES was created to meet TfNSW’s statutory obligations to maintain road registers and, as a road regulatory authority, TfNSW uses the information in DRIVES to support its regulatory functions and objectives.

DRIVES supports TfNSW’s administration of a range of other functions related to owning and operating vehicles on NSW roads such as the issue of mobility parking permits and number plates.

DRIVES stands for the DRIver VEhicle System. The system first went live in 1991 for the management of driver licensing and has been significantly extended and updated over the past 33 years. TfNSW now uses DRIVES to either directly manage, or provide information for:

  • driver licences and vehicle registrations
  • mobility parking permits and vehicle number plates
  • other transport functions such as the mandatory alcohol interlock program
  • traffic offences, court conviction and enforcement actions
  • customer names and addresses
  • NSW Photo cards and proof of identity
  • firearms licences.

DRIVES purpose, usage, data protection, retention and data access are governed by a number of pieces of legislation including the Road Transport Act 2013 which requires TfNSW to maintain a register of driver licences and a register of registrable vehicles. In 2022, TfNSW used DRIVES to manage over 6.2 million driver licences and over seven million registered vehicles. DRIVES also records the customer addresses for close to 540,000 maritime licences and 240,000 registered vessels.

The system includes personal information such as home addresses for most of the NSW adult population, sensitive health information such as medical conditions, and biometric data in photographs. This information must be controlled in line with the NSW Privacy and Personal Information Act 2018. It is vital that the system is held secure from cyber-related threats. Appendix two provides further detail on the statutory and regulatory framework related to DRIVES.

1.2 Key users of DRIVES

In June 2023, DRIVES was used by 141 organisations. Exhibit 1 outlines the number of main users by type of entity. Outside of DRIVES, TfNSW has built web-based applications such as ‘Renew my registration’. These ‘DRIVES-linked applications’ allow the public and users such as Service NSW, NSW Police Force, insurers, and others to update or view some of the information in DRIVES.

 

Exhibit 1: DRIVES users by type
Entity typeNumber
NSW government agencies29
Local councils90
Commonwealth government agencies11
ACT government agencies  1
Private sector10
Total141

Source: Audit Office of New South Wales analysis of TfNSW data.

Most organisations access DRIVES using API (application programming interface) access and online read access. Ten organisations interact with DRIVES through business-to-business e-commerce, including six insurers, Revenue NSW, NSW Police Force, National Heavy Vehicle Regulator, and Austroads. Exhibit 2 is a simplified model of DRIVES main organisational connections.

Infographic demonstrating how DRIVES users access the system
Exhibit 2: How DRIVES users access the system

Source: Audit Office of New South Wales analysis of TfNSW documentation.

1.3 The evolution of DRIVES

DRIVES was commissioned in 1988 using CA-Gen Technology2 and first went live in 1991 for the management of driver licensing. In June 1992, vehicle registration services were added and internet-based services for external users started in December 1999 with the ‘myRego’ service.
Key dates in the evolution of DRIVES and TfNSW’s recent efforts to replace3 DRIVES are set out in Exhibit 3 below.

Infographic demonstrating the evolution of the DRIVES system between 1988 and 2023
Exhibit 3: The evolution of DRIVES

Source: Audit Office of New South Wales analysis of TfNSW documentation.


2 CA-Gen is software intended for the creation and maintenance of large-scale business applications.
3 DRIVES may be replaced with a new business application or may be retained but very substantially upgraded. For ease, we refer to the replacement or modernisation of DRIVES interchangeably in this report.

1.4 About the audit

This audit assessed how effectively TfNSW is managing the DRIver VEhicle System (DRIVES). The audit investigated whether:

  • TfNSW is effectively managing the current system
  • TfNSW is effectively planning to transition DRIVES to a modernised system

Appendix three provides further information about this audit.

