Wednesday 11 June 2014

Individual Electoral Registration = national identity register

Individual Electoral Registration (IER) came into force in England and Wales yesterday, Tuesday 10 June 2014. DMossEsq's millions of readers have known about it for ages ...
... and a few other people may have seen Rt Hon Greg Clark MP's press release yesterday, Register to vote: new online service launched.

Mr Clark is a Minister of State at the Cabinet Office and he says that:
IER will prevent fraud by enabling government to check that everyone on the register is who they say they are. This will lead to greater trust in the legitimacy and fairness of elections.
"Prevent fraud"? That's a tall order.

"Check that everyone on the register is who they say they are"? We've always been told that we need the Government Digital Service's (GDS) identity assurance service (IDA) for that. IDA still doesn't exist. GDS just can't hack it. It's beyond them. What we've got instead is a second rate check – against the Department for Work and Pensions National Insurance number database. That's the database that included nine million people no-one could account for back in April 2007, Fraud fear as millions of NI numbers are lost – so much for identity assurance:
The nine million numbers were issued by the Department for Work and Pensions (DWP) and are registered on its database, but officials do not know if they are held legitimately.
"This will lead to greater trust"? Mr Clark may prove to be right. Or wrong.

Either way ...
From 10 June 2014, people will be able to register online in just 3 minutes by providing their name, address, date of birth and National Insurance number.
... and DMossEsq took the new on-line registration service out for a spin, pausing only to note that he must be about to provide not only his name, address, etc ... but also, unmentioned by Mr Clark, his IP address, his broadband provider and his location.

Let's start at the end of the process. The last thing you discover is that you haven't registered at all.

Hardly surprising, of course, given that GDS is not an Electoral Registration Officer (ERO).

All GDS do is send the data you've just entered to your local authority, who will either register you or question you if there seems to be something amiss.

DMossEsq's local authority says:
You will ... receive a letter from the Electoral Registration Officer to let them [you?] know that either:
  • You have been confirmed and been successfully transferred to the 'IER register' and do not need to do anything further
or
  • You need to provide additional information to the Electoral Registration Officer in order to be registered under IER.
"Receive a letter"? Five individuals in the family. So five letters. And there was dear old Mr Clark telling us that "putting public services online is saving taxpayers money". Once again he may prove to be right. Or wrong.

There's meant to be one electoral register per constituency.

It looks remarkably as though GDS will now have a copy as well as the EROs. IER is #1 on GDS's list of 25 public services by digitising which they aim to "transform" government in an exemplary fashion. And they say the service will be used by 46 million people.

That's quite some transformation. It means that Francis "JFDI" Maude, who promised not to create a national identity register, will in the event have created ... a national identity register.

And where is this national electoral register? In the cloud. Possibly with Skyscape. Or Carrenza. Or Akamai. One way and another, not under GDS's control. Nor your local ERO's control.

Anyone could be helping themselves to the electoral roll in the cloud.

In addition, in order to complete the registration application process, DMossEsq had to give permission for his data to be shared with "other government departments".

That's something else Mr Clark failed to mention while he was telling us that:
The new online tool is part of the move to Individual Electoral Registration (IER), replacing the old and outdated household registration system with individual registration.

Now that we've stopped being outdated, we can swap telephone numbers and email addresses.

If you try to Continue without ticking any of the boxes, GDS get all shirty and start talking to you in red, see opposite.

Most voters will no doubt sensibly choose the Post option.

DMossEsq tested to see if there's anything to stop you applying twice. There isn't. GDS aren't validating carefully enough.

Will DMossEsq be given two votes in the next election? Probably not. But his local ERO may be a bit irritated that GDS send the same data twice.

Will DMossEsq appear twice on Mr Maude's new national identity register? Again, Mr Clark didn't make that clear.

GDS celebrated the release of their new public service with a blog post, Individual Electoral Registration – changing the way we register to vote. They're proud of the achievement:
IER underpins the democratic process in this country and is secure and robust.
But not proud enough to update their government "transformation" dashboard, which still shows just one of their 25 exemplars live. It should show two live ...


... and 23 not.

----------

Updated 11.6.14

The image of the digital transformation dashboard above, showing just one live exemplar, was made at some ungodly hour this morning around 2 a.m. Later that same day, the dashboard was transformed by some alert functionary to show three live exemplars:


Mostly, you'd expect dashboards to be updated automatically. They obviously do things differently at GDS. How long before we see "Situations vacant: agile dashboard assurance director, central London, 2 days a year"?


