Saturday, 12 April 2014

Digital government – the customer is always wrong 2

We noted, a couple of months back, an open letter to the Government Digital Service (GDS) and the Government Procurement Service (now the Crown Commercial Service). The letter was orchestrated by Skyscape Cloud Services, please see G-Cloud – Animal Farm, and included this suggestion:
There is little, if any, transparency of forthcoming opportunity to the supplier, which can in turn lead to negative speculation about how long-lists and shortlists are compiled. We recommend that transparency principles are applied to all areas of G-Cloud transacting:
  • That an opportunity pipeline is published so that suppliers can see who is planning to buy and when (Contracts Finder would be the logical channel);
  • That suppliers are informed if they have been long-listed – and that reasons for failing to make the shortlist are communicated to the supplier. Suppliers can then improve their products and pricing which will in turn benefit the market as a whole.
Skyscape and their 14 fellow signatories want to force prospective customers to tell suppliers what new business is available and they want to force them to explain why they rejected all the other suppliers in favour of the lucky ones who were shortlisted.

"10 out of 10 for trying", you may say, "a bit pushy, unlikely to work – what sanction do suppliers have if customers simply refuse to explain themselves? – but, who knows, they might get away with it. Someone might fall for the it's-in-your-own-best-interests argument, prices will fall and quality will rise. There again, do Skyscape and their friends really want to get into a public shouting match about why they were rejected, how bad their products are and/or how stupid the customers are for rejecting them? The customer is always right, isn't he? ..."

Never mind all that.

How could suppliers be notified of new business opportunities? "Contracts Finder would be the logical channel", say the Skyscape 15, referring to the venerable Contracts Finder website on BusinessLink.gov.uk, a domain which isn't supposed to exist any more but does, like Direct.Gov.uk, don't tell GDS.

Someone has had a better idea.

We refer once again to GDS's Designing the Digital Marketplace, a blog post which includes this:
On commercial retail websites it’s common to favourite or bookmark things (like a house for sale on Rightmove, or a book on Amazon). Adding something to your shortlist on the Digital Marketplace is similar, except it would also allow you to record your reason for including it, for the purposes of an audit trail.

We’re currently testing Projects as a way to organise multiple shortlists. For example, if you’re working on creating a website you will need multiple things; including a CMS [content management system] and hosting. A Project page, which contains shortlists, is one means of organising choices and recording how decisions are made. Later we’ll be designing and testing what adding collaborators to a project (or a shortlist) might look like.
What looks like a facility to help customers manage the product selection process could easily be transformed into a way of giving prospective suppliers detailed information about new business opportunities and the prospective customers' innermost thoughts about them.

It may be advisable not to use this "Projects" facility. Unless you want Skyscape and 14 other suppliers ringing you up every day to badger you.

Digital government – the customer is always wrong 2

We noted, a couple of months back, an open letter to the Government Digital Service (GDS) and the Government Procurement Service (now the Crown Commercial Service). The letter was orchestrated by Skyscape Cloud Services, please see G-Cloud – Animal Farm, and included this suggestion:
There is little, if any, transparency of forthcoming opportunity to the supplier, which can in turn lead to negative speculation about how long-lists and shortlists are compiled. We recommend that transparency principles are applied to all areas of G-Cloud transacting:
  • That an opportunity pipeline is published so that suppliers can see who is planning to buy and when (Contracts Finder would be the logical channel);
  • That suppliers are informed if they have been long-listed – and that reasons for failing to make the shortlist are communicated to the supplier. Suppliers can then improve their products and pricing which will in turn benefit the market as a whole.
Skyscape and their 14 fellow signatories want to force prospective customers to tell suppliers what new business is available and they want to force them to explain why they rejected all the other suppliers in favour of the lucky ones who were shortlisted.

"10 out of 10 for trying", you may say, "a bit pushy, unlikely to work – what sanction do suppliers have if customers simply refuse to explain themselves? – but, who knows, they might get away with it. Someone might fall for the it's-in-your-own-best-interests argument, prices will fall and quality will rise. There again, do Skyscape and their friends really want to get into a public shouting match about why they were rejected, how bad their products are and/or how stupid the customers are for rejecting them? The customer is always right, isn't he? ..."

Never mind all that.

How could suppliers be notified of new business opportunities? "Contracts Finder would be the logical channel", say the Skyscape 15, referring to the venerable Contracts Finder website on BusinessLink.gov.uk, a domain which isn't supposed to exist any more but does, like Direct.Gov.uk, don't tell GDS.

Someone has had a better idea.

Friday, 11 April 2014

Digital government – the market in contempt

Dotted around central government and local government there are thousands of experienced and responsible buyers, among them people who buy IT hardware, software and services. They've been doing it for decades. They know what they're doing. They're not idiots.

It is sensible to collect their experience together. That way standards can be raised and mistakes avoided. It is sensible to share their experience. That cuts out wasteful, repetitive work – there's not much point 100 branches of government assessing the same product 100 times. It is sensible to create centralised "digital marketplaces" like the Digital Services framework, where suppliers will be made to compete on price and quality openly, in full view of the buying public.

In connection with which, please see Designing the Digital Marketplace, which was posted a few days ago on the Government Digital Service's digital marketplace blog and which discusses "some of the exciting new features and improvements we’re bringing to the Digital Marketplace":
... a major design goal is to reassure buyers that they’re buying the right thing, and to make sure buyers are supported throughout the buying process ...

A problem with the current CloudStore is that it’s tricky to find the same search result twice, because the search results are randomised. We’re working on making it easier to find the service you need by improving browsing and searching.

One way we’re doing that is by looking at language. The acronyms SaaS, PaaS, and IaaS mean something to those who know, but to those who are new to cloud services they are confusing. To help users understand the phrasing and categorisation, we’re looking at including a full phrase, an explanation of what it means, and some examples (the most popular) of what these services actually are (see screenshot below). But even with the full phrase, do our users know what “software as a service” means? (For those interested, Ivanka’s written previously about the importance of language.) ...
"... a major design goal is to reassure buyers that they’re buying the right thing"? Do GDS really believe that their colleagues in government who are professional buyers would buy something when they're not sure what it is?

