Tuesday 8 April 2014

RIP IDA – where is it?

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

The Government Digital Service (GDS) are trying to transform government by making it digital by default. They have chosen 25 public services as exemplars. Exemplar no.9 is a service for DVLA – the Driver and Vehicle Licensing Agency – and is described as follows:
If you are a driver you will be able to view information from your record, including what vehicles you can drive and any penalty points and disqualifications. Drivers' data will be made available via a new DVLA enquiry platform built to handle high-volume enquiries
That's point #1.

Point #2 – GDS have been trying for some time to get identity assurance working. On 11 February 2014 they told us that IDA was finally being tested behind the scenes, and that testing on exemplar no.9 would start to use IDA in public in March:
Initially we will be adding more services and users quite gradually, as we continue to get the service ready for wider use. Other services will begin to use identity assurance from March onwards, starting with DVLA’s view driving record service. The DVLA will start trialling identity assurance for some users, aiming to use it exclusively once the identity assurance service is in public beta.
Point #3, on 1 April 2014 DVLA announced that:
Yesterday, at just after midday, we launched the public beta of View Driving Record on GOV.UK.
"... after 15 months of hard work this was it", they said, "we had delivered the first part of what we had set out to achieve ...".

Can you now see "what vehicles you can drive and any penalty points and disqualifications" on-line? Yes.

And can you see IDA in action? No.


After 15 months of work, what we get is the screen form above with just four fields to fill in and when you press the button you get two database lookups – the vehicles you can drive and any points on your licence. Maybe it's harder than it looks but it doesn't look as though that should take 15 months. Not if you're using "agile" software engineering methods.

Leave a space in your National Insurance number or in your post code when you enter it, and GDS tell you "Sorry, due to a technical problem we can't display your details right now. Please try again later" – an obtuse way to tell users to remove the spaces, and a surprising approach for an organisation that prides itself on designing user interfaces.

Are you really the user of this service? The objective is to make life easier for DVLA and for the car hire companies – this service is one step along the path to dispensing with the paper counterpart driving licences we all lose. The objective is also to make it easier for car insurance companies to check that we're telling the truth on our proposals.

This heavy reliance on National Insurance numbers to identify us is likely, we are told, to underpin the individual electoral registration service due to be released in June 2014. Does it provide adequate assurance?

All of these matters and more we can debate. But, point #4, that debate is set against the background of the continued glaring absence of IDA. Where are the so-called "identity providers"? Where are the personal data stores? Where is the secure identity hub?

----------

Updated 7.10.14

"From today, [DVLA, the UK's Driver and Vehicle Licensing Agency] has launched a new digital service. Now you can view your driving licence information online." That's what the Government Digital Service (GDS) said today in a Tweet. And they provided a link to a post on the GDS blog, A new way to view your driving licence info online.

You might take that at face value.

If you were born yesterday.

But as the rest of us know, if only from the 8 April 2014 post above, the service was launched at least six months ago.

No-one knows why it was launched then.

It's of no use to drivers.

And no-one knows why it's being re-launched now. It's still of no use to drivers. And it still operates without the benefit of the long-promised identity assurance.


RIP IDA – where is it?

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

The Government Digital Service (GDS) are trying to transform government by making it digital by default. They have chosen 25 public services as exemplars. Exemplar no.9 is a service for DVLA – the Driver and Vehicle Licensing Agency – and is described as follows:
If you are a driver you will be able to view information from your record, including what vehicles you can drive and any penalty points and disqualifications. Drivers' data will be made available via a new DVLA enquiry platform built to handle high-volume enquiries
That's point #1.

Point #2 – GDS have been trying for some time to get identity assurance working. On 11 February 2014 they told us that IDA was finally being tested behind the scenes, and that testing on exemplar no.9 would start to use IDA in public in March:
Initially we will be adding more services and users quite gradually, as we continue to get the service ready for wider use. Other services will begin to use identity assurance from March onwards, starting with DVLA’s view driving record service. The DVLA will start trialling identity assurance for some users, aiming to use it exclusively once the identity assurance service is in public beta.
Point #3, on 1 April 2014 DVLA announced that:
Yesterday, at just after midday, we launched the public beta of View Driving Record on GOV.UK.
"... after 15 months of hard work this was it", they said, "we had delivered the first part of what we had set out to achieve ...".