Updated 12.6.14



Updated 12.6.14

No response from GDS, apart from the digital transformation dashboard being updated, but a welcome response from Halarose:


The Halarose company sells electoral registration systems to about 80 local authorities in the UK. We have come across them before, when it transpired that they keep the electoral rolls for these local authorities in the cloud, with Amazon Web Services, in the Republic of Ireland.

According to them, "the data doesn't persist at GDS" – having sent the details of an individual applying to vote to that individual's local ERO the idea is, according to Halarose, that GDS then delete those details, they don't "persist".

True? Or false?

How do Halarose know? How would you know?

GDS certainly don't say that anywhere in the application dialogue – DMossEsq has been through and applied for a third time just to check and, no, the wording hasn't been changed since yesterday.

On the other hand, they do say that they may want to contact applicants, which is why they ask for an email address or a phone number.

If Halarose are right then, no, GDS haven't set about creating a national identity register even though the design of the application dialogue makes it look as though they have.

Perhaps GDS will for once do its parishioners the honour of explaining themselves.


Updated 12.6.14

The level of confusion GDS have sown with their IER publicity is impressive.

We now have people filling in the form thinking that they have as a result registered to vote. They haven't. They've submitted an application to register to vote:



That's in the UK. The confusion extends to the US:


18f is the would-be US equivalent of GDS. Alex Howard is a journalist on several influential journals. And the British public is the British public.

Anyone taken in by this claim that you can now register to vote on-line in the UK is going to feel legitimately aggrieved when the truth comes out, especially the Electoral Commission whose job it really is to register electors, and not GDS's, who might do well to dispel the current confusion quickly.

It's just an application, not a registration

GDS might try clearing up another confusion at the same time. Public Servant of the Year ex-Guardian man Mike Bracken CBE works for the Cabinet Office and is sometimes described on that basis, in the US press at least, as a member of the Cabinet. Confusing. But he's not.


Updated 20.6.14 I

Official forms in the UK are normally available in both English and Welsh.

That includes applications to register to vote. There's an English application form and there's a Welsh one. These are both hard copy forms available from GDS's apply-to-register-by-post page.

As we have seen, there is an English form available on-line. That's where the examples above come from.

Why isn't there a Welsh one?

The answer is that there is a Welsh language application form on-line – https://www.gov.uk/cofrestru-i-bleidleisio. It's a funny mixture of English and Welsh but it's there, it exists, and yet GDS haven't told anyone about it. Why? It seems like a bizarre omission. GDS have produced the form but don't tell anyone. Why don't they offer the chance to proceed in Welsh early on in the dialogue?


Updated 20.6.14 II

When you submit your completed application form, the details are forwarded to the appropriate electoral registration officer (ERO).

EROs are going to receive a lot of forms:
  • Some of them will be complete, accurate and legitimate.
  • Some will have honest mistakes.
  • Some will be attempts at fraud.
  • And some will be submitted by trolls simply because they can. In principle, a computer program could be used to submit hundreds of millions of applications automatically. Should GDS perhaps introduce a captcha facility to stop EROs from being deluged?
It's up to the EROs to decide whether to register any given applicant to vote. It's not up to GDS.

The EROs' job could be made easier if there was more validation performed by GDS as the details are being entered:
  • At the moment, any date of birth will be accepted so long as that makes the applicant less than 115 years old.
  • And any address can be entered.
  • Some letters in the National Insurance number (NINO) are acceptable, some aren't, and any numbers will be accepted. The GDS facility validates the NINO a bit, but it doesn't check that it is the applicant's NINO and it doesn't check that the NINO actually exists.
Before 10 June 2014, there was just one application form per household. It had to be signed – there is no equivalent in the new GDS application system – and once posted back to the ERO, any fraudster or troll had run out of ammunition to work with, whereas now there seems to be no limit to the number of applications that can be submitted.

There could be legal reasons for those deficiencies. There might be. There might not be.

Either way, EROs could find themselves with a lot of work to do as a result.