"The acronyms SaaS, PaaS, and IaaS mean something to those who know, but to those who are new to cloud services they are confusing"? Do GDS really believe that their colleagues in government who are professional buyers are out there buying acronyms without knowing what they stand for?

"... even with the full phrase, do our users know what “software as a service” means? (For those interested, Ivanka’s written previously about the importance of language.)"? If someone doesn't know what "software as a service" means, what on earth are they doing buying SaaS? And do we really need Ivanka to tell us that language is important?

It is the thoughts expressed by language which are important. GDS, whose own record is not unblemished, might do well to rein in this thought that they're dealing with idiots when it comes to government buyers. And to the rest of us.

Digital government – the market in contempt

Dotted around central government and local government there are thousands of experienced and responsible buyers, among them people who buy IT hardware, software and services. They've been doing it for decades. They know what they're doing. They're not idiots.

Tuesday, 8 April 2014

RIP IDA – where is it?

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

The Government Digital Service (GDS) are trying to transform government by making it digital by default. They have chosen 25 public services as exemplars. Exemplar no.9 is a service for DVLA – the Driver and Vehicle Licensing Agency – and is described as follows:
If you are a driver you will be able to view information from your record, including what vehicles you can drive and any penalty points and disqualifications. Drivers' data will be made available via a new DVLA enquiry platform built to handle high-volume enquiries
That's point #1.

Point #2 – GDS have been trying for some time to get identity assurance working. On 11 February 2014 they told us that IDA was finally being tested behind the scenes, and that testing on exemplar no.9 would start to use IDA in public in March:
Initially we will be adding more services and users quite gradually, as we continue to get the service ready for wider use. Other services will begin to use identity assurance from March onwards, starting with DVLA’s view driving record service. The DVLA will start trialling identity assurance for some users, aiming to use it exclusively once the identity assurance service is in public beta.
Point #3, on 1 April 2014 DVLA announced that:
Yesterday, at just after midday, we launched the public beta of View Driving Record on GOV.UK.
"... after 15 months of hard work this was it", they said, "we had delivered the first part of what we had set out to achieve ...".

Can you now see "what vehicles you can drive and any penalty points and disqualifications" on-line? Yes.

And can you see IDA in action? No.


After 15 months of work, what we get is the screen form above with just four fields to fill in and when you press the button you get two database lookups – the vehicles you can drive and any points on your licence. Maybe it's harder than it looks but it doesn't look as though that should take 15 months. Not if you're using "agile" software engineering methods.

Leave a space in your National Insurance number or in your post code when you enter it, and GDS tell you "Sorry, due to a technical problem we can't display your details right now. Please try again later" – an obtuse way to tell users to remove the spaces, and a surprising approach for an organisation that prides itself on designing user interfaces.

Are you really the user of this service? The objective is to make life easier for DVLA and for the car hire companies – this service is one step along the path to dispensing with the paper counterpart driving licences we all lose. The objective is also to make it easier for car insurance companies to check that we're telling the truth on our proposals.

This heavy reliance on National Insurance numbers to identify us is likely, we are told, to underpin the individual electoral registration service due to be released in June 2014. Does it provide adequate assurance?

All of these matters and more we can debate. But, point #4, that debate is set against the background of the continued glaring absence of IDA. Where are the so-called "identity providers"? Where are the personal data stores? Where is the secure identity hub?

----------

Updated 7.10.14

"From today, [DVLA, the UK's Driver and Vehicle Licensing Agency] has launched a new digital service. Now you can view your driving licence information online." That's what the Government Digital Service (GDS) said today in a Tweet. And they provided a link to a post on the GDS blog, A new way to view your driving licence info online.

You might take that at face value.

If you were born yesterday.

But as the rest of us know, if only from the 8 April 2014 post above, the service was launched at least six months ago.

No-one knows why it was launched then.

It's of no use to drivers.

And no-one knows why it's being re-launched now. It's still of no use to drivers. And it still operates without the benefit of the long-promised identity assurance.


RIP IDA – where is it?

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

The Government Digital Service (GDS) are trying to transform government by making it digital by default. They have chosen 25 public services as exemplars. Exemplar no.9 is a service for DVLA – the Driver and Vehicle Licensing Agency – and is described as follows:
If you are a driver you will be able to view information from your record, including what vehicles you can drive and any penalty points and disqualifications. Drivers' data will be made available via a new DVLA enquiry platform built to handle high-volume enquiries
That's point #1.

Point #2 – GDS have been trying for some time to get identity assurance working. On 11 February 2014 they told us that IDA was finally being tested behind the scenes, and that testing on exemplar no.9 would start to use IDA in public in March:
Initially we will be adding more services and users quite gradually, as we continue to get the service ready for wider use. Other services will begin to use identity assurance from March onwards, starting with DVLA’s view driving record service. The DVLA will start trialling identity assurance for some users, aiming to use it exclusively once the identity assurance service is in public beta.
Point #3, on 1 April 2014 DVLA announced that:
Yesterday, at just after midday, we launched the public beta of View Driving Record on GOV.UK.
"... after 15 months of hard work this was it", they said, "we had delivered the first part of what we had set out to achieve ...".

Can you now see "what vehicles you can drive and any penalty points and disqualifications" on-line? Yes.

And can you see IDA in action? No.

Monday, 7 April 2014

RIP IDA – long odds

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Last Friday the Government Digital Service (GDS) announced that they would be issuing a new invitation to tender for identity assurance work (IDA), please see Identity assurance, procurement 2.

As noted, it looks as though enrolment into IDA would cost 35 times more than GDS previously told us. £30 million was meant to pay for 21 million putative registrations. In the event, it will cover only 600,000 putative registrations.

In a typically clear-headed assessment published in Computer Weekly magazine, Toby Stevens describes the difficulties GDS face with IDA. He also examines the position of suppliers considering a bid. Should they try to become "identity providers" (IDPs)? He has this to say:
... an IDP would need to run a population of 250,000 users in the first year just to have a chance of breaking even. That's going to be a problem for stretched Sales Directors who are evaluating bid risks and trying to determine where to focus their sales resources. Why bid the high-risk job with the deferred payback, when they could go for safer projects with up-front payment ...

