Identity providers – the electronic Mary Poppinses

At last, everyone will have their own nanny ...

... with absolutely no interference from the state

To no fanfare at all, the Department for Work and Pensions (DWP) today named in a press release seven of the eight organisations selected to be the UK's first "identity providers".

The eighth organisation is presumably having second thoughts. As well they might.

The seven named winners are the Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex and Verizon.

This is all to do with identity assurance, without which nothing in the digital-by-default universe works.

Your identity will be provided henceforth by Digidentity (a Dutch PKI company – public key infrastructure), Ingeus (dedicated to getting the unemployed into work), Verizon (a US mobile phone network with no known presence in the UK), the Post Office, and/or three organisations you may dimly recall having heard of.

How did DWP come up with that list?

They didn't.

GDS are in charge, as they rarely fail to mention. It's GDS who will have made this peculiar selection, the Government Digital Service, they're six weeks late announcing it, we were supposed to know by 30 September 2012, and they're obviously still having trouble with No.8.

We were promised an "ecosystem" of private sector suppliers. The Post Office is not a private sector supplier. Cassidian and Experian earn a material portion of their income from UK government public sector contracts, and Mydex is funded to some extent by Department for Business Innovation and Skills (BIS) and Cabinet Office grants, while its chairman sits on the BIS strategy board for midata.

What should you expect?

An organisation whom you have barely heard of and/or who doesn't know you from Adam will seek to register you. They will enrol you onto a database, asking for all sorts of footling documentation to prove that you are who you say you are and asking a lot of impertinent questions, from which they will create your "personal data store" (PDS). Then, if you apply for Universal Credit (UC), DWP may pay it to you, but only if the identity provider's computers assure DWP's computers that you are you. You have the choice – sign up with one of these identity providers or go without UC.

And for the rest of us?

Mydex think this is a big day. A "global milestone" they call it in The DWP ID assurance decision and the new personal data ecosystem, where Mydex insist on repeating their claims that they can grant everyone total control over their personal data and that midata will save money, a claim which BIS cannot defend.

What Mydex foresee is a day when your personal data store, your PDS, will advise you ... what to watch on television and ... whether to go out to dinner and ... what job to apply for and ... what to wear on holiday. At last, everyone will have their own nanny. Don't be surprised if Nanny also advises you to take out a phone contract with Verizon. Or reminds you to vote in next week's municipal elections in the Hague (Digidentity are Dutch, remember).

Don't believe it?

Take a look at this BIS press release, A midata future: 10 ways it could shape your choices:

