RIP IDA – Mydex flies over the cuckoo's nest

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

Here's a selection of GDS posts and a film in the week leading up to purdah:

24-03-2015	Janet Hughes	Introducing GOV.UK Verify
25-03-2015	Chris Mitchell	Ready for Live: Digital Self-Assessment
25-03-2015	Janet Hughes	Procurement 2: New identity suppliers to join GOV.UK Verify
25-03-2015	Janet Hughes	GOV.UK Verify and Mydex CIC
26-03-2015	Janet Hughes and Stephen Dunn	GOV.UK Verify: Objectives for live
26-03-2015	Mike Bracken	It’s people who make transformation happen
27-03-2015	David Rennie	Working with the private sector to verify identity
27-03-2015	Mike Bracken	Turning the tanker: digital transformation done right
27-03-2015	Mike Beavan	Looking back at the exemplars
28-03-2015	Mike Bracken	Not the HMRC of old
28-03-2015	Mike Bracken	Data as a public asset
29-03-2015	Mike Bracken	Government as a Platform: the next phase of digital transformation
29-03-2015	Liam Maxwell	Better for less
30-03-2015	Martha Lane Fox	The Richard Dimbleby Lecture (text) (text) (text)

If there's a tricky job facing the Government Digital Service (GDS), or indeed an impossible job, what do they do? Call for Janet Hughes.

Let's take a look at her 25 March 2015 offering, GOV.UK Verify and Mydex CIC.

As we were saying, GDS have managed to appoint nine "identity providers" for the second phase of the GOV.UK Verify (RIP) obsequies.

Mydex Data Services Community Interest Company "will continue to work with the Identity Assurance Programme", Ms Hughes tells us. They will work not only on IDA but also with "the government more broadly". They will work "on the policy and delivery areas within specific areas of [their] expertise around verified attribute exchange and consent management for data sharing".

She goes on to say that Mydex have been "an important partner for GOV.UK Verify ... that partnership is ongoing and they are already an approved G-Cloud 6 supplier for their live ISO27001 certified services". Chris Ferguson, Director of the Identity Assurance Programme, is quoted as saying: "Mydex CIC has made a fantastic contribution to the development of GOV.UK Verify and we’ve greatly benefited from their input. We look forward to continuing to work with them through the OIX forum".

There's more where that came from: "Mydex CIC goals for citizens – the community they serve – remain aligned with HMG policy on respecting privacy and offering consent driven identity assurance and data sharing".

And more, but you get the picture – it's hard to overstate how marvellous Mydex are. The only thing is:

Mydex CIC will not be a certified company in the next framework for identity providers.

Why not?

No explanation is advanced. Did GDS refuse to have Mydex on board? Did Mydex refuse to join? We have no idea and there's no point guessing.

Mydex will not be "identity providers" to GOV.UK Verify (RIP) but Digidentity will. So will GB Group. And Morpho. How come? Why them, and not Mydex?

Ms Hughes's post is extraordinary. Nothing similar was written when Cassidian pulled out of the first framework agreement. Nor Ingeus. Nor PayPal. They're not worth memorialising but Mydex are? Why? And nothing similar has been written for all the organisations which applied to join the second framework and then didn't. Just Mydex. Why?

Why bother to write anything at all about Mydex not becoming an "identity provider"? Why bring attention to the matter? Who cares?

Clearly someone cares, for some reason, and that someone thinks that the non-appointment of Mydex needs to be written about. But who could possibly do the job? Only Janet Hughes. And she's succeeded. The perfect result has been achieved. The non-appointment has been documented and yet no-one (other than DMossEsq) is asking any questions in public. Well done, Janet.

The DMossEsq position, incidentally, is that it is commercially reckless for any organisation to get into the GOV.UK Verify (RIP) bed with GDS. In which case this is a good result for Mydex ...

... and a rotten result for the nine "identity providers" that have been appointed. They will look back with envy at Mydex's timely escape.