I think I’d rather put my money on a 5-horse accumulator than an IDP bid team.
No board is going to sanction betting on the horses as a business development strategy. The equity analysts wouldn't wear it. Neither would the shareholders. The directors could kiss goodbye to their careers.

Nevertheless, the salesmen will probably turn up to the 28 April 2014 "event for interested organisations". That's what salesmen do. Quite rightly. It promises to be a re-run of the 20 September 2010 meeting, please see Identity assurance. Only the future is certain – doom 1.

GDS didn't exist then, back in September 2010. They do now. But it remains the case nevertheless that investing in IDA is akin to betting on the horses. Toby Stevens says: "GDS has a track record of delivering 'impossible' projects". He is a kinder man than DMossEsq. "Impossible" means impossible. RIP.

RIP IDA – long odds

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Last Friday the Government Digital Service (GDS) announced that they would be issuing a new invitation to tender for identity assurance work (IDA), please see Identity assurance, procurement 2.

As noted, it looks as though enrolment into IDA would cost 35 times more than GDS previously told us. £30 million was meant to pay for 21 million putative registrations. In the event, it will cover only 600,000 putative registrations.

In a typically clear-headed assessment published in Computer Weekly magazine, Toby Stevens describes the difficulties GDS face with IDA. He also examines the position of suppliers considering a bid. Should they try to become "identity providers" (IDPs)? He has this to say:
... an IDP would need to run a population of 250,000 users in the first year just to have a chance of breaking even. That's going to be a problem for stretched Sales Directors who are evaluating bid risks and trying to determine where to focus their sales resources. Why bid the high-risk job with the deferred payback, when they could go for safer projects with up-front payment ...

I think I’d rather put my money on a 5-horse accumulator than an IDP bid team.
No board is going to sanction betting on the horses as a business development strategy. The equity analysts wouldn't wear it. Neither would the shareholders. The directors could kiss goodbye to their careers.

Friday, 4 April 2014

RIP IDA – registration just became 35 times more expensive

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

It seems like only yesterday but actually it was 1 March 2012 when Public Servant of the year ex-Guardian man Mike Bracken MBE published Identity: One small step for all of Government.

At that stage, the Cabinet office had "built a new team and delivery plan and a working governance structure to implement Identity Assurance solutions strategically across government", he told us. The team was starting the "exciting challenge" – progress to date unknown – of "creating a trust infrastructure", whatever that is.

The Department for Work and Pensions (DWP) were going to be the "vehicle" for delivering identity assurance (IDA). Get it right for DWP and IDA could be "cut" (copied?) and pasted across the whole of Her Majesty's Government (HMG) to support its digital-by-default policy. That's what he said.

"In the first instance, IDA digital services will be used to support Universal Credit and the Personal Independence Payment, which from 2013 will replace DWP’s current benefit system". Some details were set out in a notice published in the Official Journal of the European Union (OJEU): "The initial DWP services will be required to provide identity assurance for approximately 21 000 000 claimants".

And how much was this all going to cost? Thanks to the Government Digital Service (GDS), the cost of IDA had been cut from DWP's £240 million estimate to just £30 million (= £25 million + VAT).

In the event, two years later, there is still effectively no Universal Credit and there are no "IDA digital services".

But there is a new post on the IDA blog written by Janet Hughes and David Rennie, and there's going to be a new OJEU notice, please see Identity assurance, procurement 2.

We are reminded that "last year we signed contracts with 5 identity providers. These are companies that will verify that users are who they say they are ...".

"Identity providers"? Have you grown accustomed yet to this 21st century science fiction in the British Constitution? Probably not. No-one in the UK has been provided with an identity yet by any of these five companies and there is no sign that anyone ever will be.

Today's IDA post goes on to say that "identity providers are paid each time a user registers with them. The initial contracts cover the first 600,000 registrations. We’re expecting to use all of these this year ...".

Just a minute.

The "initial contracts" were meant to cover 21 million DWP claimants. That's what the OJEU said. Where has this 600,000 figure come from? The goalposts have moved.

The DMossEsq slide rule suggests that value for money, IDAwise, has just plummeted by a factor of 35. At this rate, registering 21 million claimants would cost just over a billion pounds, making DWP's £240 million estimate seem modest by comparison.

GDS now have to plug an enormous hole in their "trust infrastructure". If there ever are any registrations in GDS's non-existent IDA programme, those registrations are going to cost 35 times more than we were first told. And in another two years' time? What will we be asked to believe then?

RIP IDA – registration just became 35 times more expensive

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

It seems like only yesterday but actually it was 1 March 2012 when Public Servant of the year ex-Guardian man Mike Bracken MBE published Identity: One small step for all of Government.

At that stage, the Cabinet office had "built a new team and delivery plan and a working governance structure to implement Identity Assurance solutions strategically across government", he told us. The team was starting the "exciting challenge" – progress to date unknown – of "creating a trust infrastructure", whatever that is.

Thursday, 3 April 2014

Estonia – are we nearly there?

This morning's Computer Weekly headline speaks for itself: "Parliamentary computers crash 90 minutes after IT assurances".

There was a "major incident" nine days ago on 25 March 2014 when parliamentarians and their staff had trouble with email and internet access. Joan Miller, Director of Parliamentary IT, emailed her users at 12:28 to say that the problem had been fixed. 89 minutes later at 13:57 it happened all over again, major incident #2.

That's a resilience problem. Like the Government Digital Service's CloudStore being unavailable for several days. Twice. In October and November 2013.

Then there's the security problem. Even when Parliament's IT is up and running smoothly, you will remember, Ms Miller suffers from the Government Digital Service's problem – security isn't important, usability is what matters, please see The Tragedy of the Commons.

Parliament seems to be in danger of enjoying neither resilience nor security.

"Would that work here?", BBC Radio 4 asked last night. In Estonia they seem to have iDemocracy, as recommended by Douglas Carswell. How far along the road to Estonia is the UK? Without resilience, security and identity assurance, not very.

Estonia – are we nearly there?

This morning's Computer Weekly headline speaks for itself: "Parliamentary computers crash 90 minutes after IT assurances".

