RIP IDA – 16 June 2014

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Hat tip-and-a-half: Brian Krebs

Operating until recently sometimes out of New Zealand and sometimes out of Vietnam, Mr Hieu Minh Ngo is currently locked up in New Hampshire as a guest of the Justice Department and looks like spending the next 45 years in prison in the US.

An entrepreneurial young man – he's only 24 now, 69 when he gets out – Mr Ngo had two illicit web-based businesses, superget.info and findget.me, which have between them sold the personal details of more than half a million Americans. Their 1,300 customers make money fraudulently by using this information to take out loans in the victim's name, for example, or to make false tax refund requests.

Mr Ngo's companies bought this information from a legitimate company, Court Ventures, which, in turn, bought it from another legitimate company, US Info Search.

How did the information cross the line between the legitimacy of Court Ventures and the criminality of superget.info and findget.me? Rather suspiciously – Mr Ngo paid Court Ventures with monthly wire transfers from Singapore.

So far we've had new Zealand, Vietnam, Singapore and the US. We can throw in Guam, too – the US Secret Service contacted Mr Ngo and offered him some illegal business which required him to leave Vietnam, where they couldn't arrest him, and come to Guam, where they could and did.

It's all quite exotic for us Brits. Interesting in its way. But nothing to do with us, surely.

Wrong.

In March 2012, Court Ventures was bought by our very own Experian. Mr Ngo carried on paying his monthly bills by Singapore wire transfer for over nine months before the Secret Service approached Experian and told them what was happening.

This whole story comes from Brian Krebs, who operates krebsonsecurity.com and who has taken part in the investigation of Mr Ngo. He first wrote about it in October 2013, Experian Sold Consumer Data to ID Theft Service. He returned to it a fortnight ago, Experian Lapse Allowed ID Theft Service Access to 200 Million Consumer Records. And a very embarrassing story it is, too – Experian didn't identify the problem themselves either during the due diligence period before buying Court Ventures or for the first nine months that they owned the company. Their own procedures failed. They had to be told by the Secret Service.

The matter is still under investigation, Experian can't say all they would no doubt like to, in their defence, but they have given this statement to Mr Krebs:

Experian acquired Court Ventures in March, 2012 because of its national public records database. After the acquisition, the US Secret Service notified Experian that Court Ventures had been and was continuing to resell data from US Info Search to a third party possibly engaged in illegal activity. Following notice by the US Secret Service, Experian discontinued reselling US Info Search data and worked closely and in full cooperation with law enforcement to bring Vietnamese national Hieu Minh Ngo, the alleged perpetrator, to justice. Experian’s credit files were not accessed. Because of the ongoing federal investigation, we are not free to say anything further at this time.

15 criminal charges have been brought in New Hampshire – Mr Krebs provides the charge sheet – and Mr Ngo has pleaded guilty and will be sentenced on 16 June 2014.

Meanwhile, the story has moved on from New Hampshire to Washington DC, where Senator Rockefeller's Committee on Commerce, Science, & Transportation is investigating all aspects of the "data broker" industry.

On 18 December 2013 the Committee took evidence from, among others, Mr. Tony Hadley, Experian's Senior Vice President of Government Affairs and Public Policy. Mr Hadley makes his opening statement starting at 1:30:35. Committee member Senator McCaskill confronts him with the Ngo case starting at 2:22:45.

See what you make of it.

Bear in mind that, over here in the UK, Experian is currently one of the five remaining "identity providers" appointed by the Government Digital Service to provide identity assurance (IDA) for GDS's plans for public services to become digital by default.

They're not just one of the UK's "identity providers". They're easily the leading UK "identity provider". Without them, IDA dies.

Over in the US, Experian hold data on 200 million Americans. Experian are acting as "identity providers" to Obamacare. When the New Hampshire judge sentences Mr Ngo to an estimated 45 years behind bars, there's going to be some consternation. There hasn't been much coverage of the case in the UK if any but, on 16 June 2014, the ripples are going to lap up on these shores.

And when they do, can Experian survive as an "identity provider" to IDA? Should they? Will they want to?

GDS themselves are lukewarm to the point of being uninterested in security. That leaves the "identity providers" to shoulder the burden alone. No major retail bank is prepared to put itself forward as an "identity provider". No UK mobile phone network operator ditto. The "identity providers" GDS would probably like to retain – Google and maybe Facebook – are unacceptable. It's Experian or no-one.