midata is about giving the public more control and access to their personal data. There are potentially endless possibilities. This allows not just consumers, but all users, to unlock sources of information in order to make the best choices for themselves, individually and collectively. People could benefit from a range of applications made possible by accessing and sharing digital data about themselves held by businesses Here are 10 ways in which ‘midata’ could be used in future to help change how we manage our lives, carry out day to day tasks and make decisions. 1. Returns, receipts and repairs midata could help you manage your returns and warranties. It could be used by companies to provide electronic receipts of purchases to customers, who can download and store them at home. Instead of losing receipts and forgetting when guarantees expire, customers can use a ‘contracts and warranties dashboard’ to keep track of their purchases. Retailers would save money by getting rid of paper receipts, and call centre costs would reduce as customers have a lot more information. You could manage renewals, returns, repairs, enquiries and upgrades all through a database, and new services could be developed to automatically offer price comparisons when product renewal dates are coming up. 2. Getting a new job midata’ could allow individuals to have access to information held about them by various organisations. When getting a new job, an individual could use verification programmes to send necessary proofs to a new employer. For example, instead of making copies and going to the post office, a new employee could get their driving licence, educational qualifications, CRB check and personal identity all by ticking a set of boxes and clicking ‘send’. This would save money for employers who won’t have to deal with lengthy and expensive hiring processes. 3. Finance midata could help you manage your money in an easier and time efficient way. Service providers can develop and offer services which offer a full picture of accounts and information, instead of having to view and analyse spending from various different financial service providers. You could view your spending, analyse spend by chosen categories, compare offers and set budgets. This would create a foundation for a wide range of added-value money management, analysis and advice services. 4. Shopping midata could lead to services which combine your shopping history, and crunch this data into a range of services which improves your purchasing patterns. You could for example see how much money you’re spending on certain items, brands or companies, as well as any trends in your spending. Take clothing: an individual could receive tailored fashion advice based on their style and purchases. How about your latest summer holiday outfit? A database could offer more specific price comparisons to show you how money could be saved based on the style and products you might usually go for, and send alerts for upcoming sales. 5. Keeping up with the Joneses There are benefits in comparing with other people’s spending: midata could help those who want to change particular habits or make a purchase. For example, a couple may want to save money and energy, but are unsure if their current energy bills or usage are the norm. They are hearing varying opinions from friends and websites, but really want to know the energy consumption of people in a similar situation to them. midata could use their energy consumption and supplier details, as well as the size of their home and family. It could then match their data to that of others in similar situations, and draw comparisons to show whether loft insulation or solar panels have benefitted others. Such programmes will be able to gain insights into customer priorities and offer trustworthy personalised advice in a way that has not been done before.  6. Better billing midata can help users sift through mobile phone tariffs and other utilities quickly and easily with the use of ‘specification building’. Instead of sifting through one tariff after another, users can build a specification of exactly what they want and publish it to the marketplace, leaving it to businesses to make offers that suit them. Alternatively they can filter existing products against their specifications, a process that can be automated. Specification building will provide suppliers with a direct insight into exactly what customers are looking for and immediate contact with the right customer. This eliminates a huge amount of time and money from the marketing process. Such data has the potential to kick-start a major marketplace innovation, driven by customers openly telling suppliers “this is what I want, can you help me?”  7. Health For individuals who need to take a closer look at their lifestyle, for health or personal reasons, midata can help them manage their medication and food intake. midata service providers could take details of medication timings and doses of diabetes sufferers for example. By using such programmes an individual could record their blood sugar levels, physical activity, food intake and day-to-day health issues. That data could be presented to an individual’s doctor or dietician, who will be able to personalise their advice and prescriptions much better. An individual could see where their food intake patterns may be affecting them, and tackling any issues reduce the risks of complications and emergencies.  8. Entertainment midata could lead to service providers giving a much better range and value offer to entertainment customers. If you regularly purchase things like films, music, and theatre tickets you could use this data to be kept ‘in the know’ about the latest entertainment news. ‘midata’ programmes could use purchase info to provide a tailored service which tells customers when their favourite music artists are releasing an album or are on tour, for example, and lead them directly to the ticket providers. Individuals could expand their taste to try suggestions of films and theatre based on previous purchases, leading to an increase in sales of certain sectors. 9. Healthy eating midata could help you take advantage of your grocery purchase data and help manage your diet. Service providers could develop tools which look at not only how shoppers could save money between retailers, but also what they tend to buy as comfort food. Data could be amalgamated to show that a user tends to buy a lot of sweet foods or expensive brands around ‘pay day’, and provide a deeper insight into the added effect of ‘impulse buys’. This could go further to show where certain foods are increasing a user’s blood sugar or cholesterol, and indicate which alternatives could improve their health but satisfy their cravings. This could lead to a reduction in food-related health complications such as diabetes and obesity, and save money not only for the user but for national health services. 10. Going out midata service providers could use an individuals purchase data to look at which restaurants and bars that user like. Taking this data, they could offer you a unique service, alerting you to new or recommended restaurants that suit your taste and location. So where your favourite restaurant has deals or offers, you could be alerted in advance to take advantage and make a booking. Combined with other services, the programme could also indicate where you could save money or improve your health by eating elsewhere, drinking less or going out less.

----------

Updated 5 February 2014:

It was August 2012 when A midata future: 10 ways it could shape your choices was published. Here we are, 18 months later.

In between, the midata Innovation Lab was established and produced five sample prototype apps that were meant to demonstrate the value and attraction of midata.

One of those apps, MI Finances is meant to help you manage your ... finances:

In case you can't read the four nuggets of advice, they say:

Save £70 a month by buying your own ingredients and cooking yourself. Your health may improve too! Do your grocery shopping online and save £14 per month on fuel You're having an average of 4 takeaways a month. Why not make it a special treat? Cut down to once a month and save £100 You're not using your overdraft facility but you're using an expensive credit card. Save £45 a month in interest and cut up that card!

Nanny is on fine form.