Can you now see "what vehicles you can drive and any penalty points and disqualifications" on-line? Yes.

And can you see IDA in action? No.

Monday 7 April 2014

RIP IDA – long odds

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Last Friday the Government Digital Service (GDS) announced that they would be issuing a new invitation to tender for identity assurance work (IDA), please see Identity assurance, procurement 2.

As noted, it looks as though enrolment into IDA would cost 35 times more than GDS previously told us. £30 million was meant to pay for 21 million putative registrations. In the event, it will cover only 600,000 putative registrations.

In a typically clear-headed assessment published in Computer Weekly magazine, Toby Stevens describes the difficulties GDS face with IDA. He also examines the position of suppliers considering a bid. Should they try to become "identity providers" (IDPs)? He has this to say:
... an IDP would need to run a population of 250,000 users in the first year just to have a chance of breaking even. That's going to be a problem for stretched Sales Directors who are evaluating bid risks and trying to determine where to focus their sales resources. Why bid the high-risk job with the deferred payback, when they could go for safer projects with up-front payment ...

I think I’d rather put my money on a 5-horse accumulator than an IDP bid team.
No board is going to sanction betting on the horses as a business development strategy. The equity analysts wouldn't wear it. Neither would the shareholders. The directors could kiss goodbye to their careers.

Nevertheless, the salesmen will probably turn up to the 28 April 2014 "event for interested organisations". That's what salesmen do. Quite rightly. It promises to be a re-run of the 20 September 2010 meeting, please see Identity assurance. Only the future is certain – doom 1.

GDS didn't exist then, back in September 2010. They do now. But it remains the case nevertheless that investing in IDA is akin to betting on the horses. Toby Stevens says: "GDS has a track record of delivering 'impossible' projects". He is a kinder man than DMossEsq. "Impossible" means impossible. RIP.

RIP IDA – long odds

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

Last Friday the Government Digital Service (GDS) announced that they would be issuing a new invitation to tender for identity assurance work (IDA), please see Identity assurance, procurement 2.

As noted, it looks as though enrolment into IDA would cost 35 times more than GDS previously told us. £30 million was meant to pay for 21 million putative registrations. In the event, it will cover only 600,000 putative registrations.

In a typically clear-headed assessment published in Computer Weekly magazine, Toby Stevens describes the difficulties GDS face with IDA. He also examines the position of suppliers considering a bid. Should they try to become "identity providers" (IDPs)? He has this to say:
... an IDP would need to run a population of 250,000 users in the first year just to have a chance of breaking even. That's going to be a problem for stretched Sales Directors who are evaluating bid risks and trying to determine where to focus their sales resources. Why bid the high-risk job with the deferred payback, when they could go for safer projects with up-front payment ...

I think I’d rather put my money on a 5-horse accumulator than an IDP bid team.
No board is going to sanction betting on the horses as a business development strategy. The equity analysts wouldn't wear it. Neither would the shareholders. The directors could kiss goodbye to their careers.

Friday 4 April 2014

RIP IDA – registration just became 35 times more expensive

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

It seems like only yesterday but actually it was 1 March 2012 when Public Servant of the year ex-Guardian man Mike Bracken MBE published Identity: One small step for all of Government.

At that stage, the Cabinet office had "built a new team and delivery plan and a working governance structure to implement Identity Assurance solutions strategically across government", he told us. The team was starting the "exciting challenge" – progress to date unknown – of "creating a trust infrastructure", whatever that is.

The Department for Work and Pensions (DWP) were going to be the "vehicle" for delivering identity assurance (IDA). Get it right for DWP and IDA could be "cut" (copied?) and pasted across the whole of Her Majesty's Government (HMG) to support its digital-by-default policy. That's what he said.

"In the first instance, IDA digital services will be used to support Universal Credit and the Personal Independence Payment, which from 2013 will replace DWP’s current benefit system". Some details were set out in a notice published in the Official Journal of the European Union (OJEU): "The initial DWP services will be required to provide identity assurance for approximately 21 000 000 claimants".

And how much was this all going to cost? Thanks to the Government Digital Service (GDS), the cost of IDA had been cut from DWP's £240 million estimate to just £30 million (= £25 million + VAT).