Experian is one of the best-performing shares in DMossEsq's pension scheme. It is with considerable pain, therefore, that the verdict handed down round here at DMossEsq Towers is, no-one. RIP IDA.

----------

Updated 15.6.14

It's the big day tomorrow, 16 June 2014 – Hieu Minh Ngo appears in court to be sentenced and the judge may have something to say about how Experian managed to provide him, unknowingly until the US Secret Service alerted them, with the wherewithal to commit fraud.

Updated 27.6.14

Computer Weekly say German government terminates Verizon contract over NSA snooping fears.

What fears? Verizon are quoted as saying: “Our view on the matter is simple: the US government cannot compel us to produce our customers’ data stored in data centers outside the US and, if it attempts to do so, we would challenge that attempt in court”. Clearly the German government disagrees and has terminated the contract anyway.

The US lawyers Mayer Brown disagree. And so do Facebook, who are quoted as saying that they put up a "forceful" defence against disclosing "nearly all data from the accounts of 381 people who use our service" but had to comply in the end.

Verizon is one of the five remaining "identity providers" accredited by the Government Digital Service (but not tScheme) for their hopeless identity assurance service (IDA).

But for how long?

Can Verizon be good enough for the UK but not good enough for Germany?

Updated 28.6.14

The judge was meant to deliver his decision in the matter of Mr Hieu Minh Ngo on 16 June 2014. Here we are 12 days later and the scrofulous DMossEsq still hasn't reported it. What's going on?

David Moss @DMossEsq

@briankrebs Have been following your Ngo/Experian story, dmossesq.com/2014/03/rip-id…Can't find June 16 sentence/judgement. Can you find it?

Details

Open

briankrebs @briankrebs

@DMossEsq it got delayed til september. no explanation why.

have you seen my followups on his customers?

2:55pm · 27 Jun 2014 · Hootsuite

Updated 10.3.15

As we were saying, "on 18 December 2013 the Committee took evidence from, among others, Mr. Tony Hadley, Experian's Senior Vice President of Government Affairs and Public Policy". Has anything happened since then?

Yes, hat tip ElReg, the Data-broker Accountability and Transparency Act has been drafted.

RIP IDA – 16 June 2014

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Hat tip-and-a-half: Brian Krebs

Operating until recently sometimes out of New Zealand and sometimes out of Vietnam, Mr Hieu Minh Ngo is currently locked up in New Hampshire as a guest of the Justice Department and looks like spending the next 45 years in prison in the US.

An entrepreneurial young man – he's only 24 now, 69 when he gets out – Mr Ngo had two illicit web-based businesses, superget.info and findget.me, which have between them sold the personal details of more than half a million Americans. Their 1,300 customers make money fraudulently by using this information to take out loans in the victim's name, for example, or to make false tax refund requests.

Mr Ngo's companies bought this information from a legitimate company, Court Ventures, which, in turn, bought it from another legitimate company, US Info Search.

How did the information cross the line between the legitimacy of Court Ventures and the criminality of superget.info and findget.me? Rather suspiciously – Mr Ngo paid Court Ventures with monthly wire transfers from Singapore.

So far we've had new Zealand, Vietnam, Singapore and the US. We can throw in Guam, too – the US Secret Service contacted Mr Ngo and offered him some illegal business which required him to leave Vietnam, where they couldn't arrest him, and come to Guam, where they could and did.

It's all quite exotic for us Brits. Interesting in its way. But nothing to do with us, surely.

Wrong.

Who says Public Servant of the Year ex-Guardian man Mike Bracken CBE doesn't have a sense of humour?

Fascinating chat, @SKellyCOO & HMTreasury boss Sharon White. Great collaboration with @cabinetofficeuk & HMT https://t.co/zcCxFPwlUw
— Mike Bracken (@MTBracken) March 17, 2014

Who says Public Servant of the Year ex-Guardian man Mike Bracken CBE doesn't have a sense of humour?

Fascinating chat, @SKellyCOO & HMTreasury boss Sharon White. Great collaboration with @cabinetofficeuk & HMT https://t.co/zcCxFPwlUw
— Mike Bracken (@MTBracken) March 17, 2014

RIP IDA – what we shan't be told on 10 June 2014

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Individual electoral registration (IER) was passed into law last year and will start in England and Wales in a few months time on 10 June 2014. In the weeks leading up to that date the Electoral Commission will conduct a publicity campaign to tell people how it works and to remind us of the benefits we can expect.