That problem could be alleviated if GDS had managed to make identity assurance (IDA) work. Famously, they haven't. But if they had, then:
  • We could digitally sign our applications.
  • The ERO would know that that was the applicant's date of birth ...
  • ... and address ...
  • and ... NINO, and so on.
IDA will rely if it ever comes into being on a number of so-called "identity providers" (IDPs) and the apparent benefits above could be achieved by getting our putative IDP(s) to confirm with the EROs that the details given are authentic.

But hang on a minute.

In that scenario, the individual trying to register has become redundant. Registration can be achieved simply by communication between the EROs and the IDPs. The individual cancels out of the equation.

Either this new facility of GDS's remains unhelpful or it becomes so helpful that we're no longer needed.


Updated 23.6.14 #1

The first day that individual electoral registration came into force, 10 June 2014, there was already an entrepreneurial website offering to submit your application to register to vote for you, for only £29.95 – just one of the many ways in which digital-by-default can help to boost the economy.


Updated 23.6.14 #2

It may feel like a new world now that we have on-line application to register to vote in the UK but some traditions carry on, at least for the moment, Electoral Registration Officers must all conduct house-to-house canvassing during transition to new electoral registration system.


Updated 23.6.14 #3

GDS published a post on Friday, I fought the law and the users won: delivering online voter registration. The Permanent Secretary at the Cabinet Office, Richard Heaton himself, has submitted a comment:
One small point on your first paragraph: you don't get onto the electoral roll within minutes: what's happened is that you've applied to go onto the register. Your local authority then completes the process.
Good to see that point first raised on this blog confirmed by the man in charge.

He also says:
Your point about law being at the service of users (citizens) is really, really important. Statutes that make sense to parliamentarians and officials, but don't work, are useless. As St Paul the lawmaker might have said: If I speak with the tongue of men and angels but have not useability, I am as a sounding brass or a tinkling cymbal.
1 Corinthians 13
King James Version (KJV)

1 Though I speak with the tongues of men and of angels, and have not charity, I am become as sounding brass, or a tinkling cymbal.

2 And though I have the gift of prophecy, and understand all mysteries, and all knowledge; and though I have all faith, so that I could remove mountains, and have not charity, I am nothing.

3 And though I bestow all my goods to feed the poor, and though I give my body to be burned, and have not charity, it profiteth me nothing.

4 Charity suffereth long, and is kind; charity envieth not; charity vaunteth not itself, is not puffed up,

5 Doth not behave itself unseemly, seeketh not her own, is not easily provoked, thinketh no evil;

6 Rejoiceth not in iniquity, but rejoiceth in the truth;

7 Beareth all things, believeth all things, hopeth all things, endureth all things.

8 Charity never faileth: but whether there be prophecies, they shall fail; whether there be tongues, they shall cease; whether there be knowledge, it shall vanish away.

9 For we know in part, and we prophesy in part.

10 But when that which is perfect is come, then that which is in part shall be done away.

11 When I was a child, I spake as a child, I understood as a child, I thought as a child: but when I became a man, I put away childish things.

12 For now we see through a glass, darkly; but then face to face: now I know in part; but then shall I know even as also I am known.

13 And now abideth faith, hope, charity, these three; but the greatest of these is charity.
Mr Heaton has a special interest in drafting the law. St Paul didn't.

Far from being a "lawmaker", St Paul's expertise was in mohair, specifically for use in making tents. And far from usability, pace Mr Heaton, it's charity that St Paul promoted, please see opposite.

"Charity vaunteth not itself, is not puffed up ...", unlike the brass-tongued claim "I fought the law and the users won", which sounds like a tinkling cymbal vaunting itself and puffing itself up.

What, you may ask yourself, lies behind this claim?

You're not alone. Several people would like to know, e.g. the redoubtable Paul Clarke, and Edward Crocker: "What were the laws you got changed and what was the timescale for this?".

And as luck would have it, we have this response:

Good question. An example of a legislative change we worked with the policy and legal team on, was to remove the requirement for online anonymous voter registration (people who have concerns for their safety) to be available on June 10th. This is a complex area that needs a lot more user research and has additional information and offline documentary requirements (physical copies of court orders etc).

We felt that by including this option in the online service, we risked making it harder and more complex for anonymous registrants as well as exposing the vast majority of people using the service to a concept that has no relevance to them at all. We would rather create the time to research this area fully and come up with a new service for these people.

