JFDI, Agile People

The Government Digital Service (GDS) has everything. Bunting and mascots. Cake and stickers (27'00"-27'20").

Everything except a corporate song.

Until now, when – thanks to the inspiration of Francis Maude's speech at Sprint 14 – that lacuna can at last be filled.

The lyrics below are now ready for beta release. An instance of song as a service (SaaS), it is based on a disco classic of 1978 which sold over 10 million copies when the world still had singles and, who knows, after a few more iterations, perhaps if GDS can sing it with enough gusto and enough pure mindless disco-style enjoyment, maybe they can add the equivalent iAccolade to their already groaning shelvesful of awards:

YMCA (© Victor Willis) Village People

JFDI Agile People

Young man, there's no need to feel down. I said, young man, pick yourself off the ground. I said, young man, 'cause you're in a new town There's no need to be unhappy. Young man, there's a place you can go. I said, young man, when you're short on your dough. You can stay there, and I'm sure you will find Many ways to have a good time. It's fun to stay at the y-m-c-a. It's fun to stay at the y-m-c-a. They have everything for you men to enjoy, You can hang out with all the boys ... It's fun to stay at the y-m-c-a. It's fun to stay at the y-m-c-a. You can get yourself cleaned, you can have a good meal, You can do whatever you feel ... Young man, are you listening to me? I said, young man, what do you want to be? I said, young man, you can make real your dreams. But you got to know this one thing! No man does it all by himself. I said, young man, put your pride on the shelf, And just go there, to the y.m.c.a. I'm sure they can help you today. It's fun to stay at the y-m-c-a. It's fun to stay at the y-m-c-a. They have everything for you men to enjoy, You can hang out with all the boys ... It's fun to stay at the y-m-c-a. It's fun to stay at the y-m-c-a. You can get yourself cleaned, you can have a good meal, You can do whatever you feel ... Young man, I was once in your shoes. I said, I was down and out with the blues. I felt no man cared if I were alive. I felt the whole world was so tight ... That's when someone came up to me, And said, young man, take a walk up the street. There's a place there called the y.m.c.a. They can start you back on your way. It's fun to stay at the y-m-c-a. It's fun to stay at the y-m-c-a. They have everything for you men to enjoy, You can hang out with all the boys ... Y-m-c-a ... you'll find it at the y-m-c-a. Young man, young man, there's no need to feel down. Young man, young man, get yourself off the ground. Y-m-c-a ... you'll find it at the y-m-c-a. Young man, young man, there's no need to feel down. Young man, young man, get yourself off the ground. Y-m-c-a ... just go to the y-m-c-a. Young man, young man, are you listening to me? Young man, young man, what do you wanna be?

Stand up, there's no need to sit down. We say, stand up, get ourselves to the wall. We say, stand up, 'cause we're in a new world There's no need to have a meeting. Users, they all have their own needs. We say, users, time for discovery. We can alpha, even beta test too And then go live within budget. It's fun to iterate j-f-d-i. It's fun to iterate j-f-d-i. We have everything, twenty-five exemplars, We can cut code, we’re the world’s best ... It's fun to iterate j-f-d-i. It's fun to iterate j-f-d-i. We can transform the world, make it transition now, Without fail deliver the goods ... Pivot, revolution is here We say, pivot, paradigm shift has come We say, pivot, Whitehall stand on your head. All because of Martha Lane Fox All code has to be open source We use github, post-it notes and short sprints And then dashboards, from our wow factory There’s just nothing that can stop us It's fun to iterate j-f-d-i. It's fun to iterate j-f-d-i. We have everything, twenty-five exemplars, We can cut code, we’re the world’s best ... It's fun to iterate j-f-d-i. It's fun to iterate j-f-d-i. We can transform the world, make it transition now, Without fail deliver the goods ...  G-Cloud, data under control. IDAP surely, no-one doubts that it works. We can route round any problems we find Security convenience ... We have bunting, and cake on Fridays, We have mascots, stickers we had designed, We use Apple so we always have fun We’re all digital by default. It's fun to iterate j-f-d-i. It's fun to iterate j-f-d-i. We have everything, twenty-five exemplars, We can cut code, we’re the world’s best ... J-F-D-I ... just iterate it j-f-d-i. Shout out, shout out, there's no need to write apps. Stand up, stand up, with your mobile device. J-f-d-i ... just iterate it j-f-d-i. Shout out, shout out, there's no need to write apps. Stand up, stand up, with your mobile device. J-f-d-i ... just iterate j-f-d-i. Recast, recast, for the coming new world Whitehall, Whitehall, what do you wanna be?

