Monday 15 June 2015

RIP IDA – “It’s not our IT system; it’s the Cabinet Office’s”

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

Her Majesty's Revenue and Customs (HMRC) offer their parishioners several digital public services, among others Tax credit renewals and Transferable tax allowance. People are having problems using these digital services because they can't get past GOV.UK Verify (RIP).

Public services are services which the public are entitled to. GOV.UK Verify (RIP) is denying the public their rights.

The problem is that people can't register for a GOV.UK Verify (RIP) on-line ID without a passport or a photo-ID driving licence. Even with those documents, they can't register if they don't have a substantial credit history. Even with a substantial credit history, they can't register if they're not moderately computer-literate. Even with moderate computer literacy, they can't register if they don't have access to the internet.

These problems are well-known now and always have been. The Government Digital Service (GDS) claim to be solving them through their assisted digital initiative.

They've been claiming that since 28 July 2011 and they still are claiming it, please see All aboard: 18 months of assisted digital, 4 June 2015. It remains the case that, as the Daily Mail newspaper put it, talking about the Transferable tax allowance service, Thousands miss out in marriage tax fiasco, "HMRC's problem centres on a £25million computer system called Verify".

This matter has come to the attention of Clare McDonald, the business editor of Computer Weekly magazine. She's been talking to HMRC and reports as follows:
“No one will miss out on the Marriage Allowance because of difficulties with online verification. People can apply at any stage in the tax year and get the full entitlement regardless of when they claim,” said an HMRC spokesperson.

“It’s not our IT system; it’s the Cabinet Office’s,” the spokesperson added.
The Cabinet Office is the home of GDS and, understandably enough, HMRC want to make it clear that the dereliction of duty lies with GDS, and not HMRC, “it’s not our IT system; it’s the Cabinet Office’s”.

Ms McDonald concludes that:
Although the Verify scheme is still in its trial stage, these issues highlight the difficulties the Cabinet Office’s “digital by default” plans can bring for particular demographics, including vulnerable members of the public, people without the necessary documentation and those who do not have access to the internet.
"Particular demographics" means people. Here in the UK, public services are for everyone, not just well-connected iPhone users with a long credit history. GDS need to acknowledge reality. RIP IDA.

----------

Updated 20.1.15

Ms McDonald returned to the subject of GOV.UK Verify (RIP) on 11 June 2015, please see Is HMRC making tax more taxing for non-digital taxpayers?. It's not HMRC's system. And even GDS are trying to keep their distance:
GDS identifies need for testing [nothing gets past them]

GDS has highlighted the need for significant provisions and funding for HMRC to include the assisted digital user base during beta testing, as part of its latest assessment of the progress on developing the personal tax account system ...

The GDS team’s assessment of the project found that, although several “assisted digital users” had been identified, there had not been sufficient testing to register their needs. GDS said the system needed “substantial work” to focus on the needs of this type of user.
If it's not HMRC's problem and it's not quite GDS's either, whose is it?

Expect to see Mark Dearnley hung out to dry at some point. Him, and also the non-performing assisted digital team, whose presence here on earth has had no detectable effect.

But when?

HMRC and GDS had better hurry up about it because even ex-tax inspectors are now publicising the problem, "BBC's Linda McAuley interviews ex Tax Inspector Adrian Huston about how some find online verification difficult":



Some of the demographics out there – "people", as we used to call them – may begin to wonder whether HMRC and GDS are being entirely truthful when they say that "no one will miss out on the Marriage Allowance because of difficulties with online verification". That's not how it looks.

RIP IDA – “It’s not our IT system; it’s the Cabinet Office’s”

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

Her Majesty's Revenue and Customs (HMRC) offer their parishioners several digital public services, among others Tax credit renewals and Transferable tax allowance. People are having problems using these digital services because they can't get past GOV.UK Verify (RIP).

Public services are services which the public are entitled to. GOV.UK Verify (RIP) is denying the public their rights.

Sunday 14 June 2015

RIP IDA – security through the looking-glass

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

It's been a torrid week for computer security. Worldwide:
  • Over there in the US "the Obama administration is scrambling to assess the impact of a massive data breach involving the agency that handles security clearances and US government employee records ...", the Guardian newspaper told us, "Government officials familiar with the situation told the Associated Press the hack occurred at the Office of Personnel Management (OPM) and the Interior Department, and could potentially affect four million people at every federal agency".
  • "Although reports are conflicting about how the OPM discovered the breach, it took investigators four months to uncover it", Wired magazine tells us, "which means the EINSTEIN system failed" – EINSTEIN is the US government's anti-hacking/hack detection system. Or not.
  • Dossiers on US spies, military snatched in 'SECOND govt data leak', says ElReg and everyone else, "China said to have stolen detailed info on employees in sensitive federal positions".
  • Meantime in Germany, "two weeks on from the revelations of a serious cyber attack on the German Bundestag, insiders have told The Register that the tech department is 'clueless' about what is going on ... On Friday it emerged that data had almost certainly been stolen ... As yet techies inside the Bundestag don’t know who is behind the attack – or even when it started ... The Trojan malware which penetrated the entire Bundestag network, including MPs' computers, could have been sitting on computers for months or even years".
But then it always is. A torrid week. For computer security. Every week.