What you will read
We may hear that managing our own electoral registration on-line will give us more control. And that it's more efficient. We may be told that democracy will thereby be extended. And that IER is modern and more fitting for a 21st century country than the household registration by post that it replaces.

We may be told that IER will reduce electoral fraud because, for the first time, electoral roll records can be checked against national insurance records. In fact, that's what we've already been told:

The Government’s plan for the introduction of IER includes the intention to compare existing electors’ names and addresses on the electoral registers with records held by the Department for Work and Pensions (DWP) in order to verify the identity of people currently on the registers. This process is known as 'confirmation'.

There might be a few ignorable moanbags complaining that national insurance records are in such a mess that they don't provide the Electoral Commission with much confidence. Some clever dicks may point out that the reliance on social security numbers to identify people in the US has historically been a nightmare. But this benighted awkward squad, incapable of seeing the marvels of modernisation, won't get much coverage.

The Individual Electoral Registration Bill was a Liberal Democrat Bill sponsored by their leader, Nick Clegg, the Deputy Prime Minister. The impact assessment revealed that the data-matching above was illegal. Primary legislation therefore had to be passed to allow it – a Liberal Democrat Bill had the illiberal effect of removing one of the protections built into the carefully crafted unwritten British Constitution.

Anyone complaining that the sharing of records, between the Department for Work and Pensions (DWP) and Electoral Registration Officers, is a dangerous constitutional revolution will be treated as a typical British eccentric. Charming in their way, but not to be taken seriously.

These old gits can point out all they like that democracy's finger has been pulled out of the dyke, releasing the floodwaters of massive data-sharing in which we shall all drown. They will be ignored. Francis Maude has won the day and convinced the administration that the protections afforded by the old laws were just so many myths.

All of those matters may be discussed. That will be the news.

What you won't read
What will not be news and what will not be discussed is the embarrassing point that the identity assurance programme still doesn't exist.

If IDA existed, we would have a reliable way of determining identity and its associated entitlements such as the entitlement to vote.

We wouldn't have to rely on half-baked checks against DWP, whose national insurance number database contains at least nine million records which no-one can account for. That was the figure back in 2007, after the database had been deduped/cleaned up. Before that, there were 20 million suspect records. How many are there now? Who knows.

IDA was "due to be rolled out for initial public services by autumn 2012" but it wasn't and it still hasn't been and it won't have been by 10 June 2014. It should be the linchpin of digital government but it isn't there to protect the new electoral roll at one of its weakest points – the take-on of voter details for the first time. And at the present rate, it never will be there.

At some point the administration will have to admit that IDA is dead. RIP.

When?

Not 10 June 2014. That's for sure.

You'll have to wait much longer than that.

How much longer?

144 hours. Six days. You'll have to wait until 16 June 2014 ...

RIP IDA – what we shan't be told on 10 June 2014

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Individual electoral registration (IER) was passed into law last year and will start in England and Wales in a few months time on 10 June 2014. In the weeks leading up to that date the Electoral Commission will conduct a publicity campaign to tell people how it works and to remind us of the benefits we can expect.

EXCLUSIVE: GDS and the 2015 general election – SCOOP

"Central plank of the 2015 UK election campaign temporarily unavailable", we said, back in November 2013.

That was when CloudStore went down for a week. Twice. Just after Public Servant of the Year ex-Guardian man Mike Bracken CBE had been allowed to make a presentation to the full Cabinet of the UK government.

Clearly GDS – the Government Digital Service – was going to form part of the Conservative Party May 2015 general election campaign and manifesto, and maybe the Liberal Democrats', too.

But what of UKIP?

Don't know.

And what of Labour?

There's been a bit of activity on Twitter over the past few weeks involving Matthew Taylor and, indirectly, Jon Cruddas MP, Labour's policy architect. It looked as though Labour are trying to make their mind up about digital-by-default and that is confirmed in a blog post by Bryan Glick, the editor of Computer Weekly, following an interview with Chi Onwurah, one of the few Labour (or Conservative or Liberal Democrat or UKIP) MPs who might actually understand the technology.