----------

Updated 21:41

@CyberSecKent It certainly does, apologies for omitting. — David Moss (@DMossEsq) April 19, 2015

RIP IDA – Mydex flies over the cuckoo's nest

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

Here's a selection of GDS posts and a film in the week leading up to purdah:

24-03-2015	Janet Hughes	Introducing GOV.UK Verify
25-03-2015	Chris Mitchell	Ready for Live: Digital Self-Assessment
25-03-2015	Janet Hughes	Procurement 2: New identity suppliers to join GOV.UK Verify
25-03-2015	Janet Hughes	GOV.UK Verify and Mydex CIC
26-03-2015	Janet Hughes and Stephen Dunn	GOV.UK Verify: Objectives for live
26-03-2015	Mike Bracken	It’s people who make transformation happen
27-03-2015	David Rennie	Working with the private sector to verify identity
27-03-2015	Mike Bracken	Turning the tanker: digital transformation done right
27-03-2015	Mike Beavan	Looking back at the exemplars
28-03-2015	Mike Bracken	Not the HMRC of old
28-03-2015	Mike Bracken	Data as a public asset
29-03-2015	Mike Bracken	Government as a Platform: the next phase of digital transformation
29-03-2015	Liam Maxwell	Better for less
30-03-2015	Martha Lane Fox	The Richard Dimbleby Lecture (text) (text) (text)

If there's a tricky job facing the Government Digital Service (GDS), or indeed an impossible job, what do they do? Call for Janet Hughes.

Let's take a look at her 25 March 2015 offering, GOV.UK Verify and Mydex CIC.

RIP IDA: Policy as a Dashboard (PaaD)

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

Here's a selection of GDS posts and a film in the week leading up to purdah:

24-03-2015	Janet Hughes	Introducing GOV.UK Verify
25-03-2015	Chris Mitchell	Ready for Live: Digital Self-Assessment
25-03-2015	Janet Hughes	Procurement 2: New identity suppliers to join GOV.UK Verify
25-03-2015	Janet Hughes	GOV.UK Verify and Mydex CIC
26-03-2015	Janet Hughes and Stephen Dunn	GOV.UK Verify: Objectives for live
26-03-2015	Mike Bracken	It’s people who make transformation happen
27-03-2015	David Rennie	Working with the private sector to verify identity
27-03-2015	Mike Bracken	Turning the tanker: digital transformation done right
27-03-2015	Mike Beavan	Looking back at the exemplars
28-03-2015	Mike Bracken	Not the HMRC of old
28-03-2015	Mike Bracken	Data as a public asset
29-03-2015	Mike Bracken	Government as a Platform: the next phase of digital transformation
29-03-2015	Liam Maxwell	Better for less
30-03-2015	Martha Lane Fox	The Richard Dimbleby Lecture (text) (text) (text)

Let's take a look at Janet Hughes's 25 March 2015 offering, New hopefuls join the cortège for GOV.UK Verify (RIP) ... something like that.

The Government Digital Service (GDS) have managed to appoint nine "identity providers" for the second phase of the GOV.UK Verify (RIP) obsequies. You could respond with the obvious objections yourselves.

But there is something new in Ms Hughes's post:

Procurement 2: New identity suppliers to join GOV.UK Verify We've completed our procurement exercise for a new framework for certified companies ...

Public Servant of the Year ex-Guardian man Mike Bracken CBE CDO CDO, executive director of GDS and senior responsible owner of the pan-government identity assurance programme now known as "GOV.UK Verify (RIP)", has strict rules for the vassals in his manor. "Be consistent, not uniform", for example.

You risk eternal damnation if you break these rules.

Not least in the case of: "Don't procure, commission".

What was Ms Hughes thinking of? Not only has she embarked on a procurement exercise, she admits (a) to having completed it and (b) to the fact that it's the second time – an open source of shame.

You may wonder what else she's supposed to do. How do you go about establishing an identity management scheme for 60 million Brits without doing a bit of procuring?

Shows how much you know.