JFDI, Agile People

The Government Digital Service (GDS) has everything. Bunting and mascots. Cake and stickers (27'00"-27'20").

Everything except a corporate song.

Until now, when – thanks to the inspiration of Francis Maude's speech at Sprint 14 – that lacuna can at last be filled.

The lyrics below are now ready for beta release. An instance of song as a service (SaaS), it is based on a disco classic of 1978 which sold over 10 million copies when the world still had singles and, who knows, after a few more iterations, perhaps if GDS can sing it with enough gusto and enough pure mindless disco-style enjoyment, maybe they can add the equivalent iAccolade to their already groaning shelvesful of awards:

Francis Maude: "We’re the JFDI school of government"

Last week saw a major congregation of central government computer persons at the London Film Museum.

Computing isn't that exciting. There's not a lot of news. You'd expect this event – Sprint 14 – to have been covered by all the computer media.

It wasn't.

You can read Government showcases digital exemplars at Sprint 14 or Government showcases digital services at Sprint 14 or Government unveils online voter registration system or Government websites on rise again despite cull, and that's about it.

Odd.

You wouldn't expect the generalist media to cover the event, of course, but that's odd, too – because Sprint 14 was more political than you might expect.

Rt Hon Francis Maude MP, Cabinet Office minister, was there and gave a speech.

Sir Jeremy Heywood, the Cabinet Secretary, was there. He didn't speak but Treasury minister David Gauke did, as did Greg Clark, minister for Cities and the Constitution, Mike Parsons, chief operating officer at the Home Office, Oliver Morley, chief executive of the Driver and Vehicle Licensing Agency and Jeremy Wright, minister for prisons and rehabilitation.

And Martha-now-Lady Lane Fox was there, which usually guarantees several column inches, but no – nothing in the Times, the Telegraph or the Guardian.

Mr Maude assured the audience that "SMEs are engines of growth in our economy" and promised that government would spend more and more money with small and medium-sized enterprises, rather than giving it to the oligopoly of big IT suppliers. The oligopoly, that is, who keep wasting billions of pounds of public money – your money and mine – on failed IT projects. "This is a massive vote of confidence in the role [the SMEs] are playing to help Britain compete and win in the global race", he said.

That was after he'd already said that "digital is one of the major contributions to reducing the deficit and encouraging growth in the British economy ... As the Chancellor highlighted recently, every part of the public sector will continue to need to face up to the challenge of reduced budgets for some time to come ... And we know much more money can be saved – staggering savings potentially – while actually improving quality online".

Which, in turn, came after this hostage to fortune: "We’re changing things by doing them, not by talking about them. We’re the JFDI school of government".

It was 29 October 2013 when Public Servant of the Year ex-Guardian man Mike Bracken CBE published GDS goes to Cabinet. He is the executive director of the Government Digital Service (GDS), part of the Cabinet Office, championed by Mr Maude, and he was allowed to make a presentation to the full Cabinet.

That doesn't normally happen and DMossEsq raised the question at the time whether the government are considering making the alleged successes of GDS a plank of their election strategy. Now, with Sprint 14, the question arises again.

Let's hope for their sake that they don't try it. By the time of the next general election, May 2015, there will be five years of National Audit Office reports providing ammunition for the opposition to shoot down the claim that this government succeeds with IT where others fail.

We have recently had the example of the Ministry of Defence recruitment system and Capita's failure to get it right. There will be the on-going tragedy of the Department for Work and Pensions Universal Credit system. And by May 2015, who knows what else.

The government are unlikely to be able to make themselves heard, against the gales of laughter and scorn, if they try to make the point that those failures are failures of the oligopoly whereas the government successes are successes of GDS. But if they do manage to present their case, the laughter and the scorn will just start all over again – what are the successes of GDS?

So far, none.

Lots of big promises. Nothing big delivered.

Mr Maude and the government are making a politically fatal mistake if they believe GDS's over-enthusiastic salesmanship.

GDS are in no position to take on the oligopoly. They have no experience of analysing, designing, implementing, deploying and supporting large-scale government IT systems. The cocky profanity* of "we’re the JFDI school of government" is ridiculous.