Only four months after DMossEsq, Mr Glick says "GDS becomes political as Labour launches digital government review" and now GDS have noticed, too, and have started to set out their stall in a blog post today, Mapping the GDS journey.

We've got 14 months of this to look forward to. And we're off to a good start. With a scoop, which Mr Glick has not yet found room to publish in the comments on his blog post. [Mr Glick has now kindly published the comment, which had been trapped by a Computer Weekly spam filter.] So here it is. An exclusive:

David Moss | March 12, 2014 10:27 PM By some mystery of modern telecommunications, the following email arrived in my inbox three months before it was sent. ---------- From: SpAd Sent: 12 June 2014 20:15 To: ShadCabOffMin Subject: Government Digital Service (GDS) Dear Chi As requested, I have taken a look at this GDS business. I understand that the issue is what to put in the manifesto that will make us look modern, alert to the possibilities of technology, caring and prudent moneywise. There’s an obvious political problem. If we support GDS, we look as though we support the Conservatives/Lib Dems. I strongly recommend, therefore, that we criticise them. There is ample reason to do so. They’re promising savings. GDS reckon it would take 11 years [1] from the time digital-by-default starts – which it still hasn’t – to the point at which the country could enjoy savings by making a minimum of 40,000 [2] public servants redundant. The public has had it up to here with promises of savings that are never delivered. They’ll take one look at that 11 years and decide that (a) it’s so far in the future no-one could possibly make an accurate prediction, (b) that’s 11 years during which no politician or official can be accused of failure, they can just do what they like in the interim, and (c) they’ll all have moved on to retirement/better jobs in the private sector by the time the mission is aborted at a cost estimated by the NAO to be £1 billion. I may have got this wrong but 40,000 public sector redundancies doesn’t look to me like a Labour policy objective. It would probably knock another million off union subs to the Party. Not helpful with our overdraft at the Co-op. We’d do best to point out that digital-by-default is just the Blair policy of transformational government [3] under a different name. Criticising it gives us a double whammy. Not only can we say that the coalition have got it wrong, they’ve been hoodwinked by silver-tongued IT salesmen, it also helps to keep a distance between us and TB. Digital-by-default only works if there’s a reliable national identity management system. We really don’t want to go through all the aggro we had with ID cards again. Do we? Better to cast the coalition mob as Blairite ID card supporters and let Labour take a stand on civil liberties (if any of your colleagues can remember what they are) and the human right to privacy. There’s a lot more but perhaps that’s enough. Will write up the rest if you insist. As a parting shot, do you realise that GDS’s model for digital by default is Estonia [4]? I wouldn’t fancy your chances of re-election if you try to convince the good people of Newcastle that they should be more Estonian. Best SpAd 1. Figure 10, p.20 2. Ibid, p.19 3. Transformational Government – Enabled by Technology 4. Estonia’s technology economy and online service provision- back to the future?

EXCLUSIVE: GDS and the 2015 general election – SCOOP

"Central plank of the 2015 UK election campaign temporarily unavailable", we said, back in November 2013.

That was when CloudStore went down for a week. Twice. Just after Public Servant of the Year ex-Guardian man Mike Bracken CBE had been allowed to make a presentation to the full Cabinet of the UK government.

Clearly GDS – the Government Digital Service – was going to form part of the Conservative Party May 2015 general election campaign and manifesto, and maybe the Liberal Democrats', too.

But what of UKIP?

Don't know.

And what of Labour?

Something for the weekend, Sir?

"We wanted to try something new", said GDS four Saturdays ago, 15 February 2014, "sharing the things we've liked over the past week in a blog post".

That was followed by links to stories about the National Archives, ways to write clearly, "an unlikely cause for squeaky brakes" and other matters.

You get the idea. GDS are proposing a frothy Saturday magazine features series. Nothing too serious. A touch of humour. The emphasis is on good news for a change. Which is fine. Utterly harmless. If you're a frothy Saturday magazine.

But they're not. They're the Government Digital Service. This Weekend Links series appears on the GDS blog. And GDS's job is, to quote them, "to be the unequivocal owner of high quality user experience between people and government by being the architect and the engine room of government digital service provision".

What are GDS doing, highlighting flood defences, as they did on 22 February 2014? That's not their job. It's DEFRA's job.