Updated 11.10.14

One of the five prototype apps designed to demonstrate the virtues of midata is MI Relative Calm. It's a fine example of what happens when the "quantified self" that Ctrl-Shift and Mydex embrace meets a human being – the human being loses. That may be the answer to William Heath's scandalised question yesterday. Mr Heath is the chairman of Mydex:

Why would Cabinet Office do an elaborate consultation about data sharing policy without putting personal stores in the frame? #baffling — williamheath (@williamheath) October 10, 2014

It's nearly two years since the post above was published. It is still unclear how Mydex can grant control over the way your personal data is used. And it is still the case that the public has yet to see identity assurance in action. Trust in its existence is beginning to wane.

Identity providers – the electronic Mary Poppinses

At last, everyone will have their own nanny ...

... with absolutely no interference from the state

To no fanfare at all, the Department for Work and Pensions (DWP) today named in a press release seven of the eight organisations selected to be the UK's first "identity providers".

The eighth organisation is presumably having second thoughts. As well they might.

The seven named winners are the Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex and Verizon.

This is all to do with identity assurance, without which nothing in the digital-by-default universe works.

Your identity will be provided henceforth by Digidentity (a Dutch PKI company – public key infrastructure), Ingeus (dedicated to getting the unemployed into work), Verizon (a US mobile phone network with no known presence in the UK), the Post Office, and/or three organisations you may dimly recall having heard of.

How did DWP come up with that list?

They didn't.

Cloud computing, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:

Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?]. We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.

But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cloud computing for example.

The Executive summary of the Government Digital Strategy tells us that:

Government is improving the way it provides information by moving to a single website, GOV.UK. Transactional services now present the biggest opportunity to save people time and save the government money [the writers mean "save the people money", the government doesn't have any money, only the people do].

GOV.UK is the implementation of Martha Lane Fox's dream, a single government domain, one website, on which all government information is to be published, and on which we will all communicate with the government via "transactional services".

Every central government website is in the process of being re-written and subsumed in GOV.UK. No more HMRC.gov.uk, no more Education.gov.uk, etc ... One day there will just be GOV.UK. Why? What's the point of all this energetic and agreeable re-writing of what has already been written? The answer has never been made clear.

How many government transactions will GOV.UK need to carry out every year? According to the Government Digital Strategy:

There is a huge volume of transactions with government. There were around 1 billion individual transactions a year with central government departments in 2011/12. This number rises to nearer 1.5 billion when other governmental organisations such as local government are taken into account ...

Clearly GOV.UK is intended to be a remarkably important national asset. It will act as the gateway or hub through which personal and corporate tax returns are made, passports are applied for, the electoral roll is maintained, benefits are paid, student loans are granted, vehicle excise duty is paid, licences are applied for, and so on – 1½ billion transactions a year.

Further on in the Government Digital Strategy we find:

Principle: Broaden the range of those tendering to supply digital services including more small and medium sized enterprises

and

The ICT Strategy stressed the need for government to procure its technical infrastructure - its servers, internet hosting, etc - as commodity services. The CloudStore framework is an example of this shift, with over 300 suppliers offering cloud-based solutions on a pay-as-you-use basis, with a maximum 12 months contract. The learning from the development of the CloudStore framework will be fed into other digital procurement and commissioning reform.

So-called "cloud computing" is being championed by Whitehall's G-Cloud team (government cloud) and they have provided an on-line shop, the CloudStore, making it easy for central and local government to buy IT services. It's just like using Amazon. There's even a little supermarket trolley to fill up.

GDS have elected to host GOV.UK in the cloud. And elected to do so, with a company called Skyscape Cloud Services Ltd whose wares are for sale on CloudStore.

Skyscape is a startup so young that it has yet to file any accounts with Companies House. It has filed an Annual Return, though, according to which Skyscape has no company secretary and only one director, a Mr Jeremy Robin Sanders, who is also the only shareholder in the company, holding all £1,000-worth of ordinary shares issued and fully paid-up.

GDS have decided to entrust an important national asset and 1½ billion transactions a year to Mr Sanders, a decision described in an open letter as "dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible". No response has been received from GDS.

HMRC also have contracted with Skyscape, to store all the data currently held at their hundreds of local offices around the country – presumably all our personal and corporate tax returns and correspondence. In future, Mr Sanders will be responsible for the lot.

HMRC are a sensible lot, you may say to yourself, so perhaps GDS's GOV.UK hosting decision isn't so dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible, after all? Maybe. Or are HMRC being dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible, too?