If the government picks a serious fight with the oligopoly without having an alternative to replace them, the machinery of Whitehall will stop.

That's a tremendous platform if you're standing for election in the anarchists interest. But Mr Maude, presumably, isn't.

You can just about see how the computer press might fail to report that point. But RTFM** – the generalist media should have spotted it.

----------

* JFDI = just fucking do it
** read the fucking manual

Francis Maude: "We’re the JFDI school of government"

Last week saw a major congregation of central government computer persons at the London Film Museum.

Computing isn't that exciting. There's not a lot of news. You'd expect this event – Sprint 14 – to have been covered by all the computer media.

It wasn't.

You can read Government showcases digital exemplars at Sprint 14 or Government showcases digital services at Sprint 14 or Government unveils online voter registration system or Government websites on rise again despite cull, and that's about it.

Odd.

RIP IDA – Strange Life of Ida

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

In his serious youth DMossEsq read Strange Life of Ivan Osokin: A Novel by PD Ouspensky. Chapter 1 opens with:

ON THE SCREEN a scene at Kursk station in Moscow. A bright April day of 1902. A group of friends, who came to see Zinaida Krutitsky and her mother off to the Crimea, stand on the platform by the sleeping-car. Among them Ivan Osokin, a young man about twenty­-six ...

Chapter 26, The Turn of the Wheel, opens with:.

ON THE SCREEN a scene at Kursk Station in Moscow. A bright April day of 1902. A group of friends who came to see Zinaida Krutitsky and her mother off to the Crimea stand by the sleeping car. Among them is Osokin ...

You get the idea. There's no need to read the intervening chapters. The wheel keeps turning. It's one of hundreds of drearily portentous novels ideal for a certain sort of moody and ignorant teenager. The last words are, predictably:

Osokin looks round, and suddenly an extraordinarily vivid sensation sweeps over him that, if he were not there, everything would be exactly the same.

Profoundly ignorant of course, but not moody enough, DMossEsq had forgotten all about the ghastly Ivan until yesterday, and the publication on the Government Digital Service blog of What is identity assurance? by Janet Hughes.

Here we go again:

Identity assurance is a new service that will give people a secure and convenient way to sign in to government services.

Secure?

Convenient?

The wheel will turn. We know that. Please see Identity assurance. Only the future is certain – doom 1. RIP IDA.

----------

Updated 16:00

PD Ouspensky writes:

Trans:

On her Twitter account Janet Hughes is shown eating a takeaway at what looks like a station.

But which station?

Surely ... no ... it can’t be ... Kursk?

----------

Updated 25.1.14:
"Identity assurance is a new service that will give people a secure and convenient way to sign in to government services", say GDS. Anyone clicking on the link provided by DMossEsq on the word "secure" is taken to his post Hyperinflation hits the unicorn market, which casts doubt on GDS's or anyone else's ability to offer security on the web. It's an attractive object, security, but like unicorns it doesn't exist.

People are well-advised to regard promises of on-line security with scepticism – "We live on a diet of data hacking stories fed to us by the media. Have done for years", says the unicorn post. And anyone clicking on that link is meant to be taken to DMossEsq's list of hacking stories. That list is maintained on http://DematerialisedID.com, an old website of his which, on Thursday, was obliterated by some eHooligan.

It's annoying but in a small way it does sort of make the point, doesn't it? Security?

DMossEsq and his ISP are currently working to resume normal service. In the meantime the list of hacking stories has been moved to here.

Take a look at some of the hacking stories there. Or here. Or take a look at the Home Office's latest attempt to warn people about on-line security. Then ask yourself, how confident are you that GDS can offer security for your personal data stored in their identity assurance system. You be the judge. No-one else will.

Updated 28.1.14:
What is identity assurance? offered "a new service that will give people a secure and convenient way to sign in to government services". Can GDS deliver on that offer?

The question is taken up in a new post today, Security and convenience: Meeting user needs. Security is a user need and "if we don’t fulfil this need, digital services won’t be trustworthy or trusted, so people won’t want to use them". Yes. Obviously.

GDS are due to start testing IDA in the next few weeks with a view to having some services live by the end of the summer with hundreds of thousands of members of the public using them, if not millions. There's not long to go. What are GDS doing about this user need?

Their answer is "we’re trying to stimulate a competitive market for identity assurance as the quickest and most effective way to close the gap between solutions that are convenient and those that provide security ... We expect to see new methods emerge that are more convenient for end users but satisfy the required standards".