2. Management of DRIVES

This part of the report considers whether Transport for NSW (TfNSW) is effectively managing the current system. It considers DRIVES’:

  • role in NSW Government service delivery
  • ease of use and appropriateness for a modern system
  • mechanisms to ensure the service is available for users.

2.1 DRIVES’ role in NSW Government service delivery

DRIVES has grown to become a core system for the NSW Government, but its growth has not been planned strategically, and its role in whole-of-government service delivery is not fully defined, nor is it supported by an effective and comprehensive service management framework

DRIVES growth has not been clearly planned and TfNSW has lacked a strategy that provides guardrails or an overarching logic to guide the development of the system. As a result, the rationale for some DRIVES services is not readily evident and includes services which have minimal or no links to transport. For example, people licenced to own a firearm are recorded in DRIVES but most other non-transport licences (including all other details of the firearms registry) are recorded in the Government Licensing Service run by the Department of Customer Service. DRIVES also plays an important role in identity management, allowing Service NSW to check the identity information stored in DRIVES during many citizen services such as the ‘working with children check’.

Many of the developments to DRIVES may have reflected reasonable decisions at the time they were made. However, as DRIVES has expanded and taken on more functions, it has moved from a database that was wholly focused on managing transport regulatory activities to a service that is increasingly important across government. DRIVES now supports the collection of more than $5 billion in revenue annually and has 141 user organisations including many outside of TfNSW such as commercial insurers, national, state and local government agencies, Revenue NSW, the National Heavy Vehicle Regulator, Austroads and the NSW Police Force.

TfNSW has responded to DRIVES becoming a critical part of the NSW Government’s overall service delivery architecture by implementing a range of management practices. For example, it has formed memoranda of understanding with key partners such as Service NSW (part of the Department of Customer Service) and has access and use agreements with a wide range of partners such as:

  • state and national government agencies
  • law enforcement agencies
    • including the NSW Police Force, the NSW Sheriff’s Office, the Australian Criminal Intelligence Commission and the Australian Federal Police.
  • regulatory bodies
    • including the State Insurance Regulatory Body (SIRA) and the National Heavy Vehicle Regulator (NHVR).
  • commercial insurance companies
    • local councils.

However, TfNSW has not supported DRIVES’ expansion with a clear statement of its role in whole-of-government service delivery, nor has it matched this expansion with a comprehensive service management framework that ensures users are able to influence the service. For example, TfNSW does not have well-developed insight into the views of DRIVES’ customers or a clear view on whether and how DRIVES’ costs should be recovered through fees.

Organisations using DRIVES have also been unable to satisfactorily resolve some weaknesses with DRIVES, or understand why the weaknesses cannot be addressed, despite repeated engagement through existing channels for customer feedback.

Exhibit 4 shows the indicative positioning of DRIVES as a whole-of-government service over time.

Line graph which outlines the costs of supporting the DRIVES system over a 5 year period
Exhibit 4: DRIVES has increasingly become a whole-of-government service

Note: Representation of DRIVES positioning is indicative only.
Source: Audit Office of New South Wales analysis of documentation provided by TfNSW.

2.2 Appropriateness and ease of use

DRIVES uses a programming language which is inappropriate for a modern system

DRIVES was built using a programming language originally called CA-Gen, now known as Gen. The system went live in 1991 with the capability to manage driver licences. In the following year, TfNSW added the capability to manage vehicle registration. Since then, DRIVES has been significantly extended and now manages a wide range of transport functions associated with owning or operating vehicles on NSW roads, including licences, registrations, mobility parking permits and number plates, as well as the management of traffic offences and enforcement actions.

DRIVES also connects to businesses and government to facilitate functions such as roadworthy inspections and vehicle insurance. It also provides the processing for many transport-related functions that directly serve the public, such as booking a driver licence test or renewing a vehicle registration.
DRIVES programming language was an appropriate choice when DRIVES was created but it is now outdated, relatively inflexible, and requires more time and effort to integrate with other systems than other more modern languages. It is now inappropriate for a modern system.