You don't need DMossEsq to tell you that. But we have anyway. Repeatedly. Hyperinflation hits the unicorn market we told you, back in October 2013, with links further back to a collection of hacking stories which started in October 2010.

By now, you may agree that computer security is like a unicorn. A lovely idea but there's no such thing. You may agree that marketing computer services on the basis of security is old-fashioned or other-worldly or downright suspicious – what fools do the marketing persons take us for if they imagine we'll fall for that when even US defence contractors can't ... hack it, cybersecuritywise?

You know that, the US Office of Personnel Management knows that, the German parliament knows that, everyone knows that – except the UK Government Digital Service, apparently, who blithely continue to promise that their identity management scheme, GOV.UK Verify (RIP), is secure: "GOV.UK Verify (RIP) will provide users with a simple, trustworthy and secure means of accessing public services".

Sometimes GDS replace their glib promise of security with a glib promise of safety: "GOV.UK Verify is the new way to prove who you are online so you can use government services safely, like viewing your driving licence or assessing your tax". Changing the word doesn't alter the risk. It's still manifest nonsense:
"I can't believe that!" said Alice.
"Can't you?" the Queen said in a pitying tone. "Try again: draw a long breath, and shut your eyes."
Alice laughed. "There's no use trying," she said: "one can't believe impossible things."
"I dare say you haven't had much practice," said the Queen. "When I was your age, I always did it for half-an-hour a day. Why, sometimes I've believed as many as six impossible things before breakfast."

Perhaps GDS are the real thing, delightful eccentrics living in a looking-glass world of their own where they believe without qualification that their parishioners can safely/securely use GOV.UK Verify (RIP).

And perhaps they are cynically manipulative would-be snake oil salesmen exploiting fashion.

It's one or the other and it doesn't matter which because either way the British public is being lured into dangerous territory and that's not what Whitehall is for.

https://identityassurance.blog.gov.uk/wp-content/uploads/sites/36/2014/12/Screen-Shot-2014-12-23-at-10.42.06-620x387.png
Most of us use on-line payments and we would hate to be deprived of that convenience. The banks work hard to try to make on-line payments as safe/secure as possible. When our accounts are nevertheless hacked, as long as we have followed procedures, we are compensated – it's the banks that get defrauded, not us.

Up to a certain point, those compensation payments keep the banks' noses clean, they are motivated to keep on trying hard to increase security. Beyond that point, it won't be worth it, the banks will withdraw on-line payments and it will be goodbye convenience.

GOV.UK Verify (RIP) doesn't follow that model. The "identity providers" limit compensation payments to derisory levels. They operate their parts of GOV.UK Verify (RIP) under contract to GDS, and GDS only. GDS acknowledge no duty of their own to compensate people. What is there to keep GDS's nose clean or their agents' noses?

What Alice found through the looking-glass makes for an enchanting children's story. You can check with the Office of Personnel Management or the German parliament but the world of GOV.UK Verify (RIP) would be altogether grubbier and more unpleasant.

It's one or the other and it doesn't matter which
because either way
the British public is being lured into dangerous territory
and that's not what Whitehall is for.

RIP IDA – security through the looking-glass

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

It's been a torrid week for computer security. Worldwide:
  • Over there in the US "the Obama administration is scrambling to assess the impact of a massive data breach involving the agency that handles security clearances and US government employee records ...", the Guardian newspaper told us, "Government officials familiar with the situation told the Associated Press the hack occurred at the Office of Personnel Management (OPM) and the Interior Department, and could potentially affect four million people at every federal agency".
  • "Although reports are conflicting about how the OPM discovered the breach, it took investigators four months to uncover it", Wired magazine tells us, "which means the EINSTEIN system failed" – EINSTEIN is the US government's anti-hacking/hack detection system. Or not.
  • Dossiers on US spies, military snatched in 'SECOND govt data leak', says ElReg and everyone else, "China said to have stolen detailed info on employees in sensitive federal positions".
  • Meantime in Germany, "two weeks on from the revelations of a serious cyber attack on the German Bundestag, insiders have told The Register that the tech department is 'clueless' about what is going on ... On Friday it emerged that data had almost certainly been stolen ... As yet techies inside the Bundestag don’t know who is behind the attack – or even when it started ... The Trojan malware which penetrated the entire Bundestag network, including MPs' computers, could have been sitting on computers for months or even years".
But then it always is. A torrid week. For computer security. Every week.

