RIP IDA – in search of a rôle

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

"If Verify is the answer, what was the question?"

As noted on 26 May 2016, GOV.UK Verify (RIP) will not replace the Government Gateway. GOV.UK Verify (RIP) won't be any use to hundreds of millions of Her Majesty's Revenue and Customs's annual transactions, worth hundreds of billions of pounds. HMRC are developing their own successor to the Government Gateway.

Nor will GOV.UK Verify (RIP) help with age verification. All those transactions where we have to prove our age in order to be eligible? We'll have to find some other way to do it, even if we have one or more GOV.UK Verify (RIP) accounts.

The huge prize of inserting GOV.UK Verify (RIP) into the nation's payment systems has also eluded the Government Digital Service (GDS). If payments depended on GOV.UK Verify (RIP), the UK would be reduced to a barter economy in no time.

What does that leave for GOV.UK Verify (RIP)?

It's in a precarious position. We've never needed GOV.UK Verify (RIP). Once we've got a new Government Gateway and new age verification systems and new payments systems, we'll need it even less.

In the meantime, GDS are holding out for a rôle for GOV.UK Verify (RIP) in 10 vaguely specified systems:

Register a child’s birth in Northern Ireland – TBC (to be confirmed). File for uncontested divorce – TBC. Inheritance tax online – TBC. View your medical benefit – TBC. Voluntary dissolution of a company – TBC. Amend your driver record – TBC. Sign your mortgage deed – TBC. Apply for the Personal Independence Payment – TBC. Child maintenance – TBC. Bereavement support – TBC ...

GDS's case is undermined by repeatedly claiming that all eight of their "identity providers" are certified trustworthy. They're not.

And by repeatedly claiming that GOV.UK Verify (RIP) abides by all nine identity assurance principles specified by the Privacy and Consumer Advisory group. It doesn't.

And by repeatedly asserting, without qualification, that GOV.UK Verify (RIP) is secure. It can't be. Nothing is.

GDS are undermining the case for Government as a Platform – instead of GOV.UK Verify (RIP) being the single pan-government identity assurance platform, it will be just one among many. Ditto GOV.UK Pay if that platform ever sees the light of day.

And they are undermining the case for data as a public service/evidence-based policy-making, please see Matt Hancock: 83 + 83 = 71.

Exploring the need for GOV.UK Verify [RIP] in local government - get involved was published on 1 June 2016. GDS sound like a supplicant. Will local government intercede on GDS's behalf, where HMRC and others have refused?

Most government in the UK is local government. Mostly, it is local authorities who have to deliver public services. It is local authorities, most of the time, who have to deal with people in person. It is local authorities and not the theoreticians in GDS who have the practical experience of government.

It is possible that local government will come to GDS's rescue. But a 19 June 2016 article on the Government Computing website makes it clear how unlikely that is.

Money is one problem. GDS can't tell the local authorities how much GOV.UK Verify (RIP) would cost them:

Another key consideration for any potential ID solution for local authorities making use of GOV.UK Verify [RIP] is expected to be around finalising a financial businesses case for who will pay private ID suppliers for the service. Delegates at a Socitm [the Society of Information Technology Management] conference held in Leicester last October raised concerns around a lack of a financial plan over how Verify may be adapted and run.

Three times we are told that local authorities need "highly assured" on-line identities but that's just what GOV.UK Verify (RIP) can't provide. The US National Institute of Standards and Technology say that GOV.UK Verify (RIP) doesn't prove people's identities, it just collects a lot of self-certifications.

What is the supposed attraction for local authorities? Why should they use GOV.UK Verify (RIP), according to GDS?

The Blue Badge project is trotted out again. Years of hard work on it, and still no sign of a transformed, digital-by-default service.

Apart from that, what are the "high priorities requiring a system to check individual user eligibility"? Answer apparently, "local authority taxi licensing and parking permit functions".

Opening a GOV.UK Verify (RIP) account requires you to hand over reams of personal information to companies in countries all over the world. GDS may believe that people are prepared to do that just to get a resident's parking permit. Local authorities may believe that that is questionable.

It's out of proportion. It's an unnecessary risk for residents. And who would be liable in the case of losses following a security breach? GDS? Or would it be the local authorities?

That is not the rôle of local government.

And GOV.UK Verify (RIP) will have to try elsewhere to discover its rôle.