DRIVES is no longer an easy system to use and is expensive to maintain

The user interface for DRIVES retains the look and feel of a system designed and built over 30 years ago. The interface is not intuitive, being wholly text-based with green font on a black background. This results in lengthy lead times, increased errors, and a sub-optimal staff experience.

DRIVES is complex, not easy to adapt or scale and includes components which have reached the end of their life. Due to the age of the system, TfNSW is also finding it difficult to source software specialists to manage DRIVES which means they may be forced to pay more to attract these specialists to the public sector, or they may be forced to reduce future development of the system.

As of August 2023, TfNSW supported and managed changes to DRIVES with a workforce consisting of 130 employees and 52 contractors.
Most of these contractors have been engaged by TfNSW for more than 12 months, with an average tenure of 29 months. Two contractors had been continuously engaged for nine years — which may indicate a risk to the economy of government spending. One of TfNSW’s major technology suppliers also provided specialist support for DRIVES and its supporting infrastructure.

TfNSW recognises that the age of DRIVES means that it incurs more costs to support the system than it would if DRIVES was replaced by a modern system. In May 2023, TfNSW estimated that it would save $31 million over ten years in technology support costs if it implemented a modern system. This was a net saving which considered access costs such as licencing costs and resourcing costs to maintain and change the system.

TfNSW has estimated that it has spent $146.6 million to support DRIVES over the past five years. Support costs peaked in 2021–22 when the agency migrated support services to a new supplier and incurred duplicate costs for a period of time. Exhibit 5 sets out the approximate annual support costs for DRIVES since 2018–19.

Line graph which outlines the costs of supporting the DRIVES system over a 5 year period
Exhibit 5: Costs to support DRIVES ($m)

Note: TfNSW does not separately record the cost to support DRIVES and has estimated these costs based upon actual external costs and an attribution of 61.5% of costs incurred across its technology operations for items such as service management, servers, storage and network costs.
Source: Audit Office of New South Wales analysis of data provided by TfNSW (unaudited figures).

TfNSW has a clear framework to control access to DRIVES but, together with its delivery partner Service NSW, it has been slow to implement automatic monitoring to reduce the risk of misuse of DRIVES data

DRIVES includes personal information such as home addresses for most of the NSW adult population, sensitive health information such as medical conditions and biometric data in photographs.. Personal information held in DRIVES should only be accessed in accordance with the Privacy and Personal Information Act 1998.

DRIVES data is accessed and used by a wide range of organisations through multiple channels including direct access, batch transfer and Application Programming Interface (API) connections.

To manage the challenges of data sharing and appropriate data use, TfNSW has policies and procedures which aim to control access to and use of DRIVES including:

  • An agreement for Service NSW to act on behalf of TfNSW.
  • Agreements governing access by third party organisations.
  • Privacy plans and procedures.
  • Internal employee access frameworks.
  • Physical access controls such as proximity cards and workplace monitoring.
    Monthly reviews of the need for people to maintain access, and suspension of people’s access after 30 days without active use of the system. This includes people within third party organisations.
  • Obligations for organisations accessing DRIVES data to maintain records of system access, ensure access is from identified premises and carry out an annual security audit.

While these controls aim to reduce the likelihood of misuse of DRIVES data, people with access to DRIVES can still misuse personal information held in the system in ways similar to those investigated by the NSW Independent Commission Against Corruption in May 2021 (Operation Mistral; ICAC May 2021).

The ICAC found that a Service NSW officer had engaged in serious corrupt conduct and made a series of recommendations including that:

Service NSW should implement a risk-based system designed to improve detection of unauthorised access of personal information, including using analytics of access logs across the system to help detect anomalous or other patterns of access that might indicated unauthorised access.

TfNSW and its delivery partner, Service NSW, are targeting March 2024 for the implementation of a capability to automatically detect unusual or anomalous patterns of access to DRIVES. If this capability is delivered on time, it will go live nearly three years after the ICAC report was published in May 2021. This is a slow response to one of the key recommendations made in the ICAC report, particularly considering the relatively low cost and time that the system is estimated to require ($200,000 to $300,000 and approximately six months).