IDA goes back to a meeting held on 20 September 2010 if not earlier. Three-and-a-bit years later and they're still "expecting" to see a number of solutions "emerge"? That's the GDS approach to public services?

Good luck with that.

RIP IDA – Strange Life of Ida

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

In his serious youth DMossEsq read Strange Life of Ivan Osokin: A Novel by PD Ouspensky. Chapter 1 opens with:

ON THE SCREEN a scene at Kursk station in Moscow. A bright April day of 1902. A group of friends, who came to see Zinaida Krutitsky and her mother off to the Crimea, stand on the platform by the sleeping-car. Among them Ivan Osokin, a young man about twenty­-six ...

Chapter 26, The Turn of the Wheel, opens with:.

ON THE SCREEN a scene at Kursk Station in Moscow. A bright April day of 1902. A group of friends who came to see Zinaida Krutitsky and her mother off to the Crimea stand by the sleeping car. Among them is Osokin ...

You get the idea. There's no need to read the intervening chapters. The wheel keeps turning. It's one of hundreds of drearily portentous novels ideal for a certain sort of moody and ignorant teenager. The last words are, predictably:

Osokin looks round, and suddenly an extraordinarily vivid sensation sweeps over him that, if he were not there, everything would be exactly the same.

Profoundly ignorant of course, but not moody enough, DMossEsq had forgotten all about the ghastly Ivan until yesterday, and the publication on the Government Digital Service blog of What is identity assurance? by Janet Hughes.

Here we go again:

GreenInk 10: Private Eye Crook of the Year 2014 awards

(Hat tip: No2ID)

Sadly, there seems to have been no space in the latest edition of Private Eye for the following letter:

From: David Moss Sent: 10 January 2014 14:05 To: Letters to the editor Subject: The Gnome Business Awards for 2013, p.32, Eye #1357 Sir Gnome awards Crook of the Year 2013 to James McCormick. He bought novelty golf ball-finders and sold them as explosives detectors to governments whose gullibility or corruption must also be award-winning. When it comes to the 2014 awards, perhaps Gnome's panel would like to consider the McCormicks selling mass consumer biometrics technology which is meant to identify us uniquely and verify our identity. Three world-class experts reviewed the literature and determined that biometrics is "out of statistical control". I.e. it's not a science [1]. By way of a practical example, they cite the charade at the US National Institute of Standards and Technology (NIST). Under the terms of the USA PATRIOT Act 2001 section 403(c)(1), NIST have to certify all biometrics systems before they are deployed to federal law-enforcement agencies. What the scientists at NIST say in their certificates is: "This evaluation does not certify that any of the systems tested meet the requirements of any specific government application". By issuing certificates, NIST abide by the Act even if the certificates say that they haven't got a clue whether the biometrics systems work. It's not just the USA. The panel will be spoilt for choice [2]. Governments all over the world are handing over public money to McCormicks talking biometricsballs. Yours David Moss 1. http://biometrics.nist.gov/cs_links/ibpc2010/pdfs/FundamentalIssues_Final.pdf 2. http://www.planetbiometrics.com/

If only they had seen ENISA's latest report.

ENISA is the European Union Agency for Network and Information Security and in eID Authentication methods in e-Finance and e-Payment services they say:

6.1 Biometrics adoption related risks The results of the survey show that very few professionals incorporate biometrics as an eIDA method solution for e-banking. The rationale behind this phenomenon is that institutions must be able to comply with the GDPR. There exist legal issues when dealing with personal information (different legislation for every country). In Europe, a specific authorization from customers is required, which is a difficult task, since the majority of people do not feel comfortable with granting permission on the storage of their biometric information (i.e. personal body patterns). This, in general, is only manageable if a strong juridical base exists and the use is adequate, relevant and not abusive in correspondence with the goals and reasons for biometric data to be collected, used or saved, resulting in an important challenge to be addressed. Moreover, there exist high associated risks, mainly due to the potential attacks to a centralised data base storage of biometrics parameters. The risk of compromise of the biometric information DB (even if it’s encrypted, hashed, etc.) is real and non-acceptable for CISOs and directors of the e-banking sector. The sensitive nature of biometric information: data is compromised forever (i.e. it’s not possible to change the hand print, Iris, fingerprints, etc.), resulting in both high risk, and great responsibility to be accepted, especially if other eIDA methods are suitable. Another important factor is the usability, since current technologies do not provide 100% of accuracy at the first try. There are still open issues related to the False Rejection Rate (FRR) and the False Acceptance Rate (FAR), which remain open even in scientific experiments or proof of concepts. In summary, because of the associated risks, the financial sector is still not prepared to use biometry neither as a unique authentication factor nor a second authentication factor. Biometry is used in emerging countries, where there are no other means of unique identification of the persons, due to lack of governmentally supported credentials, and also in countries where Personal Data protection is not a priority, like it is in EU. Specialists are working in finding a solution to the high risk associated to using the biometry, and one solution that is being analysed and starting to be implemented is the local storage of biometric identification profiles. This has three advantages: 1) the responsibility of the storage is transferred to the end user, 2) the chances of a successful threat to steal large amount of biometric information is low, because the threat should be successful on many devices and stores, 3) the biometric identification vector doesn’t have to travel over the network.