Saturday 13 June 2015

RIP IDA – Whitehall and eternity

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

Here's a selection of Government Digital Service (GDS) posts and a film published in the week leading up to purdah:

24-03-2015
Janet Hughes
25-03-2015
Chris Mitchell
25-03-2015
Janet Hughes
25-03-2015
Janet Hughes
26-03-2015
Janet Hughes and Stephen Dunn
26-03-2015
Mike Bracken
27-03-2015
David Rennie
27-03-2015
Mike Bracken
27-03-2015
Mike Beavan
28-03-2015
Mike Bracken
28-03-2015
Mike Bracken
29-03-2015
Mike Bracken
29-03-2015
Liam Maxwell
30-03-2015
Martha Lane Fox

Let's take a look at David Rennie's 27 March 2015 offering, Working with the private sector to verify identity. It won't take long.

Mr Rennie tells us that GDS have regular chats with the Open Identity Exchange (OIX). OIX is a talking shop where people interested in identity management meet. Including GDS. GDS have chatted in particular with the GSMA, the Payments Council and VocaLink. "We are now planning a project to investigate how a certified company could validate a user’s bank details", says Mr Rennie, and that's it.

See? It didn't take long.

In fact, why bother to write about it?

Answer, partly because we know that unmentioned by Mr Rennie GDS have also been talking to the pornographers and the insurance industry, both of whom have rejected GOV.UK Verify (RIP) as useless ...

... and partly because Mr Rennie has just published the same post again, please see Identity assurance and the private sector - a discovery project. No mention this time of the GSMA, the Payments Council or VocaLink, but OIX still figure prominently and so do the banks: "banks and pension providers are interested in how they might use digital identity assurance such as that provided by GOV.UK Verify (RIP)".

So what? So "we've agreed with OIX that it would be useful to have a structured and open conversation about this".

Why? What are they going to talk about? "This will help us develop a shared understanding of the needs for identity assurance ... Nothing is decided or presumed in this work at this stage - we’re approaching the issue with an open mind ... At the moment we’re doing early planning work for this project ...".

Early planning work? Identity assurance and the private sector – a discovery project? Is this some sort of elaborate joke? Nothing is decided ... at this stage? It should be – for goodness sake, Mr Rennie has been engaged in this talkathon for ten years:
David Rennie works for the Cabinet Office's Government Digital Service (GDS) where he is Industry Engagement Lead for the pan-Government Identity Assurance Programme (IDAP). Originally a payments consultant in the financial services sector, David joined the Home Office's Identity Card Programme in 2005 to define and develop the notion of 'identity services' under the National Identity Scheme. He went on to support James Crosby's Public Private Forum on Identity Management in 2007 / 2008 [Crosby, Smith, Kelly and Brown]. Since then he has been developing the principles defined in the Crosby Report into the UK public sector's approach to identity assurance initially from within Directgov and latterly through the Identity Assurance Programme.
If nothing's been decided after all this time it clearly never will be. RIP IDA.

RIP IDA – Whitehall and eternity

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

Here's a selection of Government Digital Service (GDS) posts and a film published in the week leading up to purdah:

24-03-2015
Janet Hughes
25-03-2015
Chris Mitchell
25-03-2015
Janet Hughes
25-03-2015
Janet Hughes
26-03-2015
Janet Hughes and Stephen Dunn
26-03-2015
Mike Bracken
27-03-2015
David Rennie
27-03-2015
Mike Bracken
27-03-2015
Mike Beavan
28-03-2015
Mike Bracken
28-03-2015
Mike Bracken
29-03-2015
Mike Bracken
29-03-2015
Liam Maxwell
30-03-2015
Martha Lane Fox

Let's take a look at David Rennie's 27 March 2015 offering, Working with the private sector to verify identity. It won't take long.

Friday 12 June 2015

RIP IDA – Walter Mitty and the machinery of government

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

GOV.UK is the award-winning on-line face of government in the UK and, as Public Servant of the Year ex-Guardian man Mike Bracken CBE CDO CDO told us back in October 2012, "GOV.UK is not Government on the Internet, but of the Internet".