From October 2022 to March 2023, TfNSW recorded four instances of misuse of personal data held in DRIVES. As three of these four instances were reported to TfNSW by either the Australian Federal Police or the NSW Police Force following investigations, the risk remains that further instances of misuse of personal data may have occurred but have not yet been discovered.

2.3 Service availability

TfNSW manages DRIVES using recognised practices, but it has not kept DRIVES consistently available for users

TfNSW has a range of management practices that are designed to protect information held in DRIVES and ensure technology services are aligned with business needs and meet service standards. This includes practices such as those set out in the international standard for the protection of information (ISO27001:2022) and in the information technology infrastructure library (known as ITIL). TfNSW holds current certification against the ISO27001:2022 standard.

TfNSW has set a target for DRIVES to be available to users for 99.99% of the agreed service hours. For services that are expected to be available 24 hours a day for 365 days a year, the 99.99% target can only be met if unplanned downtime each month is less than 4 minutes 32 seconds.

Over the five-year period examined by this audit, TfNSW contracted with Fujitsu Australia Limited (2018 to May 2022) and Wipro (June 2022 onwards) to provide technology support to TfNSW. This included providing technology support for DRIVES.

Service availability when DRIVES was supported by Fujitsu Australia Limited (2018 to May 2022)

Exhibit 6 shows that DRIVES and many closely linked systems which make DRIVES information available to the public and industry were unavailable for significant periods of time in late 2019 and early 2020. This unplanned downtime meant that Service NSW could not provide many driving-related services to the NSW public for a significant amount of time during November 2019 and February 2020 and then again in April and May 2020. Respectively, these periods of unavailability were caused by network instability (following a planned network change) and a distributed denial-of-service attack which impacted TfNSW more generally and caused the unavailability of some internet-connected services that are closely linked to DRIVES (TfNSW’s management of cyber threats related to DRIVES is discussed below).

Line graph demonstrating that DRIVES and its linked systems were unavailable much more than planned between 2018 and 2022
Exhibit 6: DRIVES and its linked systems were unavailable much more than planned from 2018 to May 2022

Note: DRIVES-linked systems include many services used by the public such as Book a Driver Knowledge Test or by industry such as Dealer Online.
Source: Audit Office of New South Wales analysis of data provided by TfNSW (unaudited figures).

Service availability when DRIVES was supported by Wipro (June 2022 onwards)

TfNSW cannot demonstrate that it has been accurately monitoring system availability since June 2022, and did not provide downtime data requested for this audit

DRIVES and DRIVES-linked systems have suffered unplanned downtime since mid-2022 but the amount of downtime is unknown as TfNSW does not have consolidated, accurate management information on DRIVES service availability.

TfNSW’s existing management information on DRIVES service availability since mid-2022 is unreliable due to incorrect coding in the software. As a result, it:

  • incorrectly records the service as experiencing unplanned downtime during periods of planned downtime
  • incorrectly records the service as being unavailable when the service switches to a different datacentre and the service to users is uninterrupted but not discontinued.

For this audit, TfNSW manually calculated its unplanned downtime for October to December 2022. These calculations showed that DRIVES suffered downtime equivalent to 157 minutes across these three months and DRIVES-linked systems suffered downtime equivalent to 2847 minutes across the same three months.

The Audit Office of New South Wales asked TfNSW to manually recalculate all unplanned downtime for DRIVES since mid-2022. TfNSW did not comply with this request. As such, the audit can provide no assurance over the veracity of downtime data generated within this timeframe, and TfNSW cannot demonstrate that it is accurately monitoring system availability.