There was a "major incident" nine days ago on 25 March 2014 when parliamentarians and their staff had trouble with email and internet access. Joan Miller, Director of Parliamentary IT, emailed her users at 12:28 to say that the problem had been fixed. 89 minutes later at 13:57 it happened all over again, major incident #2.

That's a resilience problem. Like the Government Digital Service's CloudStore being unavailable for several days. Twice. In October and November 2013.

Then there's the security problem. Even when Parliament's IT is up and running smoothly, you will remember, Ms Miller suffers from the Government Digital Service's problem – security isn't important, usability is what matters, please see The Tragedy of the Commons.

Parliament seems to be in danger of enjoying neither resilience nor security.

"Would that work here?", BBC Radio 4 asked last night. In Estonia they seem to have iDemocracy, as recommended by Douglas Carswell. How far along the road to Estonia is the UK? Without resilience, security and identity assurance, not very.

Monday, 31 March 2014

Waterfall Wanderers 0 - 0 Agile Athletic

As we were saying:
The traditional approach to software development is often known as 'waterfall' development: that is, you plan, build, test, review and then deploy, in a relentless cascade. But some IT industry players regard this practice as the chief problem ...A rather different answer which has emerged in the last ten to fifteen years has been what are called 'Agile Systems', perhaps best described as a philosophical movement in action within the software industry.
The quotation comes, of course, from Richard Bacon MP and Christopher Hope's Conundrum: Why every government gets things wrong and what we can do about it, pp.240-1. Here we are, back again, asking why government IT systems too often go over budget and what we can do about it.

The fashionable answer is that the problem is the "waterfall" engineering of software systems and the solution is "agile" engineering. Waterfall bad, agile good. That's the idea. Let's explore it a little.

Waterfall is always associated with Winston W Royce (1929-95) and, to hear people talking about waterfall these days, you'd think he was a bit of an idiot. Actually, he was a rocket scientist who got into large-scale software engineering and ended up running IT for Lockheed.

The reason he bears the blame for the British government wasting a fortune on IT, by common consent, is something to do with a paper he published in 1970, Managing the Development of Large Software Systems. A paper in which, incidentally, the word "waterfall" doesn't appear.

On the other hand, this diagram does appear:


That looks like a waterfall. To some people. Is that the smoking gun?

No.

Royce calls that a "grandiose" approach to systems development and he doesn't recommend it because it omits the "iterative relationship between successive development phases" shown in his next diagram:

He prefers this iterative approach in theory but he believes that in practice it "is risky and invites failure" because of the problem illustrated below – the developers can get locked in a loop, iterating away forever, never deploying the system, never releasing it into the field, it never moves into operational use:

Is that what's happened to the agile-loving Government Digital Service (GDS) and their so-called "transformation programme" with its 25 "exemplars"?

The dial seems to have been stuck on "1" for the number of live services for a very long time.

The single live service is exemplar #6 – Student Finance, which was released no later than 31 October 2012, please see Refining transactions with help from the Minister.

That's 18 months ago. What's going on with the other 24 exemplars? Has the "operations" box become disconnected from the rest of the agile development process, as predicted by Royce?

Maybe.

Are GDS suffering from the lack of an identity assurance service? Would they have done better to stick with the Government Gateway?

Maybe.

Or is it something to do with this paragraph which appears under the 1/7/16/1 dashboard:
The Government Digital Strategy and departmental digital strategies commit us to the redesigning and rebuilding of 25 significant ‘exemplar’ services. We’re going to make them simpler, clearer and faster to use. All these are to meet the Digital By Default Service Standard by April 2014 and be completed by March 2015. 
All 25 exemplars have to meet the digital by default service standard in no more than 30 days time. What does that mean? Never mind.

Look at that "March 2015" at the end of the quotation. Surely no politicians think that releasing 24 digital services at the same time as launching their manifesto will help them to win the UK general election two months later in May 2015, do they?

Maybe.

We don't know why progress has stalled, but it has – agile doesn't seem to be doing any better than waterfall.

What would Royce have recommended 44 years ago? Do your program design first, he said, keep your documentation up to date, do a prototype, test thoroughly and involve the customer. In a nutshell, this – the bit to the left of the dotted line:


Whatever it is, it isn't a waterfall. Not as we know it.

----------

Updated 4.12.15

As far as the Government Digital Service (GDS) is concerned, agile is the only methodology for successful software engineering. They have always said that. Ex-Public Servant of the Year ex-Guardian man Mike Bracken CBE ex-CDO ex-CDO, ex-executive director of GDS and ex-senior responsible owner of the pan-government identity assurance programme now known as "GOV.UK Verify (RIP)", said it in connection with the UK's digital Basic Payment Scheme for farmers, for example:
I go weekly now. I go to the meeting of the Common Agricultural Policy Reform Group. It's the RPA. It's the Rural Payments Agency.

Why I'm so excited about that is because they've embraced agile completely. They're going with an agile build out of a whole new programme. That's going to affect everyone in this country, and how they deal with land management, all the farmers, all the people who deal with crops, all the data. It's going to create, I think, a data industry around some of that data.

It's going to help us deal with Europe in a different way, and quite rightly we're building it as a platform. It's going to be another example of government as a platform.
And yet the digital BPS failed and our farmers now have to apply for their money using pencil and paper.

The National Audit Office have published their report on this failure, Early review of the Common Agricultural Policy Delivery Programme. And they say:
GDS provided limited continuity and insufficient insight into how to adopt agile on this scale. It was not able to identify and provide the systems integration skills required ... (p.9)

... the Cabinet Office [i.e. GDS] should ... provide stronger written guidance and capability building for departments on agile management and governance for major projects and how it fits with traditional governance structures ... [and should] support departments in acquiring the management and technical skills required to apply agile at scale ...(p.12)

The Department [DEFRA, the Department for Environment Food & Rural Affairs] and the RPA [Rural Payments Agency] had no experience of the agile approach. The Department felt it did not receive sufficient support from GDS given the level of experience of Programme staff, leading to poor application of agile. Programme governance was not adapted to quick iterative development cycles. (p.22)

The Department told us it sought guidance in 2013 from GDS on best practice for agile governance, but guidance on this was not published until June 2014. (p.28)

The Department and the RPA described GDS support as patchy. There was little continuity in personnel and GDS staff were reported to have provided insufficient insight into the use of agile at this scale. (p.33)

Many of the commitments GDS made to the Department are vague. For example, it did not quantify the savings that the use of agile would achieve: “no formal estimates of cost savings will be offered but previous experience of operating in an agile manner would suggest a significant cost reduction can be expected from traditional approaches to large scale IT procurement”. It was agreed that the Memorandum of Understanding would be reviewed every six months at Programme Board level, but this did not happen. (p.33)

More comprehensive guidance on agile management would help departments align governance for major projects with traditional governance structures. (p.34)
It looks as though GDS's enthusiastic advocacy of agile methodology is based more on fashion than useful practical experience. They may be keen but, when confronted with the reality of a public service, it looks as though GDS can't deliver.