In the new world of GDS you have to route round Whitehall. That's what Mr Bracken says. You have to change the organising principle of Whitehall. That's all there is to it. Don't argue, JFDI. Be agile. Don't let the law stand in your way. Think Estonia. Security is in the cloud and vice versa. Forget policy, make a dashboard. This is government as a platform. That's what the user needs. Write it on a Post-it® note and bake it into a cake. Because internet.

That is the superior wisdom. Now do you understand the error of Ms Hughes's ways?

RIP IDA: Policy as a Dashboard (PaaD)

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

Here's a selection of GDS posts and a film in the week leading up to purdah:

24-03-2015	Janet Hughes	Introducing GOV.UK Verify
25-03-2015	Chris Mitchell	Ready for Live: Digital Self-Assessment
25-03-2015	Janet Hughes	Procurement 2: New identity suppliers to join GOV.UK Verify
25-03-2015	Janet Hughes	GOV.UK Verify and Mydex CIC
26-03-2015	Janet Hughes and Stephen Dunn	GOV.UK Verify: Objectives for live
26-03-2015	Mike Bracken	It’s people who make transformation happen
27-03-2015	David Rennie	Working with the private sector to verify identity
27-03-2015	Mike Bracken	Turning the tanker: digital transformation done right
27-03-2015	Mike Beavan	Looking back at the exemplars
28-03-2015	Mike Bracken	Not the HMRC of old
28-03-2015	Mike Bracken	Data as a public asset
29-03-2015	Mike Bracken	Government as a Platform: the next phase of digital transformation
29-03-2015	Liam Maxwell	Better for less
30-03-2015	Martha Lane Fox	The Richard Dimbleby Lecture (text) (text) (text)

Let's take a look at Janet Hughes's 25 March 2015 offering, New hopefuls join the cortège for GOV.UK Verify (RIP) ... something like that.

RIP IDA – what they omitted from the obituary

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

Here's a selection of GDS posts and a film in the week leading up to purdah:

24-03-2015	Janet Hughes	Introducing GOV.UK Verify
25-03-2015	Chris Mitchell	Ready for Live: Digital Self-Assessment
25-03-2015	Janet Hughes	Procurement 2: New identity suppliers to join GOV.UK Verify
25-03-2015	Janet Hughes	GOV.UK Verify and Mydex CIC
26-03-2015	Janet Hughes and Stephen Dunn	GOV.UK Verify: Objectives for live
26-03-2015	Mike Bracken	It’s people who make transformation happen
27-03-2015	David Rennie	Working with the private sector to verify identity
27-03-2015	Mike Bracken	Turning the tanker: digital transformation done right
27-03-2015	Mike Beavan	Looking back at the exemplars
28-03-2015	Mike Bracken	Not the HMRC of old
28-03-2015	Mike Bracken	Data as a public asset
29-03-2015	Mike Bracken	Government as a Platform: the next phase of digital transformation
29-03-2015	Liam Maxwell	Better for less
30-03-2015	Martha Lane Fox	The Richard Dimbleby Lecture (text) (text) (text)

Let's take a look at Janet Hughes and Stephen Dunn's 26 March 2015 offering, GOV.UK Verify (RIP): objectives while still technically just about alive, or whatever it's called.

Like a lot of the best obituary-writing, it's what's not said that is telling.

They open with a modest amount of flannel. GOV.UK Verify (RIP) was meant one day to be the default way for people to demonstrate to public services that they are who they say they are, we are told. And then:

• Under the heading What 'live' means for GOV.UK Verify the obituarists tell us what 'public beta' means for GOV.UK Verify.
• And under We've made a lot of progress in our public beta, they fail to mention that the service was meant to be "fully operational" by March 2013.
• Six of the 10 services to which GOV.UK Verify is connected are as invisible to the public as dark matter.
• Of the remaining four services, one of them, the Basic Payment Scheme operated by the Rural Payment Agency, has had to be all too visibly disconnected – farmers have gone back to using paper.
• Meanwhile, the Government Digital Service is promoting its apply-to-register-to-vote system, to which GOV.UK Verify (RIP) is mysteriously not connected.