If the banks don't think that today's mass consumer biometrics are up to the job, why do governments waste our money on this magical non-technology?

GreenInk 10: Private Eye Crook of the Year 2014 awards

(Hat tip: No2ID)

Sadly, there seems to have been no space in the latest edition of Private Eye for the following letter:

From: David Moss Sent: 10 January 2014 14:05 To: Letters to the editor Subject: The Gnome Business Awards for 2013, p.32, Eye #1357 Sir Gnome awards Crook of the Year 2013 to James McCormick. He bought novelty golf ball-finders and sold them as explosives detectors to governments whose gullibility or corruption must also be award-winning. When it comes to the 2014 awards, perhaps Gnome's panel would like to consider the McCormicks selling mass consumer biometrics technology which is meant to identify us uniquely and verify our identity. Three world-class experts reviewed the literature and determined that biometrics is "out of statistical control". I.e. it's not a science [1]. By way of a practical example, they cite the charade at the US National Institute of Standards and Technology (NIST). Under the terms of the USA PATRIOT Act 2001 section 403(c)(1), NIST have to certify all biometrics systems before they are deployed to federal law-enforcement agencies. What the scientists at NIST say in their certificates is: "This evaluation does not certify that any of the systems tested meet the requirements of any specific government application". By issuing certificates, NIST abide by the Act even if the certificates say that they haven't got a clue whether the biometrics systems work. It's not just the USA. The panel will be spoilt for choice [2]. Governments all over the world are handing over public money to McCormicks talking biometricsballs. Yours David Moss 1. http://biometrics.nist.gov/cs_links/ibpc2010/pdfs/FundamentalIssues_Final.pdf 2. http://www.planetbiometrics.com/

If only they had seen ENISA's latest report.

RIP IDA – Obama fails to consult Maude

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Last week, the US Identity Ecosystem Steering Group (IDESG) held a three-day conference, 14-16 January 2014 at the Georgia Tech Research Institute. It's all very international and there was a one-hour slot on the Wednesday for An Overview of 2014 Plans for the UK Identity Assurance Program. The talk was given by David Rennie of the Government Digital Service (GDS). The sound recording below is for any Brits who might also be interested in our government's plans for us:



The subject matter is identity assurance (IDA), not everyone's cup of tea, and you don't have to listen to all 55'44". There is a summary appended below.

But you might consider sampling odd snatches. Between 21'10" and 21'35", for example, Mr Rennie states that GDS are working with OIX, the Open Identity Exchange, to draft the rules for the trust framework within which the UK's "identity providers" (IDPs) will have to work.

We hoi polloi need to know that we can trust the IDPs. Otherwise we would be imprudent to use them in our on-line dealings with government. And if we don't, then GDS's digital-by-default initiative is a dead duck (RIP).

Steve Wreyford, Mr Rennie's colleague at GDS, told us about this on 15 April 2013, please see his amusing blog post Delivering Identity Assurance: You must be certified where we are advised to trust IDPs only if they have been certified trustworthy by tScheme.

The millions of readers of the DMossEsq blog are already up to speed on this one but not necessarily so the IDESG conference. How are they supposed to know about tScheme?

So DMossEsq submitted an on-line question to the conference and you can hear the result in the 43 seconds between 29'48" and 30'31". Mr Rennie tells the conference that:

"All the identity providers will have to be certified by tScheme before we go to full live. They're all going through the certification process at the moment.