The matter was taken up with HMRC. And they responded. They say that:

The G-Cloud was created by the Cabinet Office and the Government Procurement Services (GPS) ... In order to deliver services through G-Cloud, all suppliers on the Framework, Skyscape included, were required to meet a set of mandatory criteria set out by GPS including their financial standing and Experian risk assessments. Additionally, HMRC carried out its own standard taxation and financial compliance checks  before awarding the contract and Skyscape passed the standard set by the G-Cloud Framework and HMRC.

To which, all one can say is that there must be something wrong with the Cabinet Office, GPS and HMRC procurement criteria if they determine that it is safe to store all our records with a one-man startup with no track record.

The Skyscape contracts are subject to review by CESG, the information assurance arm of GCHQ. There is that one hurdle still to jump. Given that Skyscape's landlord advertises the address of the Skyscape data centre on its website and even provides a map how to get there, it's hard to see how Skyscape can pass CESG's security tests.

If CESG veto Skyscape, well and good. If not, that's another organisation to add to the dangerous, imprudent, ill-advised, unprofessional, wrong-headed, unbusinesslike, undignified and irresponsible list.

Suppose that the GDS and HMRC contracts weren't with Skyscape but with a bigger company – would that make them better?

No.

For several reasons.

The biggest supplier of cloud computing services in the world is Amazon. Reason #1, you will have noted Amazon's appearance in front of the Public Accounts Committee yesterday:

Andrew Cecil, head of public policy at Amazon, was lambasted by Mrs Hodge for avoiding the Committee’s questions. She said she would “summon” Amazon’s most senior executives as a matter of priority to make up for Mr Cecil’s “unacceptable nonsence.”

Amazon are in the dock, along with Google and Starbucks, for tax avoidance and one member of the Committee, Charlie Elphicke, was moved to suggest that:

The tax abuse can be stopped. We can tighten UK tax presence rules, we can stop the 'expenses' used to cut business tax bills in the UK and we should refuse Government contracts for companies that don't pay a fair share of tax in the UK.

We the public all have to pay our taxes, so should Amazon and Google and all of GDS's friends and Starbucks. If moral indignation gets us nowhere, perhaps a ban on government contracts would do the trick.

Reason #2, cloud computing is normally described as being like a utility, you only pay for the services you use, you don't have to pay for any overhead. It's a "no-brainer", as GDS put it.

It certainly is. No brains at all. Someone must be paying for the overhead. Whether Amazon or Skyscape. And they're going to pass the cost on to their customers. Whether HMRC or GDS – ultimately, us.

We've just had a month of daily news about how expensive our utilities are, gas and electricity, about how there's nothing even the prime Minister can do about it and, just yesterday, there was an allegation of utility price-fixing à la LIBOR. The utility model is not an attractive one. Which may be why GDS have taken to describing cloud computing as "commodity services" rather than the previously more conventional "utility services".

Reason #3, "cloud computing" means losing control. You don't own the computers. You don't own the buildings. You don't vet or train or manage the staff. The staff can be anywhere in the world, as can the computers, and your data with them, beyond your control, beyond the reach of English law. Ask the G-Cloud team about that, and they haven't got any answer. They're just following the latest fashion.

GDS have a weaselly argument that Whitehall is no different, they don't have to have secure data centres staffed by their own people, they can be just like all the other organisations in the world – and they use cloud computing. It sounds modest, doesn't it, and realistic.

But it's utterly mendacious. Some organisations do use cloud computing, some don't.

Ask a lawyer. Ask a lawyer about the legal problems. The data protection issues. The jurisdiction problems. The compliance problems. The commercial problems – what do you do if your supplier goes bust or is taken over by Huawei? Most of all, though, ask your lawyer if his or her firm uses cloud computing. Lawyers have to keep their clients' data under control and confidential. They can't do that if they haven't got a clue where in the world the data is or who's taking what backups. They'd go out of business the day after signing up with a cloud computing services supplier.

Whitehall also has a duty to keep control of our data and to keep it confidential. Cloud computing is an abrogation of that duty.

Reason #4, what does Larry Ellison, the President of Oracle, all $41 billion of him, have to say about cloud computing?

Maybe I'm an idiot, but I have no idea what anyone is talking about. What is it? It's complete gibberish. It's insane. When is this idiocy going to stop?

What do you know that Larry Ellison doesn't?