TfNSW states that the poor availability during October to December 2022 coincided with, and was significantly caused by, its adoption of a hybrid public-private cloud computing service. In 2022, the agency finalised a four-year program to transfer the support and maintenance of transport systems, including DRIVES, from a legacy datacentre to a hybrid public-private, cloud-based service. TfNSW advised that the transfer reduced risks associated with the performance, cost and security of the legacy service but also led to DRIVES and DRIVES-linked systems being unavailable in late 2022 while transition issues were identified and resolved.

Management information for months when DRIVES and its related systems achieve 100% availability are reliable and TfNSW reported that it had achieved 100% availability on 47 of 61 months examined by this audit. Since January 2023, TfNSW reports that it has achieved very high levels of system availability.

Protection against cyber-attack

TfNSW needs to do more now to ensure that it is effectively managing DRIVES’ cyber security and resilience

DRIVES is registered with Cyber Security NSW as one of TfNSW’s ‘crown jewels’ – that is, one of the most valuable or operationally vital systems or information in the organisation.

TfNSW acknowledges that DRIVES remains an attractive target for attack by cyber actors and that the age and evolution of DRIVES means that its defence against cyber threats needs to be strengthened. DRIVES is also accessible to more than 140 organisations.

An example of DRIVES’ exposure to the risk of cyber-attack is the successful distributed denial of service attack in early 2020, which impacted TfNSW more generally and caused the unavailability of some internet-connected services that are closely linked to DRIVES.

Following the denial-of-service attack, TfNSW established a set of follow up actions to take after a cyber-attack, including to:

  • lift DRIVES’ Essential Eight cyber defences to a higher level, which has been assessed as a requirement by TfNSW management4
  • review, and where appropriate, extend privileged access management for DRIVES users with advanced system access (whilst maintaining controls on this form of access)
  • implement multi-factor authentication for internet-linked applications that draw on DRIVES.

TfNSW has advised that it is seeking to lift DRIVES’ cyber defences, but will not achieve its stated target safeguard level until December 2025. However, even then, one of the target safeguards will not be achieved in full until DRIVES is modernised, and that is part of the RegStar program, which itself does not have a target implementation date.

In the meantime, there is limited evidence provided to the audit that there are sufficient cyber security and resilience safeguards in place for DRIVES, nor a cohesive strategy to lift defences going forward on a sufficiently timely basis. Our observations here are consistent with those made in our 2021 report on Managing Cyber Risks in TfNSW.

While TfNSW reports that a range of management practices and governance forums are in place that aim to help to manage cyber risks — including vulnerability reporting, software patching calendars, incident management processes, and regular system penetration testing — the audit team did not receive evidence that these controls are practiced on a consistent and regular basis in a manner responsive to identified risks. TfNSW’s leadership must increase its focus and prioritise efforts to ensure effective cyber security and resilience measures are in place for DRIVES as a matter of priority.

Cyber security remains a complex and highly challenging area for TfNSW and all government entities. In July 2021, we assessed how effective TfNSW and Sydney Trains were in identifying and managing cyber security risks. In that audit, we found that neither agency was effectively managing these risks and neither had fostered a culture where cyber security risk management was an important and valued aspect of decision-making. The recommendations we made then remain relevant today.

A key consideration is that, with more than 140 organisations using DRIVES, any vulnerability in individual user’s cyber defences could have potentially significant ramifications for DRIVES. Our 2023 Internal Controls and Governance Report concluded that 83% of the 25 largest agencies in the New South Wales public sector (which includes TfNSW) have reported one or more Mandatory Requirements below level three, which is the level at which the requirement is self-assessed and considered to be practiced on a consistent and regular basis.

The information contained in DRIVES, the system's age and evolution, and the high number of users of the system, means that TfNSW must increase its focus and prioritise efforts to ensure effective cyber security and resilience measures are in place for DRIVES as a matter of priority.

Other risks to service availability

The age and design of DRIVES means that TfNSW faces continued risks to the availability and performance of DRIVES. For example, in early 2022, insurers were unable to process applications for compulsory third-party insurance because tables within DRIVES had reached their maximum ‘as designed’ limit and, as a result, customers were unable to complete vehicle registration transactions. While this issue was resolved and TfNSW now monitors for a potential repeat of it, the risk remains of other issues arising due to the age and design of DRIVES.