There are five UK IDPs. Digidentity, Experian, Mydex, the Post Office and Verizon. You can check on the tScheme website – Experian is the only IDP currently certified and Verizon is the only one that has applied for certification.

So is Mr Rennie right when he says that all the IDPs are "going through the certification process at the moment"? There is some doubt there. It looks as though three of them haven't even applied for certification yet.

It must all be getting a bit tense. GDS want to start Beta-testing IDA behind closed doors "in the next few weeks" (9'00") with a view to going live "at the end of the summer":

• What happens if the certification process hasn't finished by that time?
• Suppose that one or more of the IDPs fail their certification. What happens then?
• What's the point of doing IDA tests with IDPs who might fail to get their tScheme certification?
• Wouldn't it be better for them to be certified before the tests start?
• Better still if they were certified before they were appointed as IDPs in the first place.
• Eight IDPs had been appointed by 16 January 2013. What happened to the other three (Cassidian, Ingeus and PayPal)? Why did they pull out of IDA?
• What have Digidentity, Mydex and the Post Office been doing all year? Why haven't they even applied to tScheme yet?
• And are there really five IDPs left or only two?

That last is a question raised by Charlotte Jee's article Beta launch for identity assurance this year on the government computing news website – "an official from the IDA programme ... explained that the first two identity providers will start supporting the scheme from the end of November ...".

Her article was published on 22 October 2013, when November 2013 was still in the future and it made sense to have two IDPs supporting IDA. In the event, there was no IDA to support in November. Or December. What happened? Why were the tests postponed to January or February 2014? Have three more IDPs pulled out? Which three? Why?

We don't know. There has been no explanation. Attendees at Code for America's CfA Summit 2013 conference are going to be pretty surprised. Ex-Guardian man Mike Bracken CBE, the executive director of GDS, told them on 16 October 2013 that "the first [IDA] services run out with our tax system this month". He also told them that "we have about eight or nine companies already providing identity to us". Take your pick – 2, 5, 8, 9, ...

There is a danger here that the Americans are being misled by GDS. The British public, too – we could be being misled.

But that's not all. It seems possible that GDS are misleading themselves. They have two IDA tests coming up in the next few weeks and at 15'25" Mr Rennie calls that having IDA "up and running" and says that GDS have achieved "real live delivery". Only for very low values of "up", "running", "real", "live" and "delivery".

Is misleading themselves becoming endemic?

That seems unfortunately to be entirely possible. Unfortunately, because GDS are in the trust framework as well, not just the IDPs and the public.

The earlier IDA test with Warwickshire County Council which Mr Rennie referred to at 18'05" was reviewed by OIX and was severely criticised. Words like "significant barrier", for example, and "shortcomings" were used. "Considerably more thought needs to be applied", the OIX report said and carried on with "convoluted process", "reluctant", "struggled", "not clear" and "annoying".

And how does Mr Rennie describe the same IDA test? He says it showed that "identity assurance will support the move to digital by default, simplify and improve the customer experience and make service providers more efficient.  In short, a virtuous circle of reduced effort, reduced cost and improved customer satisfaction".

And then a kind correspondent sent a link to an extraordinary article in the Huffington Post. Like ex-Guardian man Mike Bracken CBE telling CfA last October to be more like GDS if they want to get on in this world, his political boss Francis Maude has some diplomatic advice for Obama himself:

Cabinet Office Minister Francis Maude Decries 'Old Style' Obamacare Insurance Website The Huffington Post UK | By Paul Vale Posted: 09/01/2014 02:43 GMT | Updated: 09/01/2014 03:47 GMT Speaking on Wednesday, the Cabinet Office minister said that the American government should have learned from the British approach to providing online access to public services, and in particular the success of the UK government's digital programme, including the gov.uk site ... The minister added that his department had not been consulted by the Obama administration but suggested that they "probably should" get in touch due to the global interest in the British government's IT roll-out ... "This is something that is a problem for countries that do not have an ID card system and a national ID database," he said. "So it is an issue for countries like ourselves and the UK. The US is going down the same path as we are, but they are some distance behind."

----------

Summary of the points made in David Rennie's talk to IDESG
and of the subsequent question and answer session:

David Rennie's talk
"In the next few weeks", two applications will be used to test IDA. Initially, the tests will be "private Betas" (9'00"), the Betas will go public some time in the summer of 2014 (10'25"), the services will go live at the end of the summer and in the next 12 months or so GDS expect IDA to have about 600,000 people on it.