We went through the process of proposing this change, discussing and debating with the policy and legal team, preparing evidence for statutory instrument (SI) debates in parliament, and the debates themselves – all over a 3 week period.

It's worth noting that booking SI debates has a long lead time, however, importantly it can be possible to add additional items into scheduled debates, which is what we did.

It looks from that response as though the Electoral Registration and Administration Act 2013 demanded something impossible – anonymous applicants can't show hard copy court orders on-line. A "useless statute", as Mr Heaton calls it. Since it's impossible, GDS can't do it. But if they didn't do it by 10 June 2014, GDS would be breaking the law. So they argued their case and the law was changed.

Nothing heroic about that, it's not obvious that "the users won" and it's not obvious that there was any fight. So why the triumphant note in the tinkling brass cymbal?

We can only see the answer through a glass, darkly.


Updated 23.6.14 #4

It should be noted that there is a technology available that should, in theory, be able to solve the problem of anonymous applicants.

As things stand, they can't show their court orders on-line because the court orders are hard copy, material objects. But court orders could be issued as digital certificates, dematerialised court orders instead of material ones, if only GDS had got to grips with PKI, the public key infrastructure.

You might expect them to have got to grips with this technology by now. Their lasting power of attorney exemplar #25 (LPA) has been knocking around for ages and could approach the 21st century if the LPA was issued as a digital certificate. But it isn't.

Here they are again, with electoral registration exemplar #1, ducking PKI. That's why they had to ask to be let off doing anonymous applications to register.

PKI is one of the technologies needed to get identity assurance working (IDA). No PKI, no IDA. No IDA, no anonymous applications to register on-line.

GDS fought IDA and the users lost?


Updated 25.6.14

The following comment has been submitted to the GDS blog:

  • David Moss
    Your comment is awaiting moderation.
    Dear Mr Herlihy
    "I fought the law and the users won", you say.
    Judging by your answer to Edward Crocker, there was no fighting involved. Instead, a new statutory instrument was made. Not unprecedented, these have been running at the rate of about 3,000 a year since 2010.
    The question remains in what way the users have won.
    Rt Hon Greg Clarke MP says in his press release that "IER will prevent fraud by enabling government to check that everyone on the register is who they say they are. This will lead to greater trust in the legitimacy and fairness of elections".
    As the Product Manager, can you please explain how IER prevents electoral fraud any more effectively than the previous household registration procedure.
    You make the point in your what-I-learned-in-Estonia
    And having recourse to National Insurance numbers for IER is likely to lead to the same problem they have in the US with social security numbers: "Identity theft is one of the fastest growing crimes in America. A dishonest person who has your Social Security number can use it to get other personal information about you. Identity thieves can use your number and your good credit to apply for more credit in your name". So says the US Social Security Administration.
    Can you please explain how IER checks that applicants are who they say they are any more effectively than household registration did.
    Lastly in connection with the Minister's promises, can you please explain how you will measure "trust in the legitimacy and fairness of elections" to determine whether it is greater with IER than without it.
    It looks as though GDS will be collecting IER applicants' details all in one place, the database behind the on-line application form. The Electoral Registration and Administration Act 2013 makes it illegal to create a consolidated electoral roll. Is there a danger that the IER application service is breaking both the law and Rt Hon Francis Maude's promise not to create a centralised population register?
    Yours sincerely
    David Moss
    Link to this commentReply


Updated 26.6.14
Second best democracy ...
... rejected by second hand car market

Identity assurance (IDA) is meant to prove that a person is who he or she says they are.

GDS couldn't get IDA working in time for IER. So how do electoral registration officers know that an applicant is authentic? As far as we know, they are reduced to name, address, date of birth and National Insurance number.

It's not just IER. GDS couldn't get IDA working in time for Universal Credit, either. And it wasn't ready for last year's on-line PAYE tax code trials. Nor was IDA ready for DVLA's view your driving record service.

Now there are signs of movement at DVLA, the Driver & Vehicle Licensing Agency. According to a blog post by DVLA today, The View Driving Record Experience:
We are aiming to launch our private beta of the identity assurance option this week. This will mean that a limited number of users will be given the opportunity to trial identity assurance as an alternative to the existing log in process.
And why are they bothering? Why do DVLA want IDA? What's wrong with the present procedure of using National Insurance numbers to view your driving record? From the horse's mouth:
Access to the service is currently allowed by matching the user’s data to the driving licence number. We also use an existing link to the Department for Work and Pensions (DWP) to check if the National Insurance Number (NINO) provided matches details held by DWP and HM Revenue & Customs.