What does that mean?

It's all something to do with riots. That's what he told the Code for America Summit a year later in October 2013. GOV.UK is the only defence against a recurrence of riots in the streets of the UK.

And it's all something to do with what Tim O'Reilly has called "Government as a Platform" (GaaP).

Some academics disagree. Professor Mike Martin of Newcastle University Business School for example. He points out that GOV.UK is a website, and not a government. Mark Thompson on the other hand, a lecturer at the University of Cambridge's Judge Business School, reckons that if only we plot certainty against ubiquity, GaaP will come to power.

Whichever, Mr Bracken is in no doubt about the general election we have just enjoyed here in the UK: "It was great to see GOV.UK handle the change of government so smoothly".

That was back on 19 May 2015. Having handled the change of administration single-handed, what was in store now for digital government in the UK? The sense of ambition without limit was palpable. When the new government laid out its legislative programme in the Queen's Speech, would there be room for anything else, or would it be all about GOV.UK?

Twitter was all over the story ...


... and ...


... and:


The Conservative Party, who won the general election and formed the new government, had promised in their manifesto to protect children from pornography on the web. The Guardian newspaper article referred to in that last Tweet was written in the language of GOV.UK Verify (RIP). It seemed legitimate to suggest that the government would use GOV.UK Verify (RIP) to protect children.

Legitimate, but wrong, as the Government Digital Service (GDS) primly told us, GOV.UK Verify (RIP) can't help:


Who knew that GDS have a roadmap? They're not meant to. That's like having a policy – verboten.

In the event, against all expectations, the Queen's Speech didn't mention digital government once. These politicians. Useless. They simply don't understand.

Worse, the Prime Minister subsequently announced that "responsibility for the Digital Economy Unit will transfer from the Secretary of State for Business, Innovation and Skills to the Secretary of State for Culture, Media and Sport", for all the world as though digital is nothing but a branch of the entertainments industry, please see Machinery of Government changes: 1 June 2015.

While the nation mourned, hopes dashed, one journalist kept his head. Neil Merrett, mentioned in those Tweets above and long recommended by DMossEsq, read him early and read him often.

In GOV.UK Verify (RIP) potential in focus as private sector talks begin Mr Merrett tells us that "the Cabinet Office is understood to have brought forward talks on identity assurance with private sector internet service providers, raising the possibility of an expanded remit for its GOV.UK Verify (RIP) platform to include online services such as adult content sites".

And the upshot of those talks? Apologies for the long quotation but it does make the point, repeatedly, that GOV.UK Verify (RIP) is too little, too late:
Ultimately, it is thought that the government's ID assurance platform may not be at an advanced enough stage to be useful to current market demands and the needs of internet service providers for a cost effective, intuitive and anonymised service.

... key industry figures working online in areas such as the adult entertainment industry say that rather than waiting for government to fully develop its in-house ID assurance solution, the private sector is already searching for and - in some cases - implementing solutions to tackle a changing landscape for identify and age restrictions.

... having spoken with the Cabinet Office around ID assurance and potential support, he [Chris Ratcliff, managing director at broadcaster Portland TV and a council member of the Digital Policy Alliance] said he did not see any possible rollout of the beta service happening quickly at present, with the market already having to move forward with adopting available solutions.

From the perspective of the needs of online service providers, including adult services and pornographic sites, for a fully functioning ID assurance platform, Ratcliff said GOV.UK Verify (RIP) was likely to arrive too late to serve as a one-stop cross-industry solution.

"This is a solution that I needed about three and a half years ago and not something in beta," he said.

While not ruling out potential use of the government's ID assurance platform entirely, Ratcliff claimed that Portland already had a broad number of options to verify age of subscribers and service users.

He added that the adult entertainment industry and online suppliers of films, alcohol, tobacco and other age restricted products, together with the Digital Policy Alliance, were looking for more innovative means to verify customers, where possible allowing for the potential for anonymised checks that could remove any possible abuse of confidential and personal details.

The UK finance sector has also sought guidance from GDS along with other private providers as part aims to build an innovative "digital passport" ID assurance solution to support online applications for savings accounts and related services ...

"This is an issue that we will bear in mind as we build the prototype. Consumer security and cybercrime considerations are paramount and we do acknowledge that whilst we are working with [GDS], GOV.UK Verify (RIP) may not be the answer for this project," said Dalton-Brown [director general of the Tax Incentivised Savings Association].
GOV.UK Verify (RIP) is no use to HMRC. Or anyone else in either central government or local government. Those "identity providers" who have signed up to GOV.UK Verify (RIP) have wasted their shareholders' money. And it's no use to the private sector.