Where there should be answers to these questions in the Government Digital Strategy there are just holes. Revolution is proposed with no justification. And yet Sir Bob, the head of the home civil service, welcomes this fantasy.

Cloud computing, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:

Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?]. We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.

But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cloud computing for example.

The UK's identity providers

DWP press release:

13 November 2012 – Providers announced for online identity scheme The Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex, and Verizon are the successful providers chosen to design and deliver a secure online identity registration service for the Department for Work and Pensions. The identity registration service will enable benefit claimants to choose who will validate their identity by automatically checking their authenticity with the provider before processing online benefit claims. The Minister for Welfare Reform Lord Freud said: "We are working with cyber security experts to ensure we are clear about the threats to the online process and we are confident that the providers announced today will offer an effective, safe and free to use identity service for future online benefit claims." As well as offering a safe and secure system, providers will be required to offer a simplified registration process, minimise the number of usernames and passwords a customer will need to remember and reduce the costs incurred across Government for the management of Identity Assurance. The online Identity Assurance model will be incorporated into Universal Credit as it’s developed and rolled-out. Over time Identity Assurance will become available to all UK citizens who need to access online public services. Notes to Editors: On 28 February 2012, the DWP issued an Official Journal European (OJEU) advertisement to provide identity assurance services for Universal Credit customers. In May 2012 DWP issued an invitation to tender to 44 suppliers. The value of the 18-month framework contracts is £25m. The Identity Assurance programme is a Government-wide initiative led by the Cabinet Office which will in time be available to all UK citizens who need to access online public services. Universal Credit will be the first programme to use the cross-government Identity Assurance solution. Universal Credit, which will go live nationally in October 2013, replaces the current complicated paper based benefits payment system we have now with a new online application that meets the needs of claimants and employers in today’s digital world. One further provider is expected to sign up in the next few weeks – completing the eight chosen to design and deliver a secure online IDA service for Universal Credit. Media enquiries: 0203 267 5125 Out of hours: 07659 108 883 Website: www.dwp.gov.uk Follow us on Twitter: www.twitter.com/dwppressoffice

The UK's identity providers

DWP press release:

13 November 2012 – Providers announced for online identity scheme The Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex, and Verizon are the successful providers chosen to design and deliver a secure online identity registration service for the Department for Work and Pensions. The identity registration service will enable benefit claimants to choose who will validate their identity by automatically checking their authenticity with the provider before processing online benefit claims. The Minister for Welfare Reform Lord Freud said: "We are working with cyber security experts to ensure we are clear about the threats to the online process and we are confident that the providers announced today will offer an effective, safe and free to use identity service for future online benefit claims." As well as offering a safe and secure system, providers will be required to offer a simplified registration process, minimise the number of usernames and passwords a customer will need to remember and reduce the costs incurred across Government for the management of Identity Assurance. The online Identity Assurance model will be incorporated into Universal Credit as it’s developed and rolled-out. Over time Identity Assurance will become available to all UK citizens who need to access online public services. Notes to Editors: On 28 February 2012, the DWP issued an Official Journal European (OJEU) advertisement to provide identity assurance services for Universal Credit customers. In May 2012 DWP issued an invitation to tender to 44 suppliers. The value of the 18-month framework contracts is £25m. The Identity Assurance programme is a Government-wide initiative led by the Cabinet Office which will in time be available to all UK citizens who need to access online public services. Universal Credit will be the first programme to use the cross-government Identity Assurance solution. Universal Credit, which will go live nationally in October 2013, replaces the current complicated paper based benefits payment system we have now with a new online application that meets the needs of claimants and employers in today’s digital world. One further provider is expected to sign up in the next few weeks – completing the eight chosen to design and deliver a secure online IDA service for Universal Credit. Media enquiries: 0203 267 5125 Out of hours: 07659 108 883 Website: www.dwp.gov.uk Follow us on Twitter: www.twitter.com/dwppressoffice

Cybersecurity, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:

Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?]. We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.

But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cybersecurity for example.

Iain Lobban, the Director of GCHQ, writing in the Foreword to 10 steps to cyber security says:

Every day, all around the world, thousands of IT systems are compromised. Some are attacked purely for the kudos of doing so, others for political motives, but most commonly they are attacked to steal money or commercial secrets. Are you confident that your cyber security governance regime minimises the risks of this happening to your business? My experience suggests that in practice, few companies have got this right.