How do the MOD feel about GDS promoting a DEFRA initiative rather than one of theirs?

By 1 March 2014, they'd moved onto the Oscars. They didn't win one. And yesterday, 8 March 2014, they were "celebrating International Women's Day". What's that got to do with GDS?

The accompanying paraphernalia of lions, unicorns and crowns means that, on their blog in the GOV.UK domain, GDS speak with the authority of the government. The selection of which things to share with us, the choice of which things they have liked over the past week, becomes official. Political. Religious even – dieu et mon droit.

These are editorial decisions. Can you imagine GDS choosing to promote DWP's Removal of Spare Room Subsidy?

If not, there's a bias creeping in. And GDS have no business exercising their personal bias at taxpayers' expense. Let them start their own blogs in their own time if that's what they want to do.

"Simpler, clearer, faster". That's the motto of GOV.UK and when it comes to Weekend Links – to put it simply, clearly and fast – don't. It's a mistake.

Is that a bit puritanical? A bit killjoy? Suppose GDS have something useful to say in their weekend links, something that will add to the education and entertainment of the nation. Then it might be less of a mistake. But they don't.

Yesterday's Weekend Links included this: "GDS’s Head of Content Design, Sarah Richards, shares her thoughts on women in technology":



Ms Richards would like to see more women working in technology. Why? Because she would like to see more women working in technology.

And last week, Ms Richards shared her thoughts with us on clear technical writing.

She wants to ban ampersands (480,000 instances on www.gov.uk). Why? "The reason is that 'and' is easier to read and easier to skim. Some people with lower literacy levels also find ampersands harder to understand ...".

The life expectancy of the hyphen is now similarly short. She gives the example "This information relates to 2013-14" and asks: "What does that mean to you?" It would be better to write "tax year 2013 to 2014", she says.

That takes us back to GDS's war against the word "submit". We have already noted their attempt to help HMRC by re-writing every occurrence of "submit a VAT return" as "send a VAT return", the latter being shorter and less "formal" than the former. But GDS's style guide is not followed consistently. There are 16,900 occurrences of "submit" on GOV.UK which they don't object to.

Ms Richards finishes her thoughts with a question about questions. Specifically FAQs – frequently asked questions. GDS don't approve of FAQs. So they've come up with FAQs without the questions. Which obviously tickles them.

"Did it make any difference to your understanding of the page because there’s no actual questions?", she asks. Because? Despite the fact that? There's? There are? That's an unfortunate sample sentence to be penned by someone intent on telling people how to write English.

If GDS want to promote clear English, would they please stop their fashionable talk about "learnings" when they mean "lessons", e.g. "We’ve worked together to co-ordinate research and procurement requirements and to share learnings on commissioned studies".

Also, it's Lent, would GDS please give up "behaviours", e.g. "linking this narrative to the explicit development of our behaviours as leaders, managers, partners and as Public Health England itself".

As long as GDS continue to talk about "learnings" and "behaviours" they are in no position to advise anyone else about style.

They should also learn to embrace the numbered list. They published a paper on privacy some time back and asked for comments. It is easiest to comment on this crucial matter if the paper has numbered paragraphs. They were asked to number them and they agreed to look into the matter.

That was in June 2013. Nothing has happened in the nine months since. GDS seem to be more interested in preserving their chosen unnumbered style than in creating an on-line transactional system that preserves privacy.

GDS have really got only one job to do and that's to get identity assurance working. Without that, everything they do is pointless.

They have failed so far and they should now concentrate all their efforts on IDA.

There is no excuse for "the engine room of government digital service provision" to be publishing Weekend Links.

Something for the weekend, Sir?

"We wanted to try something new", said GDS four Saturdays ago, 15 February 2014, "sharing the things we've liked over the past week in a blog post".

That was followed by links to stories about the National Archives, ways to write clearly, "an unlikely cause for squeaky brakes" and other matters.

You get the idea. GDS are proposing a frothy Saturday magazine features series. Nothing too serious. A touch of humour. The emphasis is on good news for a change. Which is fine. Utterly harmless. If you're a frothy Saturday magazine.

But they're not. They're the Government Digital Service. This Weekend Links series appears on the GDS blog. And GDS's job is, to quote them, "to be the unequivocal owner of high quality user experience between people and government by being the architect and the engine room of government digital service provision".