Whilst this authentication process is fairly quick and straightforward, there are some downsides ... it does not provide us with the level of confidence the user is who they say they are in order to offer them more information such as their photo image or allow them to link to a transactional service.
There you have it – "... this authentication process ... does not provide us with the level of confidence the user is who they say they are ...".

No good for DVLA, but it's supposed to be good enough for applications to register to vote.


Updated 29.6.14

DMossEsq submitted a comment to the GDS blog on 25.6.14 which was kindly responded to on 27.6.14. The following response to that response has now been posted:
David Moss
Your comment is awaiting moderation.
Dear Mr Herlihy
Thank you for your 27 June response.
Rt Hon Francis Maude MP, Cabinet Office Minister, is famous for referring to laws he doesn’t like as "myths" that need to be "busted". And for his claim that "we’re the JFDI school of government". Also for embracing Martha-now-Lady Lane Fox's call for "revolution, not evolution".
Working in his department as you do, it must be hard to resist this heady demagoguery. Thus, presumably, your otherwise inexplicably triumphalist "… it's early days for the register to vote service, but with currently the highest satisfaction rating of any online government service, it's testament that those battles were worth having … This is what doing the hard work to make it simple for users is all about … *drops mic*".
As you should all know, when contempt for the law reaches a sufficient hysteria to prompt a revolution, it's the innocent people/users who suffer in the new world from the resulting Terror. From that point of view it is a pleasure to see that your achievements with IER actually required no fighting ("I fought the law"?) but simply rational negotiation and the observance of due process provided for by a wise Constitution.
Far from being "slightly off topic", as you put it, "trust in the legitimacy and fairness of elections" is central to IER.
When a user gets to the end of the on-line application process, he or she sees: "What happens next … We've sent your application to the [local authority] electoral registration office". In that case "we" is GDS. Question 11 of 11 in the application process asks "If we have questions about your application, how should we contact you?". The implication is once again that "we" denotes GDS. If GDS intend to contact applicants, then GDS must be keeping the applicants' details. Illegally. But you say they're not – "this isn't the case".
If GDS insist on fomenting a belief that the law is a collection of myths that need to be busted by callow revolutionaries who JFDI because they madly believe that they know what's best for users, then they undermine their own credibility. GDS are going to find it difficult to make people believe that the law isn't being flouted and that the applicants' details aren't preserved centrally.
You say that IER has "currently the highest satisfaction rating of any online government service" but you make no reference in your 27 June response to the question how "IER checks that applicants are who they say they are". IER uses the same technique as DVLA's view-driving-record service, a technique which relies on National Insurance numbers (NINOs).
Far from being highly satisfied, DVLA say: "Whilst this authentication process is fairly quick and straightforward, there are some downsides … it does not provide us with the level of confidence the user is who they say they are in order to offer them more information such as their photo image or allow them to link to a transactional service".
The Electoral Commission are due to launch an IER public information campaign next month. If DVLA don't think NINOs are good enough to link drivers to a transactional service, then it would be irresponsible for the Commission to say that NINOs are good enough to link people to a vote.
Someone has been filling the Electoral Commission's head full of unjustified confidence in eVoting. It's been tried and failed to work in Washington DC, Estonia and Norway.
Under the Lane Fox dispensation, GDS are in charge of digital government, and it is GDS's responsibility therefore to rein in the Commission, who are getting way ahead of the game, recommending eVoting when we can't even do eRegistration. Among others, your responsibility, Mr Herlihy.
"*drops mic*"
Yours sincerely
David Moss
Link to this comment

Updated 30.6.14

"Why don't they offer the chance to proceed in Welsh early on in the dialogue?", asked DMossEsq 10 days ago.

Now they do.

After dealing with people who wish to register by post – which remains an option – and after seeing off the illegal residents.


Updated 30.10.14

Yesterday, GDS published the list of the public services that will be first to use IDA, or "GOV.UK Verify" as it's now known, please see The next 6 months: services that plan to start using GOV.UK Verify.

GDS's application service to register to vote is not on the list. Never mind the upcoming general election, the service will have to continue to limp along with no on-line identity assurance.