Mr Lobban's advice on cybersecurity was pressed on FTSE 100 companies at a 5 September 2012 event organised by the Department for Business, Innovation and Skills (BIS), the Foreign Office, the Cabinet Office, the Home Office and senior figures from the intelligence agencies, please see Business leaders urged to step up response to cyber threats.

It's hardly news. The newspapers are full of cybersecurity stories and have been for years – there's an incomplete digest in With their head in the clouds:

...
29 March 2009: Spy chiefs fear Chinese cyber attack
8 March 2010: Cyberwar declared as China hunts for the West’s intelligence secrets
10 October 2010: Worm cripples Iran nuclear plant
13 October 2010: UK infrastructure faces cyber threat, says GCHQ chief
4 November 2010: Europe attacks itself in cyber-warfare test – As OECD admits major security fail
8 November 2010: Royal Navy website infiltrated by computer hacker
18 November 2010: China 'hijacks' 15 per cent of world's internet traffic
9 November 2010: US embassy cables: The background
9 December 2010: Hackers hit Mastercard and Visa over Wikileaks row
13 December 2010: Gawker falls victim to hackers
13 December 2010: WikiLeaks: government websites could be hacked in revenge attacks
20 December 2010: Hackers leak e-mail account details of government and defence staff
20 December 2010: English Defence League donor details 'stolen' after database hacked
29 December 2010: Gawker was hacked six months ago, say sources close to Gnosis
9 January 2011: Army adds cyberattack to arsenal
14 January 2011: Reducing Systemic Cybersecurity Risk
17 January 2011: Security & Resilience in Governmental Clouds
20 January 2011: Carbon trade cyber-theft hits €30m
21 January 2011: Lush hackers cash in on stolen cards
26 January 2011: Facebook's Mark Zuckerberg 'attacked by hackers'
31 January 2011: British and US stock exchanges fend off cyber raids
4 April 2011: Epsilon email hack: millions of customers' details stolen
26 April 2011: PlayStation Network hackers access data of 77 million users
3 May 2011: Sony says 25m more users hit in second cyber attack
26 May 2011: China admits training cyberwarfare elite unit
29 May 2011: Lockheed Martin computers under 'significant attack'
31 May 2011: Cyber weapons 'now integral part of Britain's armoury'
1 June 2011: Google phishing: Chinese Gmail attack raises cyberwar tensions
12 June 2011: IMF hit by cyber attack from unknown nation state
16 June 2011: LulzSec hackers claim breach of CIA website
12 July 2011: Hackers steal 90,000 email addresses in cyber attack on US military contractor Booz Allen Hamilton
15 July 2011: US forced to redesign secret weapon after cyber breach
15 July 2011: Pentagon reveals 24,000 files stolen in cyber-attack
25 July 2011: Anonymous hacks Italy's critical-national-IT protection
1 August 2011: LulzSec hacking: teenager ‘had cache of 750,000 passwords’
1 October 2011: Flaw in software puts online savers at risk
19 October 2011: Stuxnet-based cyber espionage virus targets European firms
27 October 2011: Chinese hackers suspected of interfering with US satellites
20 November 2011: Cyber-attack claims at US water facility
24 December 2011: Hidden Dragon: The Chinese cyber menace
25 December 2011: Hackers 'steal US data in Christmas-inspired assault'
8 January 2012: Hackers expose defence and intelligence officials in US and UK
16 January 2012: Israel hit by cyber-attacks on stock exchange, airline and banks
3 February 2012: Anonymous spies on FBI / UK Police hacking investigation conference call
7 March 2012: LulzSec leader Sabu was working for us, says FBI
11 March 2012: Chinese steal jet secrets from BAE
27 March 2012: NSA Chief: China Behind RSA Attacks
31 March 2012: Hackers steal details of millions of credit cards
23 April 2012: Iranian oil ministry hit by cyber-attack
3 May 2012: Attack takes Soca crime agency website down
3 May 2012: Hackers have breached top secret MoD systems, cyber-security chief admits
1 June 2012: US role in cyber attack on Iran nuclear plant revealed
7 June 2012: LinkedIn passwords leaked by hackers
5 August 2012: Iranian state goes offline to dodge cyber-attacks
21 September 2012: Chinese hacktivists launch cyber attack on Japan
...

You get the idea. The web is a dangerous place to do business. Dangerous for individuals, companies and governments.