Updated 7.9.16

Universal Credit – From disaster to recovery? Good question.

That's the title of a report just published by the Institute for Government (IfG). Has Universal Credit (UC) flirted with disaster? Yes it has. Is it possible that UC will one day succeed? Yes it is.

UC is a Department for Work and Pensions (DWP) initiative. The report provides some insight into the IT problems of UC and the occasionally fraught relationship between DWP and the Government Digital Service (GDS):
The reason it took 'much longer than they originally thought it would', according to Lord Freud, was that the GDS team were initially 'very naïve' about just how complex it was to build Universal Credit. He says:
They were messianic about building the front end, doing it in an agile way, front facing, with their beautiful apps, and they were right about all of that. But they had no grasp of how complicated it was to tie the front end to the legacy back-office, these old and creaky legacy systems we have with which it had to work – the customer information system, the debt management system, the payment system and all the things you need to run 20 million people and their records, and with all that implied.
There's a lot more where that came from (p.53) for anyone interested.

The IfG report identifies a lot of problems faced by UC including unrealistic timetables, DWP overload, lack of in-house skills and poor governance. "Waterfall" software engineering methods were not the only problem. "Agile" also was a problem. Nothing in the report demonstrates that "agile" is the solution – some of that earlier fashionable "messianic" ardour was misplaced ...

... and is now waning, please see for example The Tyranny of Agile.

Waterfall Wanderers 0 - 0 Agile Athletic

As we were saying:
The traditional approach to software development is often known as 'waterfall' development: that is, you plan, build, test, review and then deploy, in a relentless cascade. But some IT industry players regard this practice as the chief problem ...A rather different answer which has emerged in the last ten to fifteen years has been what are called 'Agile Systems', perhaps best described as a philosophical movement in action within the software industry.
The quotation comes, of course, from Richard Bacon MP and Christopher Hope's Conundrum: Why every government gets things wrong and what we can do about it, pp.240-1. Here we are, back again, asking why government IT systems too often go over budget and what we can do about it.

The fashionable answer is that the problem is the "waterfall" engineering of software systems and the solution is "agile" engineering. Waterfall bad, agile good. That's the idea. Let's explore it a little.

Waterfall is always associated with Winston W Royce (1929-95) and, to hear people talking about waterfall these days, you'd think he was a bit of an idiot. Actually, he was a rocket scientist who got into large-scale software engineering and ended up running IT for Lockheed.

Sunday, 30 March 2014

The Scottish on-line security experiment


On-line, you can have convenience. Or you can have security.
One or the other.
But not both.

Stolen Twitter passwords 'worth more than credit card details'.

That's what it said in the Telegraph a few days ago, 28 March 2014. Credit card details are only worth between $2 and $40 these days on the black market, whereas your Twitter password can be worth between $16 and $325. That's what Michael Callahan of Juniper Networks says. And he's a security expert.

You're probably getting bored with these stories. They appear every day in the media. And every month on the DMossEsq blog, see for example Cybersecurity, and GDS's fantasy strategy. And "When it comes to cyber security QinetiQ couldn’t grab their ass with both hands". And Hyperinflation hits the unicorn market. And ...

It's boring. But it's still important.

The Telegraph article ends with this advice:
Callahan said it was vital for people to use different passwords for each site, so that if one account is compromised it will not allow the hackers access to their whole digital lives
He's not a security expert but even DMossEsq says that. Repeatedly. See for example Identity assurance – convenient? It'll make your life so much easier. And GDS – the user experience of misfeasance in public office. And Digital-by-default, an open letter to the House of Commons Science and Technology Committee (para.14). And ...

But the Government Digital Service (GDS) disagree. They're the people in charge of the identity assurance programme. And when the UK's first so-called "identity providers" were appointed, this is what we read, the opposite of Callahan:
Providers announced for online identity scheme

The Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex, and Verizon are the successful providers chosen to design and deliver a secure online identity registration service for the Department for Work and Pensions.

... providers will be required to offer a simplified registration process, minimise the number of usernames and passwords a customer will need to remember ...
It's hard work/inconvenient having multiple logon details.

GDS want to make life more convenient for us all. Keep all your logon details in a personal data store (PDS), they say, and the PDS can log on for you to your Amazon account or your electricity account or your bank account and so on and so on, world without end. All you have to remember is the logon details for your PDS. Much more convenient.

And much less secure.

As Mr Callahan says.

And DMossEsq.

On-line, you can have convenience. Or you can have security. One or the other. But not both.

GDS just can't take security seriously. See for example RIP IDA – JFDI security. Security is over-rated, according to GDS, and should always be trumped by usability/convenience.

Who's right?

How can we decide?

We need to conduct an experiment.

As luck would have it, there's an experiment coming up. A big one. In Scotland. Please see Connecting the nation – Scotland's empowered future: "Scotland’s proud heritage of innovation beckons, and Mydex CIC is proud to be part of enabling that future".

(Can a proud heritage beckon?

Never mind.)

Scotland has a Digital Participation Charter and Mydex are going to help her on the road to Estonia. They have a trust framework. They aim to make every on-line transaction dependent on Mydex.  And they will "empower" everyone with a PDS. Armed with one of these dematerialised ID cards, no Scot will ever again have to remember more than one password. That may be convenient. But will it be secure?

The Scots will soon find out.

And so thereby will we.

The Scottish on-line security experiment


On-line, you can have convenience. Or you can have security.
One or the other.
But not both.

Stolen Twitter passwords 'worth more than credit card details'.