Viewing your driving record will be graced with identity assurance, if GDS are to be believed, but not applying to register to vote.


Updated 31.10.14

Leafing through Nick Clegg's June 2011 White Paper on Individual Electoral Registration, your eye may be caught like DMossEsq's by clause 52 on pp.18-9:
In time other forms of verification may become available which means that a person may not be required to produce their NINO [National Insurance number] and DOB [date of birth] when making a new application to register – the legislation has been drafted with this in mind. On 18 May 2011 the Government announced plans for the development of a consistent, customer-centric approach to digital identity assurance [emphasis added] across all public services. The intention is to create a market of certified identity assurance services delivered by a range of private sector and mutualised suppliers so that people will be able to use the service of their choice to prove their identity when accessing any public service. The draft legislation will allow digital identity assurance to be used in future to verify an application to be added to the electoral register. Additionally it may be possible for verification to take place at local authority level using similar local arrangements. We will monitor these developments with a view to improving the verification process if it helps to simplify the system and encourages more people to register.
Have GDS forgotten?


Updated 17.1.15

Apart from the problems above, how is individual electoral registration going?

The BBC report that Labour attacks missing voters 'scandal':
Labour said 307 of 373 local authorities that provided data had recorded a reduction in their electoral roll. Overall, there had been a reduction of 950,845, the party said.
"I fought the law and the users won"?


Updated 19.3.15

BBC: Registered to vote? Computer says no…


Updated 13.7.15

Despite GDS's work on IER, electoral fraud remains a problem according to Eric-now-Sir-Eric Pickles, the UK's Secretary of State for Communities and Local Government until the general election a few months ago:
We are ignoring electoral fraud just as we ignored child sex abuse in Rotherham

Our nation has a proud heritage as the mother of Parliaments, yet the worrying and covert spread of electoral fraud threatens that reputation. While all politicians want high turnouts, we cannot sacrifice integrity and confidence in our democracy through misplaced political correctness or woolly concerns over “political engagement”. It is time to awake from our state of denial and take action against the electoral crooks who threaten our elections. British democracy should not be reduced to the level of a phone vote in an X Factor contest: “vote early, vote often” is the problem, not the solution.

Updated 31.1.16

Now that we have individual electoral registration in the UK and now that we have GDS's on-line system for batching up applications to register to vote, everything is different.

Gone are the days when the local Electoral Registration Officer (ERO) wrote to the head of the household to confirm voter details. Now he or she sends the same letter addressed to "The Occupier(s)":


The transformation isn't quite complete. There's only one letter – for the household – rather than one per voter and the ERO's reference is still "Household Information Letter".

When will the ERO send emails instead of letters?

When will the "Current Voting Method" column include "Electronic" in addition to "Polling Station" and "Postal"?

We don't know the answers.

But there is another question. As we speak, the Office for National Statistics is preparing for the 2021 census, see for example Come along to an Office for National Statistics supplier briefing to find out how you can get involved in the delivery of the 2021 Census. Many people expect the next UK census to be conducted electronically. How likely is that to be the case?

How likely are we to have an electronic census in five years time? Given the limitations of the electronic registration of voters? And the repeated failures of the assisted digital project to make any progress? And the sad death of the national identity assurance scheme, GOV.UK Verify (RIP)? Not very.

All that alleged transformation GDS are so proud of – lipstick on a pig? That's what the departed deputy director of GDS thinks.


Updated 1.5.16

Last week a man you've never heard of said something.

On 28 April 2016, Dr. Philip John Rycroft CB DPhil, Second Permanent Secretary at the Cabinet Office and Head of its UK Governance Group, published Modernising voter registration - the unsung story.

He wants people to be sure and vote in this week's local elections, police commissioner elections, the London mayoral election and the June EU referendum. Fair enough. That's his job.

It's a moot point whether GDS's batch application system for registration counts as modernisation. As for "unsung", 5,760 words above says GDS's efforts are anything but.

Second Permanent Secretaries asking for praise when their staff just do their job? Remember the Biblical warning of the previous permanent secretary, Richard Heaton, not to be "as a sounding brass or a tinkling cymbal".


Updated 18.7.17

The brass was being sounded again yesterday and the cymbals were tinkling.

GDS's batch apply-to-register-to-vote system recorded some monumental activity in the run-up to the UK's 8 June 2017 general election – well over 600,000 applications were made on 22 May 2017 alone.