But do GDS get the idea? Do they listen to GCHQ? Do they read the newspapers? Read the GDS blog, and you get the impression that digital-by-default is a warm, safe, cosy tea party. In reality, all the magnificent power and convenience of the web is at the disposal of criminals and spies and cyberterrorists to wreak havoc. It's a double-edged sword, the web.

You may notice that the only solution to the problem that Iran can come up with, after long and painful experience of cyber attack, is to secede from the worldwide web altogether and try to create an Iranwide web.

Meanwhile, with no such experience, GDS blithely recommend that all public services should be delivered over the web. They are luring the public into a war zone. Irresponsible? Malign? Or just gullible? But who is more gullible? GDS, or us proles?

What do GDS have to offer by way of defence? The Government Digital Strategy says:

Legality, security and resilience Transactional services will be redesigned to: • be robustly protective of the security of sensitive user information • maintain the privacy and security of all personal information • be resilient, to ensure continuity of service to users and departments

And that's it. No strategy. Just a wishlist. No defence.

Where there should be answers to these questions in the Government Digital Strategy there are just holes. Revolution is proposed with no justification. And yet Sir Bob, the head of the home civil service, welcomes this fantasy.

Cybersecurity, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:

Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?]. We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.

But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider cybersecurity for example.

Whitehall governance, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:

Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?]. We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.

But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider the governance of Whitehall for example.

In 1952 Professor GW Keeton published his book The Passing of Parliament. Keeton was Dean of the Faculty of Laws at University College, London, and according to him:

The relentless growth in size and functions of the Department of State and the relatively high level in calibre of those who staff them, coupled with the steady decline in importance of and function of MPs, has led to a gradual transfer of power and influence from the floor of the House of Commons to the private rooms of permanent civil servants.

60 years later, there are still Whitehall outsiders who believe that politicians make policy. Mainly political journalists, deeply conservative people with a love of tradition and an antique belief in the supremacy of parliament. No-one else believes it.

A few outsiders, unpleasant cynics, the awkward squad, are convinced that policy is made by the European Commission or big business or the trades unions or the US military or the Church of England. But the nice outsiders, the majority, have caught up with Keeton and Yes Minister and for them, policy is made by Sir/Dame Humphreys with a First in Greats.

Apparently the nice outsiders are wrong. Apparently the tail is wagging the dog and policy is made by GDS website designers, who also control the purse-strings and to whom the rest of Whitehall defers.

Back in October 2010 Martha Lane Fox wrote:

[GDS] should own the citizen experience of digital public services and be tasked with driving a 'service culture' across government which could, for example, challenge any policy and practice that undermines good service design ... It seems to me that the time is now to use the Internet to shift the lead in the design of services from the policy and legal teams to the end users ... [GDS] SWAT teams ... should be given a remit to support and challenge departments and agencies ... We must give these SWAT teams the necessary support to challenge any policy and legal barriers which stop services being designed around user needs ... I recommend that all digital teams in the Cabinet Office - including Digital Delivery, Digital Engagement and [GDS] - are brought together under a new CEO for Digital. This person should have the controls and powers to gain absolute authority over the user experience across all government online services ... and the power to direct all government online spend. The CEO for Digital should also have the controls and powers to direct set and enforce standards across government departments ...

Last week's Government Digital Strategy says:

Cabinet Office will help departments to recruit suitably skilled individuals. Newly appointed Service Managers will be supported by Cabinet Office through a specialist training programme run by the Government Digital Service. This will include the hands-on process of designing and prototyping a digital service ... Government digital services are inconsistent and often do not meet the standards that users expect. To ensure that users receive a consistently high-quality digital experience from government, Cabinet Office will develop a service standard for all digital services. No new or redesigned service will go live unless they meet this standard ... Cabinet Office will lead in the definition and delivery of a range of common cross-government technology platforms, in consultation with departments to ensure they meet business needs. These will underpin the new generation of digital services. Departments will be expected to use these for new and redesigned services, unless a specific case for exemption is agreed ... The guidance and tools supporting the [digital by default] standard will help service owners to design trusted, cost-effective government services that are embraced by users and meet their needs first time. Government Digital Service will ensure there is a common understanding across government of what outcomes are required to meet the standard. This understanding must be shared by everyone involved in the development and life of a new or redesigned digital service ... A new Digital Leaders Network was established in early 2012 to drive forward the digital agenda across government. The network is run by the Government Digital Service ...