Application #1 will be an on-line record of people's driving licence endorsements (11'40"), with the data available to DVLA, drivers and insurance companies. Application #2 will be a facility for people to amend their tax code (12'40"), with the data available to HMRC and taxpayers.

In the terminology of IDA, DVLA and HMRC are so-called "relying parties" (RPs). They rely on the so-called "identity providers" (IDPs) -- the Post Office, Digidentity, Experian, Mydex, and Verizon -- to assert that you are the driver or taxpayer that you say you are. There are different Levels of Assurance (LoAs), some services will require a high level (4) and others can get by with a lower one (1). The RPs, IDPs, drivers, insurance companies and taxpayers are all linked by GDS's so-called "ID hub" in the confines of a national "trust framework".

GDS hope that, a long way down the line, we will be able to access our health records via IDA (14'20").

GDS are assisted by OIX, the Open Identity Exchange, in developing IDA:

• OIX publish white papers on IDA matters, including for example the IDA test conducted with Warwickshire County Council (18'05").
• OIX is the forum where GDS are considering upgrading the ID hub (18'55") to become an "attribute exchange", e.g. the hub should be able to answer questions like "is person X entitled to a Blue Badge, yes/no?".
• OIX are investigating the involvement of the mobile phone companies (20'30").
• And OIX is the place where the rules of the trust framework are agreed (21'10").

Question and answer session
Rules of engagement for IDPs (23'10"): the ID hub is entirely GDS's work (24'05") and is built using SAML 2.0; negotiating contracts with the IDPs was difficult (26'20") but the outcome is that they have to agree their procedures with GDS in advance.

Identifiers, e.g. email addresses (28'00"): any identifiers can be used, it's up to the IDPs, as long as they can authenticate who you are and as long as they follow GDS's security standards.

Trust framework (29'50"): it is true that only one of the IDPs currently has tScheme certification (30'20") but all five will eventually have to achieve that standard and they have all begun the process to achieve it.

Existing credentials (30'35"): GDS tried to get the banks to act as IDPs, they were too busy but may yet agree to join the trust framework. Meanwhile, it's up to the IDPs and not GDS to find reliable credentials and to register people.

Business users (32'45"): citizens dealing with government already discussed, for businesses dealing with government GDS plan to provide APIs (33'30"), e.g. there should be an API that allows a new business that has gone through the process of setting up a bank account to be able to use that when registering with Companies House and HMRC, and maybe an API that allows you to start the process of applying for a new passport while booking your summer holiday.

Multiple IDs, pseudonymity, anonymity (35'40"): it's up to the IDPs to decide what satisfies them and it's up to the RPs, too; there are different LoAs, at LoA1 (self-certification) you can use any name you like.

Unobservability (41'10"): GDS is advised on key-signing by GCHQ; the ID hub is designed so that IDPs don't know which RP is asking for identity assurance and RPs don't know which IDP has responded; thanks to No2ID/BBW/PI/...; it's hard to explain to users how the ID hub handles privacy (45'00") but one day it may be possible for them to barter privacy for utility.

OIX (46'15"): the rôle of OIX includes liaising with other national schemes -- US, Canada, Australia, New Zealand; there is an international committee for trust frameworks (54'10").

Trust elevation (52'00"): requirements for LoA3 will be published by the end of the year; a document-checking service will be provided (passports and driving licences) for IDPs.

RIP IDA – Obama fails to consult Maude

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Last week, the US Identity Ecosystem Steering Group (IDESG) held a three-day conference, 14-16 January 2014 at the Georgia Tech Research Institute. It's all very international and there was a one-hour slot on the Wednesday for An Overview of 2014 Plans for the UK Identity Assurance Program. The talk was given by David Rennie of the Government Digital Service (GDS). The sound recording below is for any Brits who might also be interested in our government's plans for us:



The subject matter is identity assurance (IDA), not everyone's cup of tea, and you don't have to listen to all 55'44". There is a summary appended below.

But you might consider sampling odd snatches. Between 21'10" and 21'35", for example, Mr Rennie states that GDS are working with OIX, the Open Identity Exchange, to draft the rules for the trust framework within which the UK's "identity providers" (IDPs) will have to work.

We hoi polloi need to know that we can trust the IDPs. Otherwise we would be imprudent to use them in our on-line dealings with government. And if we don't, then GDS's digital-by-default initiative is a dead duck (RIP).