Getting down to business, Ms Hughes and Mr Dunn put up the Post-it® notes that will guide GOV.UK Verify (RIP) along the path to mass consumer deployment, Objectives for live:

1. Readiness for services to adopt GOV.UK Verify
2. Demographic coverage: 90% for services using GOV.UK Verify by April 2016
3. Success rate: 90%
4. Everyone can use GOV.UK Verify to access services
5. A range of high quality certified companies for people to choose from
6. The product and service are scaled, resilient and operationally ready for live

There's something missing, isn't there.

Where's the nationwide information campaign?

Normal people have never heard of GOV.UK Verify (RIP). GDS want the system to be live in a year's time, by April 2016. Some time soon GDS are going to have to tell 60 million people what GOV.UK Verify (RIP) is. And how it works. And why they should use it.

The media feed us a daily diet of cybercrime. Everyone knows that it exists. The impression is that there is no defence, even for experts in security. That is the background against which GDS have to create trust or confidence in GOV.UK Verify (RIP). It won't be simple. It may be impossible.

60 million people are going to have some questions. Like who will compensate them if they are defrauded as a result of the operation of GOV.UK Verify (RIP). And GDS are finally going to have to answer. They are going to have to be transparent, or open. They need a No.7 Post-it® note.

Without that information campaign, the Objectives for live look like a fine example of what GDS claim to find abhorrent, The Post-it® notes amount to six ways to make life easier for officials and for their chosen suppliers, while we, the users, can just like it or lump it.

Post-it® note ##2 and 3 call for more personal information to be made available to GOV.UK Verify (RIP).

At the moment, the system relies on our credit records. When you try to register with GOV.UK Verify (RIP) you have to answer questions based on what Experian knows about you. Experian is a credit referencing agency and it is one of GDS's three "identity providers".

Apparently that's not enough. It doesn't achieve the 90% success rate for 90% of the population that GDS hope for. They need more data. More than "just" your credit record.

More data such as what? Medical data? Education data? Travel data? Energy usage data? Mobile phone data? Insurance policy data?

Will 60 million people give their informed and voluntary consent to share all this personal data of theirs? Who knows? GDS have to convince people that the rewards outweigh the risks. Good luck with that.

GDS have appointed nine "identity providers":

• Including Digidentity. Who? A Dutch company. What data do they bring to the party to help to achieve 90% coverage for GOV.UK Verify (RIP) in the UK?
• And GB Group. Who?
• And Morpho, a French company with a claimed expertise in biometrics. Are GDS going to ask us all to record our fingerprints? That's the interesting sort of topic that an information campaign might tackle.
• And Verizon. Who? A US mobile phone operator. How do they extend the type of information available to register people in the UK?

Post-it® note #5 tells us that: "Having more certified companies [what GDS used to call "identity providers"] will offer people more choice". In what way more choice? You can choose between three overseas companies who know nothing about you and that's more choice than being restricted to choosing between only two overseas companies who know nothing about you – try putting that on a poster.

Post-it® note #4 tackles the problem of people who can't or won't use digital public services. Ms Hughes and Mr Dunn say: "We've recently started looking at how we can help services allow people to complete at least some of their task in the digital channel rather than having to resort to offline methods".

"Recently"?

"Started"?

GDS decided years ago that all public services should be digital by default. Anyone who can't or won't use digital public services is consequently excluded by default.

You can't have that in a liberal democracy. Public services are for everyone.

So, also years ago, on or before 28 July 2011, GDS dreamt up what they called the "assisted digital" programme to help these wretched non-digital members of the public. We have commented on this matter before, please see GDS & assisted digital – the project that keeps on starting. That was on 29 October 2013 and clearly assisted digital still hasn't made any progress. There's only a year left now ...

... and an awful lot to cover in the unmentioned information campaign for GOV.UK Verify (RIP).

You see? Obituaries? It's the bits they leave out.