TfNSW follows a clear process when it upgrades or changes DRIVES

Over the life of DRIVES, TfNSW has upgraded or changed the system many times to respond to changes in technology and legislative and policy developments, as well as to address customer needs or to fix faults or weaknesses in the system.

Exhibit 7 shows that TfNSW has spent $57.5 million to upgrade or change DRIVES over the five-year period examined by this audit (2018–19 to 2022–23).

Exhibit 7: Summary of the costs to upgrade or change DRIVES ($m)
DRIVES2018-192019-202020-212021-222022-23Total
Development and enhancement6.38.711.813.317.457.5

Source: Audit Office of New South Wales analysis of data provided by TfNSW (unaudited figures).

4The Essential Eight framework is a suite of cyber controls published by the Australian Cyber Security Centre.

While changes to DRIVES are necessary, each change introduces risks to system performance and availability. TfNSW advised the audit team that it has a clear process to manage these risks, which includes:

  • maintaining a forward work plan which helps TfNSW to plan for, sequence and resource the changes
  • evaluating the business and customer impact of each change
  • informing relevant business areas of the planned changes including likely system impacts
  • using a set of decision gates (‘Go’ and ‘No Go’ decisions) which, amongst other things, document and consider the results of testing performed on the planned system change, including system integration, technical, security and business or user testing.

3. Planning for DRIVES replacement

This part of the report considers whether Transport for NSW (TfNSW) is effectively planning to transition DRIVES to a modernised system. It makes findings on the:

  •  effort to develop a business case to fund the replacement of DRIVES
  • issues which have contributed to the slow progress of the replacement program.

3.1 Development of a business case to replace DRIVES

Despite five years of effort and an allocation of more than $60 million in funding, TfNSW does not have an approved business case for the replacement of DRIVES

TfNSW has dedicated a significant amount of time on its preliminary work to plan the replacement of DRIVES:

  • In 2018 and early 2019, TfNSW started, but did not complete, a strategic business case for a DRIVES replacement program.
  • In May 2019, TfNSW's Finance and Investment Assurance Committee considered an investment brief for a DRIVES replacement program. This brief envisioned a program which would commence delivery in July 2020 and complete the replacement of DRIVES by June 2026.
  • In June 2021, TfNSW completed a further strategic business case for a DRIVES replacement program. Program delivery under this business case was planned to start in the second half of 2021 and complete by the end of 2025. Across 2021–22, TfNSW completed significant preparatory work for the program (referred to as ‘tranche 1’ activities) as, in parallel, it continued work on the development of a more complete business case.
  • In October 2022, TfNSW completed a full business case which it described as a ‘bronze’ business case because TfNSW considered it was complete but not yet ready for submission to NSW Treasury. At the time, TfNSW intended to refine the document over the following months and present it to NSW Treasury for funding approval in April or May 2023. Program delivery under this business case was planned to start in the second half of 2023 and complete by the end of 2026–27. Total program costs were estimated to be $498.8 million.
  • In 2023, TfNSW paused work on the bronze full business case and developed a new strategic business case for its DRIVES replacement program. This case very significantly changed the treatment of road safety and cyber security benefits - as it included $114 million of financial benefits from an expected improvement in cyber security (which had previously been a non-financial, or qualitative benefit only) but removed the $536 million of financial benefits that it had previously forecast due to an expected increase in safety on NSW roads.

None of these documents were provided to NSW Treasury for funding consideration. TfNSW has not briefed either Cabinet or any Cabinet committee on the replacement of DRIVES.