RIP IDA.

RIP IDA – Walter Mitty and the machinery of government

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

GOV.UK is the award-winning on-line face of government in the UK and, as Public Servant of the Year ex-Guardian man Mike Bracken CBE CDO CDO told us back in October 2012, "GOV.UK is not Government on the Internet, but of the Internet".

What does that mean?

It's all something to do with riots. That's what he told the Code for America Summit a year later in October 2013. GOV.UK is the only defence against a recurrence of riots in the streets of the UK.

And it's all something to do with what Tim O'Reilly has called "Government as a Platform" (GaaP).

Some academics disagree. Professor Mike Martin of Newcastle University Business School for example. He points out that GOV.UK is a website, and not a government. Mark Thompson on the other hand, a lecturer at the University of Cambridge's Judge Business School, reckons that if only we plot certainty against ubiquity, GaaP will come to power.

Whichever, Mr Bracken is in no doubt about the general election we have just enjoyed here in the UK: "It was great to see GOV.UK handle the change of government so smoothly".

RIP IDA – tax credits: another nail in the digital-by-default coffin

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

"If there's a tricky job facing the Government Digital Service (GDS), or indeed an impossible job", we were saying on 19 April 2015 and 20 April 2015, "what do they do? Call for Janet Hughes".

GDS have had to call for her again, please see Basic identity accounts trial.

Her Majesty's Revenue and Customs (HMRC) have been lured into using GOV.UK Verify (RIP) to make sure they know who they're dealing with on-line. The problem is that GOV.UK Verify (RIP) doesn't work.

Ms Hughes takes as her example HMRC's on-line Tax credit renewals service. Who is that on the other end of the line? HMRC need to know. They can't hand out money to just anyone. "... even when the service is live, there will be some people whose identity it’s not possible to verify entirely digitally", Ms Hughes tells us, "for example, it will always be difficult to verify the identity of someone who has no evidence (like a passport, driving licence, bank account) that it’s really them and not someone pretending to be them".

That's the problem.

And the proposed solution?

"Last week we started to trial  a new part of GOV.UK Verify (RIP). Working with HMRC on the Tax Credits service, we've introduced basic identity accounts (also known as LOA1) alongside our existing verified identity accounts (also known as LOA2)".

How do basic identity accounts solve the problem?

They don't:

"As part of the trial of basic identity accounts, people who can’t fully verify their identity account can now set up a basic identity account. HMRC will then ask some additional security questions and give them access to the Tax Credits service. This is sufficient to allow someone to do relatively low-risk things online, like confirm existing details are correct, or save and return later to a form".

Basic identity accounts don't allow claimants to renew their tax credits. They may well be "a new part of GOV.UK Verify (RIP)" but they don't allow HMRC to verify your identity. They may help you to return to a partially completed form but they won't let you renew your tax credits.

Any claimant who can't get a full, non-basic identity account can renew their tax credits claim but only thanks to HMRC asking "some additional security questions".

Tax credits isn't the only on-line service in which GOV.UK Verify (RIP) poses problems for HMRC. The Daily Mail newspaper led the other day with an exposé of HMRC's Transferable tax allowance service, please see Thousands miss out in marriage tax fiasco, "HMRC's problem centres on a £25million computer system called Verify".

Poor old HMRC. They've plighted their troth to the wrong liege. They now have to route round GOV.UK Verify (RIP). They have to do without it. They don't need it. It's not up to the job. They need something that works.

Who else could explain that GOV.UK Verify (RIP) is dead while simultaneously claiming that events are all going according to plan? No-one. Only Janet Hughes.

RIP IDA – tax credits: another nail in the digital-by-default coffin

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

"If there's a tricky job facing the Government Digital Service (GDS), or indeed an impossible job", we were saying on 19 April 2015 and 20 April 2015, "what do they do? Call for Janet Hughes".

GDS have had to call for her again, please see Basic identity accounts trial.

Her Majesty's Revenue and Customs (HMRC) have been lured into using GOV.UK Verify (RIP) to make sure they know who they're dealing with on-line. The problem is that GOV.UK Verify (RIP) doesn't work.

Ms Hughes takes as her example HMRC's on-line Tax credit renewals service. Who is that on the other end of the line? HMRC need to know. They can't hand out money to just anyone. "... even when the service is live, there will be some people whose identity it’s not possible to verify entirely digitally", Ms Hughes tells us, "for example, it will always be difficult to verify the identity of someone who has no evidence (like a passport, driving licence, bank account) that it’s really them and not someone pretending to be them".

That's the problem.

And the proposed solution?