In the event, two years later, there is still effectively no Universal Credit and there are no "IDA digital services".

But there is a new post on the IDA blog written by Janet Hughes and David Rennie, and there's going to be a new OJEU notice, please see Identity assurance, procurement 2.

We are reminded that "last year we signed contracts with 5 identity providers. These are companies that will verify that users are who they say they are ...".

"Identity providers"? Have you grown accustomed yet to this 21st century science fiction in the British Constitution? Probably not. No-one in the UK has been provided with an identity yet by any of these five companies and there is no sign that anyone ever will be.

Today's IDA post goes on to say that "identity providers are paid each time a user registers with them. The initial contracts cover the first 600,000 registrations. We’re expecting to use all of these this year ...".

Just a minute.

The "initial contracts" were meant to cover 21 million DWP claimants. That's what the OJEU said. Where has this 600,000 figure come from? The goalposts have moved.

The DMossEsq slide rule suggests that value for money, IDAwise, has just plummeted by a factor of 35. At this rate, registering 21 million claimants would cost just over a billion pounds, making DWP's £240 million estimate seem modest by comparison.

GDS now have to plug an enormous hole in their "trust infrastructure". If there ever are any registrations in GDS's non-existent IDA programme, those registrations are going to cost 35 times more than we were first told. And in another two years' time? What will we be asked to believe then?

RIP IDA – registration just became 35 times more expensive

No need to say it, it goes without saying, it should be obvious to all but, just in case it isn't obvious to all, IDA is dead.

IDA is the Cabinet Office Identity Assurance programme. And it's dead.

----------

It seems like only yesterday but actually it was 1 March 2012 when Public Servant of the year ex-Guardian man Mike Bracken MBE published Identity: One small step for all of Government.

At that stage, the Cabinet office had "built a new team and delivery plan and a working governance structure to implement Identity Assurance solutions strategically across government", he told us. The team was starting the "exciting challenge" – progress to date unknown – of "creating a trust infrastructure", whatever that is.

Thursday 3 April 2014

Estonia – are we nearly there?

This morning's Computer Weekly headline speaks for itself: "Parliamentary computers crash 90 minutes after IT assurances".

There was a "major incident" nine days ago on 25 March 2014 when parliamentarians and their staff had trouble with email and internet access. Joan Miller, Director of Parliamentary IT, emailed her users at 12:28 to say that the problem had been fixed. 89 minutes later at 13:57 it happened all over again, major incident #2.

That's a resilience problem. Like the Government Digital Service's CloudStore being unavailable for several days. Twice. In October and November 2013.

Then there's the security problem. Even when Parliament's IT is up and running smoothly, you will remember, Ms Miller suffers from the Government Digital Service's problem – security isn't important, usability is what matters, please see The Tragedy of the Commons.

Parliament seems to be in danger of enjoying neither resilience nor security.

"Would that work here?", BBC Radio 4 asked last night. In Estonia they seem to have iDemocracy, as recommended by Douglas Carswell. How far along the road to Estonia is the UK? Without resilience, security and identity assurance, not very.

Estonia – are we nearly there?

This morning's Computer Weekly headline speaks for itself: "Parliamentary computers crash 90 minutes after IT assurances".

There was a "major incident" nine days ago on 25 March 2014 when parliamentarians and their staff had trouble with email and internet access. Joan Miller, Director of Parliamentary IT, emailed her users at 12:28 to say that the problem had been fixed. 89 minutes later at 13:57 it happened all over again, major incident #2.

That's a resilience problem. Like the Government Digital Service's CloudStore being unavailable for several days. Twice. In October and November 2013.

Then there's the security problem. Even when Parliament's IT is up and running smoothly, you will remember, Ms Miller suffers from the Government Digital Service's problem – security isn't important, usability is what matters, please see The Tragedy of the Commons.

Parliament seems to be in danger of enjoying neither resilience nor security.

"Would that work here?", BBC Radio 4 asked last night. In Estonia they seem to have iDemocracy, as recommended by Douglas Carswell. How far along the road to Estonia is the UK? Without resilience, security and identity assurance, not very.