Exhibit 8: Summary of the funding allocated to DRIVES replacement programs ($m)
Program2018-192019-202020-212021-222022-23Total
RegStar precursor1.264.55   5.81
RegStar   1540.0955.09
Overall total     60.90

Note: TfNSW subsequently reallocated $4.73 million of funding for 2021–22 to the program for 2022–23.
Source: Audit Office of New South Wales analysis of data provided by TfNSW (unaudited Efigures).

TfNSW does not have reliable information on its spending for the DRIVES replacement programs to date, but reports that it has spent at least $36 million

TfNSW does not have reliable information on its spending for the DRIVES replacement programs over the full five-year period covered by this audit, but it reports that it has spent at least $36.44 million to plan the transition of DRIVES to a modernised system. This understates the true amount of expenditure by an unknown amount as TfNSW did not record the cost of employees who were working on DRIVES replacement programs until the RegStar program was formed in 2021.

TfNSW has spent over $14 million with three consulting companies in its attempts to define the DRIVES replacement program

Exhibit 9 shows that TfNSW has used three major consulting firms to support its planning to transition DRIVES to a modernised system. Spending on EY in 2021–22, 2022–23 and the first four months of 2023–24 totalled $12.897 million.

Graph demonstrating the spend on major consultancies as part of the DRIVES replacement programs between 2018 and 2023
Exhibit 9: Spending on major consultancies as part of the DRIVES replacement programs

Source: Audit Office of New South Wales analysis of data provided by TfNSW.

TfNSW used a competitive tender process to appoint each of the three consultancy firms. It subsequently increased its original contract with PwC by $180,000 and then varied and extended the original contract with EY on three occasions adding a total of $10,917,522 which includes planned spending up until the end of December 2023 (see Exhibit 10 below).

Exhibit 10: Contract variations under the DRIVES replacement programs ($m)
ConsultancyOriginal contract valueNumber of extensions or variationsValue of extensions or variationsRevised contract value
Deloitte0.165NilNil0.165
PwC1.47610.181.658
EY8.113310.91819.031

Note: Revised contract value for EY includes planned spending up until the end of December 2023.
Source: Audit Office of New South Wales analysis of data provided by TfNSW.

TfNSW advised the audit team that the contracts set out in Exhibits 9 and 10 were not for consulting services but instead were for professional services. However, this is contradicted in part by TfNSW's Annual Report 2021–22 which discloses consultancy spending with EY for the RegStar program ($1,278,918).

The current version of the NSW Procurement Policy Framework (April 2022) notes that 'routinely exercising extension options or rolling-over contracts reduces competition and limits access to new suppliers, products and services'. Further, the NSW Procurement Policy Framework requires agencies to conduct a 'strategic assessment of the market prior to rolling-over or extending a contract, including how the extension will impact competition'. The audit team has seen no evidence of market assessments for any of the contract extensions reviewed for this audit.

3.2 Issues contributing to current slow progress

TfNSW has failed to learn lessons from multiple attempts to plan the transition of DRIVES to a modernised system

During the five years examined by this audit, TfNSW has prepared multiple business case documents and completed significant program activity but it cannot clearly state why it has paused or redirected the DRIVES replacement program on multiple occasions. Significant changes over this time have included its:

  • first strategic business case, which was partly completed in 2019 but then not progressed
  • use of three different consultancy companies in four years to support its planning effort
  • redevelopment of its bronze full business case into a new strategic business case, rather than a finalised full business case. Amongst other changes, this involved the monetisation of benefits expected from changes in cyber risk profiles and the demotion of road safety from being a central driver for the program, and monetised benefit, to a qualitative benefit only
  • movement from an ‘arms-length’ to a partnership approach to working with the Licence NSW5 platform (which is being developed by the Department of Customer Service).

TfNSW’s bronze full business case was the most comprehensive set of documents developed during the DRIVES replacement program. As such, it presented an opportunity for TfNSW to:

  • set out DRIVES' long history, including its lack of an overall strategy for its development
  • set out the program’s history, including the multiple attempts to develop a business case
  • learn lessons from previous delays or changes to the program’s strategic direction.