That's what it said in the Telegraph a few days ago, 28 March 2014. Credit card details are only worth between $2 and $40 these days on the black market, whereas your Twitter password can be worth between $16 and $325. That's what Michael Callahan of Juniper Networks says. And he's a security expert.

You're probably getting bored with these stories. They appear every day in the media. And every month on the DMossEsq blog, see for example Cybersecurity, and GDS's fantasy strategy. And "When it comes to cyber security QinetiQ couldn’t grab their ass with both hands". And Hyperinflation hits the unicorn market. And ...

It's boring. But it's still important.

Friday, 28 March 2014

Time for someone to take the personal information economy seriously

1938 Sears Spring/Summer Catalog
"The roots of mail order date back to the middle ages. In 1498, Aldus Manutius of Venice, a publisher, brought out a catalog of 15 texts which he had published, which were precursors of the paperback books of today" – so says Bonnie Unsworth in her A Brief History of Mail Order Catalogs.

Rather more recently, "the real beginning of mail order was the result of the experiences of a traveling salesman in the mid west, named Montgomery Ward. He published a catalog sheet that listed 163 items right after the Civil War. Within two years, the catalog grew to 8 pages, and then to 72 pages. By 1884, the catalog contained 240 pages with thousands of items, almost everyone of which was illustrated with a woodcut".

While they had Montgomery Ward and Sears Roebuck in the US, here in the UK we had Great Universal Stores, always known affectionately as "GUS".

Mail order was big business and the philanthropic Sir Isaac Wolfson amassed a fortune at GUS. The Wolfson Foundation has awarded charitable grants worth over £1 billion since 1955.

Not just big business, mail order was a credit business. There was no point Mr Ward repeatedly sending the products they had ordered to people who didn't subsequently pay for them. Ditto Sir Isaac. They needed to know before despatch that a given customer wasn't too likely not to pay.

The Manchester Guardian Society was established as a credit rating agency in 1826 in the UK. 1897 saw the formation of the Merchants' Credit Association in the US. The Ramo-Wooldridge Corporation and Thompson Products merged to form TRW in the 1960s. TRW's leading light, Simon Ramo, predicted the cashless society as early as 1961 – enter the credit card. GUS created Commercial Credit Nottingham in 1980, injected TRW into it in 1996 and the whole lot became Experian.

Once you've collected a lot of data about a lot of people – including the UK electoral roll data which Experian picked up en passant – you can do a lot more with it than just calculate a credit rating. That's an important job, oiling the wheels of commerce, but you can also for example sell your data to political parties, seeking to identify floating voters and persuade them to come down on their side of the party fence.

You can help new and established businesses target their marketing. You can do demographic analysis. You can, famously, offer to help the Department for Work and Pensions to find benefit cheats.

And perhaps you can provide the basis for identity assurance, should some government want to make public services, say, digital by default.

That raises questions about the privacy of personal data and the security with which it is maintained. We seem to have quite good laws in the UK protecting that privacy and adequately ensuring the related security – laws which Experian and its UK competitors have a good record of obeying.

They have fewer data broking laws in the US. It is the desire to make good that omission that lies behind the work of Senator Rockefeller's Commerce, Science, & Transportation Committee which we alluded to the other day.

The UK's privacy laws are permanently under threat from attackers like Google, Facebook, Francis Maude (passim), the Health and Social Care Information Centre (care.data), Professor Sir Nigel Shadbolt (ODI, midata), Stephan Shakespeare (PSI) and the Government Digital Service (identity assurance). Not to mention the NSA, GCHQ and every other halfway competent intelligence service in the world. Among others.

Perhaps the walls of civilisation will withstand the siege. Perhaps they won't. Who knows.

One thing we do know is that there's nothing new about mail order or its descendants such as Amazon. Their history can arguably be traced back to fifteenth century Venice.

And there's nothing new about the market in personal data. It already has laws associated with it, suppliers like Experian, trade associations like the DMA, and marketing "gurus" wielding techniques that have grown up over several decades, if not centuries.

You know that.

Everyone knows that.

Except, it seems, the new world born yesterday delegates at last week's seminar on the personal information economy, PIE2014. See, for example, Business scents ‘boom’ in personal information economy:
Business leaders are starting to respond to an emerging market in personal information affecting all individuals and organisations across public and private sectors.

In an interview recorded at last week’s Personal Information Economy 2014 event in London, Alan Mitchell, strategy director of Ctrl-Shift, told the Information Daily that "overall, business is not very well informed, and people are only just beginning to think about it, but it is growing rapidly."
"Starting to respond"? Google and Facebook already have annual turnovers measured in the tens of billions of dollars.

"Not very well informed"? What do these people think Google and Facebook are and always have been if not very well informed data brokers?
There are still many unknowns about the personal data market and how it will operate, including business models, issues of trust, and what new technologies are starting to enable around security, privacy, data extraction and analysis.
Unknown to whom? Everyone else seems to know that the market is already operating. There are over a million apps already available on Google Play, for example.
In a separate interview at the same event, Professor Sir Nigel Shadbolt, Chairman of the government’s Midata initiative set up to increase consumers’ access to their own data, said that the personal information economy was a "booming, burgeoning area", that was already subject to "a bit of a landgrab".
Google has detailed records of the preferences of everyone who uses the web. Facebook has more regular monthly users than the population of most countries. Amazon operates the biggest cloud services business in the world. The banks – necessarily – record our every financial transaction. The mobile phone network operators – necessarily – continuously record our location, accurate to the nearest few metres, wherever we are in the world. Not just our location, but who we call and who calls us. "The entire NHS hospital patient database for England was handed over to management consultants who uploaded it to Google servers based outside the UK". HSCIC want to do the same with our GP health records. "A bit of a landgrab"?

Ctrl-Shift, the organisers of PIE2014, have "Storified" the seminar, please see Seizing the opportunity: the next 18 months. In what way are they going to seize this decades-old opportunity over the next 18 months?


No doubt Sir Martin Sorrell's people will be happy to come up with another name for Mr Auwera.

Professor Sir Nigel himself is supposed to have said "Everybody is going to be a sensor" at PIE2014, and "Any friction is an impediment; additional steps destroy uptake". Once you're in this childish milieu it's probably hard to resist joining in, the frivolity is catching ...