Who, in GDS, as a matter of interest, is responsible for the nation's education policy? Or transport policy? What rank do GDS-trained "Digital Leaders" enjoy at the MoD?

Will we soon see GDS SWAT teams patrolling the Ministry of Justice and terrorising its denizens into standardisation? Will HM Treasury ring ex-Guardian man Mike Bracken and ask permission every time they want to spend a bob or two? Will the Department of Health really trust GDS to recruit staff for them? (No.) Will HMRC really hold up a web enhancement to their tax-farming implements because GDS tell them to?

The Home Office have a ruinously expensive contract with CSC to develop and maintain the nation's passport application website. What is GDS's locus there? How can they intervene? They don't have the contract – CSC do.

Suppose that GDS actually had all the power suggested by Martha Lane Fox and the Government Digital Strategy. Are they ready to accept the responsibility that comes with it? There are three references to accountability in the strategy document. But what do they amount to? Will anyone be fined? Or demoted? Or fired? Or is "accountability" just a word?

Whitehall departments were meant to co-operate with the Home Office on the ID cards scheme. They said they would co-operate. But according to BBC Radio 4's File on 4 programme on the subject, July/August 2007, when it came to it, either the departments sent someone too junior to the meetings or they sent no-one at all.

"Silo government" they call it in the BBC programme, and something similar put paid to the Cabinet Office's 2005 Transformational Government plan. Co-operation evaporated. GDS's digital-by-default agenda is Transformational Government MK 2 and the same outcome must be expected – co-operation will evaporate.

To us outsiders, Whitehall looks like a set of independent, powerful satrapies with no emperor in control in the centre. The engaging Sir Richard Mottram effectively said as much in his review of the handover from Sir-Gus-now-Lord O'Donnell to the new dispensation.

The repeated attempt to take control of the satraps has always failed, Sir Richard suggests. What reason is there to believe that the time has come now for the empire of the website designer?

Where there should be answers to these questions in the Government Digital Strategy there are just holes. Revolution is proposed with no justification. And yet Sir Bob, the head of the home civil service, welcomes this fantasy.

Whitehall governance, and GDS's fantasy strategy

For some time now, the Government Digital Service (GDS) have made the meaning of their digital-by-default agenda clear – they want the UK to be like Estonia.

It is thanks to the fact that practically every service in Estonia is delivered over the web that, back in 2007, Russia was able to bring the country to its knees in a matter of days. If GDS succeed with their "modernisation" plans, there will be nothing to stop that happening here in the UK.

GDS are in awe of the financial success and popularity of Apple, Amazon, eBay/PayPal, Google and Facebook. With no experience of government behind them, the over-promoted software engineers at the head of GDS want to bring their heroes' tricks to the delivery of public services in the UK.

Sensible people will see Facebook et al as latter-day Pied Pipers of Hamelin – sensible people, including the tens of thousands of public servants who will be laid off and replaced by GDS's computers when government is, as they say, "transformed".

Many of these organisations are famous for avoiding tax on their UK profits and for using their near-monopolies to tyrannise their suppliers and to milk their customers. But GDS somehow maintain their naïve veneration and on 6 November 2012 they published their Government Digital Strategy.

This fantasy strategy is an elaboration of Martha Lane Fox's ideas, set out in her October 2010 letter to Francis Maude, Directgov 2010 and beyond: revolution not evolution. Ms Lane Fox is the Prime Minister's digital champion, she's a historian, and when she says "revolution" she means it.

Her revolutionary fervour is carried over into last week's GDS strategy, which Sir Bob Kerslake – head of the home civil service, permanent secretary at the Department for Communities and Local Government (DCLG) and previously the chief executive of first the London Borough of Hounslow and then Sheffield City Council – has greeted with a post on GDS's blog, Welcoming the Digital Strategy:

Our reform plan also made a clear commitment to improve the quality of the government’s digital services, and to do this by publishing a Government Digital Strategy setting out how we would support the transformation of digital services [how does publishing a wishlist improve the quality of public services?]. We fulfilled that commitment yesterday with the launch of the Government Digital Strategy, Digital Efficiency Report and Digital Landscape Report and I very much welcome their publication.

But why? Why does Sir Bob "welcome" this emmental cheese of a strategy? It's full of holes. Consider the governance of Whitehall for example.