Monday 31 March 2014

Waterfall Wanderers 0 - 0 Agile Athletic

As we were saying:
The traditional approach to software development is often known as 'waterfall' development: that is, you plan, build, test, review and then deploy, in a relentless cascade. But some IT industry players regard this practice as the chief problem ...A rather different answer which has emerged in the last ten to fifteen years has been what are called 'Agile Systems', perhaps best described as a philosophical movement in action within the software industry.
The quotation comes, of course, from Richard Bacon MP and Christopher Hope's Conundrum: Why every government gets things wrong and what we can do about it, pp.240-1. Here we are, back again, asking why government IT systems too often go over budget and what we can do about it.

The fashionable answer is that the problem is the "waterfall" engineering of software systems and the solution is "agile" engineering. Waterfall bad, agile good. That's the idea. Let's explore it a little.

Waterfall is always associated with Winston W Royce (1929-95) and, to hear people talking about waterfall these days, you'd think he was a bit of an idiot. Actually, he was a rocket scientist who got into large-scale software engineering and ended up running IT for Lockheed.

The reason he bears the blame for the British government wasting a fortune on IT, by common consent, is something to do with a paper he published in 1970, Managing the Development of Large Software Systems. A paper in which, incidentally, the word "waterfall" doesn't appear.

On the other hand, this diagram does appear:


That looks like a waterfall. To some people. Is that the smoking gun?

No.

Royce calls that a "grandiose" approach to systems development and he doesn't recommend it because it omits the "iterative relationship between successive development phases" shown in his next diagram:

He prefers this iterative approach in theory but he believes that in practice it "is risky and invites failure" because of the problem illustrated below – the developers can get locked in a loop, iterating away forever, never deploying the system, never releasing it into the field, it never moves into operational use:

Is that what's happened to the agile-loving Government Digital Service (GDS) and their so-called "transformation programme" with its 25 "exemplars"?

The dial seems to have been stuck on "1" for the number of live services for a very long time.

The single live service is exemplar #6 – Student Finance, which was released no later than 31 October 2012, please see Refining transactions with help from the Minister.

That's 18 months ago. What's going on with the other 24 exemplars? Has the "operations" box become disconnected from the rest of the agile development process, as predicted by Royce?

Maybe.

Are GDS suffering from the lack of an identity assurance service? Would they have done better to stick with the Government Gateway?

Maybe.

Or is it something to do with this paragraph which appears under the 1/7/16/1 dashboard:
The Government Digital Strategy and departmental digital strategies commit us to the redesigning and rebuilding of 25 significant ‘exemplar’ services. We’re going to make them simpler, clearer and faster to use. All these are to meet the Digital By Default Service Standard by April 2014 and be completed by March 2015. 
All 25 exemplars have to meet the digital by default service standard in no more than 30 days time. What does that mean? Never mind.

Look at that "March 2015" at the end of the quotation. Surely no politicians think that releasing 24 digital services at the same time as launching their manifesto will help them to win the UK general election two months later in May 2015, do they?

Maybe.

We don't know why progress has stalled, but it has – agile doesn't seem to be doing any better than waterfall.

What would Royce have recommended 44 years ago? Do your program design first, he said, keep your documentation up to date, do a prototype, test thoroughly and involve the customer. In a nutshell, this – the bit to the left of the dotted line:


Whatever it is, it isn't a waterfall. Not as we know it.

----------

Updated 4.12.15

As far as the Government Digital Service (GDS) is concerned, agile is the only methodology for successful software engineering. They have always said that. Ex-Public Servant of the Year ex-Guardian man Mike Bracken CBE ex-CDO ex-CDO, ex-executive director of GDS and ex-senior responsible owner of the pan-government identity assurance programme now known as "GOV.UK Verify (RIP)", said it in connection with the UK's digital Basic Payment Scheme for farmers, for example:
I go weekly now. I go to the meeting of the Common Agricultural Policy Reform Group. It's the RPA. It's the Rural Payments Agency.

Why I'm so excited about that is because they've embraced agile completely. They're going with an agile build out of a whole new programme. That's going to affect everyone in this country, and how they deal with land management, all the farmers, all the people who deal with crops, all the data. It's going to create, I think, a data industry around some of that data.

It's going to help us deal with Europe in a different way, and quite rightly we're building it as a platform. It's going to be another example of government as a platform.
And yet the digital BPS failed and our farmers now have to apply for their money using pencil and paper.