.. but he's not naïve or commercially unaware and he must somehow make people realise that the personal information economy is not some new hippy commune in which people can witter on about "uncanny valleys" and "trust serums". It's a mature and rich market with political power, a market in which people are bartering their personal data for "free" web-based services.

The pretence is that these services "empower" us in some hippy sense of the word. Once all our data has been sucked up into the cloud, once we are all utterly dependent on these services, let's see just how long they continue to be offered free at the point of delivery and how long it takes for the new empowerment to turn into a more traditional subjection.

We have already got to the point where the Pied Pipers can ring up the President of the United States of America to tell him to get out of the way, please see Mark Zuckerberg tells Barack Obama he is 'frustrated' over US government surveillance. And the President accepts the call.

Professor Sir Nigel's colleague at Southampton University and at the Open Data Institute, Professor Sir Tim Berners-Lee, seems to be a certified member of the commune:
Armed with the information that social networks and other web giants hold about us, he said, computers will be able to "help me run my life, to guess what I need next, to guess what I should read in the morning, because it will know not only what's happening out there but also what I've read already, and also what my mood is, and who I'm meeting later on
There doesn't seem to be anyone else. Unless he really does want people to become no more than sensors, feeding data back to the Google brain, it's up to Professor Sir Nigel to forswear meretricious phrase-turning and to devise a serious response.

----------

Updated 29.4.18

There we were four years ago saying that a credit referencing agency can analyse and sell its "data to political parties, seeking to identify floating voters and persuade them to come down on their side of the party fence".

No-one turned a hair.

It was entirely uncontroversial ...

... until it was suggested that Donald Trump won the US presidential election thanks to Cambridge Analytica and that Leave won the Brexit referendum thanks to ditto.

Why the change?

It doesn't matter.

What matters is that now at last people are paying serious attention to their personal information. Cambridge Analytica and Facebook are in the dock for collecting our personal information and making money out of it. So are Google. Others will join them.

Can we add Experian to the list?


And Equifax? They lost the personal information of 145 million people.

And Callcredit:


All three companies – Experian, Equifax and Callcredit – either supply information to the Government Digital Service's GOV.UK Verify (RIP) "identity providers" or they actually are "identity providers".

Would you say "I don't mind Cambridge Analytica having my personal information"? You may well be perfectly happy with that ...

... but if not, why is it more acceptable for Experian to have your personal information, or Equifax or Callcredit?


Updated 13.8.18

Time was when we all knew that the key to winning general elections was social media. Both of the main UK political parties tried. Their supporters wished them well. "May the best man win", as we used to say. No more – Emma's Diary fined £140k for flogging data on over a million new mums to Labour Party:
Data-brokering biz Lifecycle Marketing (Mother & Baby) has been fined £140,000 by the Information Commissioner's Office (ICO) for illegally collating and flogging personal information of more than a million people.

The Buckinghamshire-based business, also known as Emma's Diary, issues advice on pregnancy and childcare. It sold the information to Experian Marketing Services, specifically for use by the Labour Party.
A loss of innocence?

No.

A return to adulthood.

Time for someone to take the personal information economy seriously

1938 Sears Spring/Summer Catalog
"The roots of mail order date back to the middle ages. In 1498, Aldus Manutius of Venice, a publisher, brought out a catalog of 15 texts which he had published, which were precursors of the paperback books of today" – so says Bonnie Unsworth in her A Brief History of Mail Order Catalogs.

Rather more recently, "the real beginning of mail order was the result of the experiences of a traveling salesman in the mid west, named Montgomery Ward. He published a catalog sheet that listed 163 items right after the Civil War. Within two years, the catalog grew to 8 pages, and then to 72 pages. By 1884, the catalog contained 240 pages with thousands of items, almost everyone of which was illustrated with a woodcut".

While they had Montgomery Ward and Sears Roebuck in the US, here in the UK we had Great Universal Stores, always known affectionately as "GUS".

Mail order was big business and the philanthropic Sir Isaac Wolfson amassed a fortune at GUS. The Wolfson Foundation has awarded charitable grants worth over £1 billion since 1955.

Not just big business, mail order was a credit business. There was no point Mr Ward repeatedly sending the products they had ordered to people who didn't subsequently pay for them. Ditto Sir Isaac. They needed to know before despatch that a given customer wasn't too likely not to pay.

The Manchester Guardian Society was established as a credit rating agency in 1826 in the UK. 1897 saw the formation of the Merchants' Credit Association in the US. The Ramo-Wooldridge Corporation and Thompson Products merged to form TRW in the 1960s. TRW's leading light, Simon Ramo, predicted the cashless society as early as 1961 – enter the credit card. GUS created Commercial Credit Nottingham in 1980, injected TRW into it in 1996 and the whole lot became Experian.

Wednesday, 26 March 2014

The magic of modern public administration

Here's a new TLA for you (three-letter acronym) – "VRA".

"VRA" is voice risk analysis. VRA software listens in on phone calls and tells you whether someone is lying.

If you'll believe that, you'll believe anything.

As the Guardian tell us:
Voice risk analysis has been mired in controversy since scientists raised doubts over the technology soon after it reached the market. In 2007 two Swedish researchers, Anders Eriksson and Francisco Lacerda, published their own analysis of VRA in the International Journal of Speech, Language and Law. They found no scientific evidence to support claims for the device made by the manufacturer.

Lacerda, head of linguistics at Stockholm University, told the Guardian that VRA "does nothing. That is the short answer. There's no scientific basis for this method. From the output it generates this analysis is closer to astrology than science. There was very good work done by the DWP [the Department for Work and Pensions] in the UK showing it did not work ...".
So what?

Here in the UK you get a 25 percent discount on your Council Tax if you live on your own. Some people lie. DWP don't think VRA will identify them. Neither do Messrs Eriksson and Lacerda. Nor, it can safely be asserted, do DMossEsq's millions of readers.

But according to the Guardian article at least 24 local authorities in the UK do believe in magic. Redcar, for example, Middlesbrough, West Dorset and Wycombe among them. "South Oxfordshire ... says that [their VRA] system helped reduce the number of people claiming the single person discount by 3% ...".