Those applications are collected by GDS's system and forwarded to the appropriate EROs, the electoral registration officers for each area. Registration is up to the EROs, not GDS.

Many applications will be legitimate and correct, some will be fraudulent, some will contain errors and many will be duplicates. They all have to be checked manually before the electoral rolls in each area can be updated.

You might assume that GDS's GOV.UK Notify would be pressed into service here but, no, applicants are not told the result electronically. Have they been registered or haven't they? They don't know until a polling card arrives by post or until they try to vote in person.

And who is that person? You might hope that GDS's GOV.UK Verify (RIP) would be pressed into service here but, no, it isn't, and the attempts made at identity assurance are puny and not worthy of the name.

Even if GOV.UK Verify (RIP) were pressed into service, you can't assume that it would help. The long line of people unimpressed with it has recently been joined by the UK's Law Commission, who say: "Verify does not currently ensure that the person entering the information is in fact the person he or she is purporting to be; rather it focuses on verifying that the person exists" (para.6.67).

GDS claim to be in the business of re-engineering public administration systems from end to end. They're not. In the case of individual electoral registration they have added a batch application system and left all the old manual practices in place.

Questions have been asked about this for three years, please see above. There were no answers three years ago and there were no answers yesterday, please see alongside. And nothing in between. Transformation, which is what is needed and promised, is beyond them.

Individual Electoral Registration = national identity register

Individual Electoral Registration (IER) came into force in England and Wales yesterday, Tuesday 10 June 2014. DMossEsq's millions of readers have known about it for ages ...
... and a few other people may have seen Rt Hon Greg Clark MP's press release yesterday, Register to vote: new online service launched.

Mr Clark is a Minister of State at the Cabinet Office and he says that:
IER will prevent fraud by enabling government to check that everyone on the register is who they say they are. This will lead to greater trust in the legitimacy and fairness of elections.
"Prevent fraud"? That's a tall order.

"Check that everyone on the register is who they say they are"? We've always been told that we need the Government Digital Service's (GDS) identity assurance service (IDA) for that. IDA still doesn't exist. GDS just can't hack it. It's beyond them. What we've got instead is a second rate check – against the Department for Work and Pensions National Insurance number database. That's the database that included nine million people no-one could account for back in April 2007, Fraud fear as millions of NI numbers are lost – so much for identity assurance:
The nine million numbers were issued by the Department for Work and Pensions (DWP) and are registered on its database, but officials do not know if they are held legitimately.
"This will lead to greater trust"? Mr Clark may prove to be right. Or wrong.

Friday 6 June 2014

Whitehall on top of the cloud


Cloud computing:
"you're relinquishing a lot of control to this system"
Mike Neil, Windows Azure general manager

Anyone read The Fear Index by Robert Harris? DMossEsq has, and it's jolly exciting – "nothing spreads like fear".

It's all about an algorithm called VIXAL-4 that "learns" how to exploit its environment and ensures its survival by disarming its competitors.

VIXAL-4 was written by a physicist at CERN. He gets thrown out of CERN because his work is too dangerous so he sets up a hedge fund. Armed with huge amounts of historical price data and a real-time web-based surveillance system, VIXAL-4 cleans up in the global securities markets.

The hedge fund's compliance officer is a bit of a threat, so VIXAL-4 gets rid of him. The major threat is VIXAL-4's own author, the ex-CERN physicist. He powers down two gigantic data centres to try to stop VIXAL-4 but, would you believe it, there's obviously another data centre somewhere because the physicist ends up looking like nothing more than a psychopathic pyromaniac, while VIXAL-4 sails on unopposed.

Great fun, but quite unrealistic, of course.

Or is it?

Anyone read Inside Microsoft's Autopilot: Nadella's secret cloud weapon by Jack Clark? DMossEsq has, and it's jolly exciting – "Redmond man spills the beans on Microsoft's top-secret software".

You should know that Satya Nadella is the newish CEO of Microsoft ...
Most recently, Nadella was executive vice president of Microsoft’s Cloud and Enterprise group. In this role he led the transformation to the cloud infrastructure and services business, which outperformed the market and took share from competition.
... and that he sees Microsoft's future in the cloud, Satya Nadella: Mobile First, Cloud First Press Briefing, that's the strategy. Microsoft's cloud offering is Windows Azure. Microsoft aren't the biggest cloud operators. That distinction goes to Amazon Web Services. Then there's Google. And some others.