However, TfNSW did not take this opportunity and executives currently responsible for the program could not clearly articulate why previous iterations of the program (which took place before their appointments) were not progressed.

The most recent change in direction of the DRIVES replacement program was confirmed in June 2023 when the Program Steering Committee discussed closer working and greater collaboration with the Department of Customer Service, along with continued consideration of the Licence NSW platform service.

A gateway review in 2022 failed to highlight the need for closer working with Licence NSW

In November 2022, TfNSW received a ‘Gate 2 Review Report’ prepared as part of the NSW Government’s assurance process for major projects. The report concluded that ‘successful delivery of the project to time, cost, quality and anticipated benefits appears feasible but risk and/or issues exist that threaten delivery or overall viability. These appear resolvable if addressed promptly’.

The Gate 2 Review Report was the result of an external independent review undertaken on behalf of the NSW Government and administered by the Department of Customer Service. Amongst other things, the review set out to:

  • assess whether the bronze full business case was robust, would deliver value for money, and has outline plans to realise benefits
  • confirm that all whole-of-government policies, standards and priorities for digital and technology investments had been considered.

The review also considered a request from TfNSW to assess whether the DRIVES replacement program was significantly impacted by an interaction with the government’s digital identity plans and the Licence NSW platform.

The Gate 2 Review Report made six recommendations, including three recommendations it rated as critical on funding and the appropriate treatment of business case options. The report did not recommend redirecting or otherwise pausing the program and made no specific recommendation on the impacts of digital identity or on working more closely with the Department of Customer Service on the program, despite a government directive that requires departments to consider Licence NSW as part of digital funding applications. It did however comment that the Licence NSW platform should be included in the consideration of options in the business case.

TfNSW’s positioning of the Department of Customer Service as an arms-length potential provider rather than a partner has been one of the causes of delays to the program

TfNSW’s current attempt to replace DRIVES is taking place at the same time as the NSW Government progresses its plans to produce state digital assets that can be used by multiple government agencies. One of these assets is the Licence NSW platform, which was developed by the Department of Customer Service for the management of customer and business licences, permits and registrations.

In August 2021, the Department of Customer Service issued a whole-of-government circular (DCS-2021-03 Licence NSW) which placed a requirement on agencies to evaluate the use of the new Licence NSW platform when seeking funding from whole-of-government digital funds.

In early 2023, TfNSW responded to the whole-of-government circular by conducting a proof-of-concept evaluation of the Licence NSW platform, evaluating the Department of Customer Service as if it was an external supplier to government rather than another part of government which could effectively deliver a common service.

In mid-2023, TfNSW redirected the program towards much closer cooperation with the Department of Customer Service. TfNSW and the Department of Customer Service are now working together to determine how Licence NSW platform and the DRIVES replacement will support the administration of a range of transport regulatory activities.

TfNSW needs to resolve several key issues, including DRIVES' role in whole-of-government service delivery and the potential cost to replace it, before it can progress the DRIVES replacement program

TfNSW has an established program team, prepared extensive program documentation and completed considerable preparation for the replacement of DRIVES including work to prepare:

  • strategic business cases and a bronze full business case
  • cost benefit analyses for DRIVES replacement options, including a technical-only upgrade
  • market engagement and sourcing strategy
  • business process mapping and redesign documents
  • program management documents such as stakeholder and change management, risk management and schedule management.

However, to progress further, TfNSW must urgently resolve several key issues including:

  • how the replaced DRIVES supports the NSW government identity strategy and what role it might have in issuing or verifying digital identities
  • how the replaced DRIVES works with the Licence NSW platform including which licensing and regulatory administration activities should be carried out by TfNSW, and which should be carried out by the Department of Customer Service
  • what should be the detailed technical design of the replaced DRIVES considering its relationship with the Licence NSW platform and its role in managing digital identities
  • how to lower the cost of the DRIVES replacement program.

5 Until 2023, Licence NSW was known as Licence.NSW