Their system is supplied by one of the UK's big government contractors, Capita, who say that: "The technology was never used in isolation. It is only used in cases which are deemed 'high risk', when earlier stages of the review have indicated that more than one person may be living at the property".

The Local Government Association say that: "No one is going to be prosecuted for benefit fraud on the result of voice analysis tests alone".

If VRA doesn't identify suspected fraudsters in the first place and it doesn't provide sufficient evidence to prosecute them, then its contribution to South Oxfordshire's 3 percent reduction is, as Lacerda says, to use the technical term, "nothing". Or as False Economy, a trade union-funded campaign group, put it: "Capita is a firm with a long rap sheet of expensive failure. Neither they nor their technological snake oil should be trusted".

"Astrology"? "Snake oil"? Remind you of anything? The belief in the efficacy of biometrics is akin to the belief in astrologyPublic administration and the McCormick spectrum?

Mass consumer biometrics is a stage prop in the security theatre that the authorities produce and VRA performs, by analogy, in anti-fraud theatre. It may look modern. Technology may impress some people. The authorities may seem to be "doing something". But they're not. Apart from wasting our money.

----------

Updated 1.4.14
Truth or lie - trust your instinct, says research

We are better at identifying liars when we rely on initial responses rather than thinking about it, say psychologists.

Generally we are poor at spotting liars - managing only slightly better than flipping a coin.

But our success rate rises when we harness the unconscious mind, according to a report in Psychological Science ...

The magic of modern public administration

Here's a new TLA for you (three-letter acronym) – "VRA".

"VRA" is voice risk analysis. VRA software listens in on phone calls and tells you whether someone is lying.

If you'll believe that, you'll believe anything.

As the Guardian tell us:
Voice risk analysis has been mired in controversy since scientists raised doubts over the technology soon after it reached the market. In 2007 two Swedish researchers, Anders Eriksson and Francisco Lacerda, published their own analysis of VRA in the International Journal of Speech, Language and Law. They found no scientific evidence to support claims for the device made by the manufacturer.

Lacerda, head of linguistics at Stockholm University, told the Guardian that VRA "does nothing. That is the short answer. There's no scientific basis for this method. From the output it generates this analysis is closer to astrology than science. There was very good work done by the DWP [the Department for Work and Pensions] in the UK showing it did not work ...".
So what?

Monday, 24 March 2014

RIP IDA – April is the cruellest month

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Anyone remember this?
Press release
Providers announced for online identity scheme

13 November 2012

Successful providers chosen to design and deliver a secure online identity registration service.

The Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex, and Verizon are the successful providers chosen to design and deliver a secure online identity registration service for the Department for Work and Pensions.

The identity registration service will enable benefit claimants to choose who will validate their identity by automatically checking their authenticity with the provider before processing online benefit claims ...

Notes to Editors:
...

2. In May 2012 DWP issued an invitation to tender to 44 suppliers.

3. The value of the 18-month framework contracts is £25m.

4. The Identity Assurance programme is a Government-wide initiative led by the Cabinet Office which will in time be available to all UK citizens who need to access online public services.

...

6. Universal Credit, which will go live nationally in October 2013, replaces the current complicated paper based benefits payment system we have now with a new online application that meets the needs of claimants and employers in today’s digital world.

7. One further provider is expected to sign up in the next few weeks - completing the eight chosen to design and deliver a secure online IDA service for Universal Credit.
Once upon a time there were seven "identity providers" – the Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex, and Verizon. Then there were eight – as per note 7, PayPal signed up later. Then there were five – Cassidian, Ingeus and PayPal pulled out. 39 of the original 44 (note 2) aspitants are gone.

Universal Credit did not go live in October 2013 (note 6). To date, no benefit claimants can choose an "identity provider" to verify their identity and there are no online benefit claims services. No sign of it so far, how long before the Cabinet Office provide identity assurance across all Government departments to all UK citizens (note 4)? They haven't said.

As Whitehall press releases go, Providers announced for online identity scheme must count as one of the most misleading ever. Is there an appropriate award? The Nostradamus Trophy?

There can't be much of that £25 million left 17 months later and there's only a month to go before the contracts come up for renewal (note 3).

With their exclusivity period at an end, will the surviving five "identity providers" face competition from Google? Or Facebook?

Not with only £25 million on the table, they won't. Will that become £250 million for the next 18 months? Or will the government stop paying the "identity providers" and leave us to pay for our dematerialised ID cards ourselves?

Will the surviving five renew their contracts? Or will they prudently cut their losses and depart the field with their reputations relatively intact?

In which case, what will the UK's political parties fill up their May 2015 manifestos with under the heading of "modernisation"?

RIP IDA – April is the cruellest month

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Anyone remember this?
Press release
Providers announced for online identity scheme

13 November 2012

Successful providers chosen to design and deliver a secure online identity registration service.

The Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex, and Verizon are the successful providers chosen to design and deliver a secure online identity registration service for the Department for Work and Pensions.

The identity registration service will enable benefit claimants to choose who will validate their identity by automatically checking their authenticity with the provider before processing online benefit claims ...

Notes to Editors:
...

2. In May 2012 DWP issued an invitation to tender to 44 suppliers.

3. The value of the 18-month framework contracts is £25m.

4. The Identity Assurance programme is a Government-wide initiative led by the Cabinet Office which will in time be available to all UK citizens who need to access online public services.

...

6. Universal Credit, which will go live nationally in October 2013, replaces the current complicated paper based benefits payment system we have now with a new online application that meets the needs of claimants and employers in today’s digital world.

7. One further provider is expected to sign up in the next few weeks - completing the eight chosen to design and deliver a secure online IDA service for Universal Credit.
Once upon a time there were seven "identity providers" – the Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex, and Verizon. Then there were eight – as per note 7, PayPal signed up later. Then there were five – Cassidian, Ingeus and PayPal pulled out. 39 of the original 44 (note 2) aspitants are gone.

Universal Credit did not go live in October 2013 (note 6). To date, no benefit claimants can choose an "identity provider" to verify their identity and there are no online benefit claims services. No sign of it so far, how long before the Cabinet Office provide identity assurance across all Government departments to all UK citizens (note 4)? They haven't said.