The National Audit Office have published their report on this failure, Early review of the Common Agricultural Policy Delivery Programme. And they say:
GDS provided limited continuity and insufficient insight into how to adopt agile on this scale. It was not able to identify and provide the systems integration skills required ... (p.9)

... the Cabinet Office [i.e. GDS] should ... provide stronger written guidance and capability building for departments on agile management and governance for major projects and how it fits with traditional governance structures ... [and should] support departments in acquiring the management and technical skills required to apply agile at scale ...(p.12)

The Department [DEFRA, the Department for Environment Food & Rural Affairs] and the RPA [Rural Payments Agency] had no experience of the agile approach. The Department felt it did not receive sufficient support from GDS given the level of experience of Programme staff, leading to poor application of agile. Programme governance was not adapted to quick iterative development cycles. (p.22)

The Department told us it sought guidance in 2013 from GDS on best practice for agile governance, but guidance on this was not published until June 2014. (p.28)

The Department and the RPA described GDS support as patchy. There was little continuity in personnel and GDS staff were reported to have provided insufficient insight into the use of agile at this scale. (p.33)

Many of the commitments GDS made to the Department are vague. For example, it did not quantify the savings that the use of agile would achieve: “no formal estimates of cost savings will be offered but previous experience of operating in an agile manner would suggest a significant cost reduction can be expected from traditional approaches to large scale IT procurement”. It was agreed that the Memorandum of Understanding would be reviewed every six months at Programme Board level, but this did not happen. (p.33)

More comprehensive guidance on agile management would help departments align governance for major projects with traditional governance structures. (p.34)
It looks as though GDS's enthusiastic advocacy of agile methodology is based more on fashion than useful practical experience. They may be keen but, when confronted with the reality of a public service, it looks as though GDS can't deliver.


Updated 7.9.16

Universal Credit – From disaster to recovery? Good question.

That's the title of a report just published by the Institute for Government (IfG). Has Universal Credit (UC) flirted with disaster? Yes it has. Is it possible that UC will one day succeed? Yes it is.

UC is a Department for Work and Pensions (DWP) initiative. The report provides some insight into the IT problems of UC and the occasionally fraught relationship between DWP and the Government Digital Service (GDS):
The reason it took 'much longer than they originally thought it would', according to Lord Freud, was that the GDS team were initially 'very naïve' about just how complex it was to build Universal Credit. He says:
They were messianic about building the front end, doing it in an agile way, front facing, with their beautiful apps, and they were right about all of that. But they had no grasp of how complicated it was to tie the front end to the legacy back-office, these old and creaky legacy systems we have with which it had to work – the customer information system, the debt management system, the payment system and all the things you need to run 20 million people and their records, and with all that implied.
There's a lot more where that came from (p.53) for anyone interested.

The IfG report identifies a lot of problems faced by UC including unrealistic timetables, DWP overload, lack of in-house skills and poor governance. "Waterfall" software engineering methods were not the only problem. "Agile" also was a problem. Nothing in the report demonstrates that "agile" is the solution – some of that earlier fashionable "messianic" ardour was misplaced ...

... and is now waning, please see for example The Tyranny of Agile.

Waterfall Wanderers 0 - 0 Agile Athletic

As we were saying:
The traditional approach to software development is often known as 'waterfall' development: that is, you plan, build, test, review and then deploy, in a relentless cascade. But some IT industry players regard this practice as the chief problem ...A rather different answer which has emerged in the last ten to fifteen years has been what are called 'Agile Systems', perhaps best described as a philosophical movement in action within the software industry.
The quotation comes, of course, from Richard Bacon MP and Christopher Hope's Conundrum: Why every government gets things wrong and what we can do about it, pp.240-1. Here we are, back again, asking why government IT systems too often go over budget and what we can do about it.

The fashionable answer is that the problem is the "waterfall" engineering of software systems and the solution is "agile" engineering. Waterfall bad, agile good. That's the idea. Let's explore it a little.

Waterfall is always associated with Winston W Royce (1929-95) and, to hear people talking about waterfall these days, you'd think he was a bit of an idiot. Actually, he was a rocket scientist who got into large-scale software engineering and ended up running IT for Lockheed.