While he was executive vice president of Microsoft’s Cloud and Enterprise group, Nadella oversaw the development of VIXAL-4 Autopilot.

Now, back to Jack Clark's article: "Autopilot is the system that lets Microsoft knit together millions of servers and hundreds and hundreds of petabytes of data into a great, humming lake of compute and storage capacity".

Autopilot: the first software the servers in this ITPAC
will meet when they arrive at a Microsoft data center
Not sure about humming lakes, but you need to understand the sheer scale of Microsoft's cloud operation. The unit they work in is the ITPAC. An ITPAC is 10,000 servers. The picture alongside shows an ITPAC being delivered to a data centre – another 10,000 servers to knit into the humming lake. That's what the cloud is all about.

"Microsoft rarely talks publicly about Autopilot", but Mike Neil, Windows Azure general manager, did talk to Jack Clark:
"Autopilot software now completely automates the entire server operational lifecycle, from power on and OS installation, to fault detection and repair, to power cycling and vendor RMA," explains Microsoft. "The [Autopilot] team can take a bow for a quietly effective operation that has profoundly transformed Internet-scale services at Microsoft."

It also helps assign resources to applications, schedule when jobs should run, gathers information from millions of computers to give up-to-the-minute capacity utilization information, and forms the underlay of other even more-secret technologies, such as the exabyte-scale COSMOS data analysis engine that sits beneath services such as Bing, Xbox Live, and Windows Azure ...

If a server fails, then Autopilot has a "self-healing" capability that can prevent a cluster-scale brownout, he said. "Things are going to fail all the time – Autopilot can take remediation actions for you to address failures. There's a bunch of auto-healing autonomic behavior in the system ...
And then there's the bit Robert Harris would like:
And just like systems in use at Google (Borg and its successor Omega), and Twitter (Mesos), Autopilot's complexity makes it behave more like a skilled yet uncommunicative colleague than a [subservient] system.

"The thing you have to get comfortable with is you're relinquishing a lot of control to this system and allowing it to do the right thing for you, and trusting it – it may take steps you don't know about," Neil says. "These systems are so large that no one person is keeping track. That's what the system is designed to do – take care of the details."
It's big. It's complex. No-one knows how it works. The algorithms do – Autopilot and COSMOS – but not the humans, "it may take steps you don't know about ... no one person is keeping track". Stick your data and your applications in the cloud and you lose control of them, "you're relinquishing a lot of control to this system".

That's how Microsoft see it. And no doubt Amazon and Google. Meanwhile, back at CERN the Cabinet Office, we have the delightful G-Cloud team, welcoming central and local government punters into this new world of the cloud. Nothing to be afraid of, not even a "cluster-scale brownout", what could possibly go wrong? With "auto-healing autonomic behavior in the system", nothing. You think you're still in control? In the cloud? Of course you are.

----------

Updated 7.6.14

Jack Clark has kindly contacted the DMossEsq news desk to confirm that, for the avoidance of doubt, Microsoft are not alone. Google also has an inscrutable algorithm managing its worldwide estate of servers. They used to use one called Borg. Now it looks as though they're using Omega. And Omega is showing signs of life – "Omega tech just like LIVING thing".

Microsoft, Google and others all confirm that, at the kind of scale they're operating, chaos can emerge from orderly, deterministic processes. They know that. The UK's G-Cloud team should also know that. But somehow their invitation to central and local government departments to ascend into the cloud omits any mention of the resulting loss of control.

Updated 8.6.14

There's a lot of marketing going on for the cloud, luring people and organisations into dependence. Here's a Microsoft example, culled from the Spectatorthe cloud + big data will cure cancer. Just remember David Spiegelhalter's opinion on the matter: "complete bollocks ... absolute nonsense". Still, what does he know about it? Believe the marketing if you will. He's only the Professor of the Public Understanding of Risk at Cambridge university:

Can you face another one?

Another professor, that is.

John Naughton is professor of the public understanding of technology at the Open University. Writing in the Observer today, We're all being mined for data – but who are the real winners?, he says:
Another disturbing thing about the big data bandwagon is its implicit epistemology, which could be crudely summarised by modifying the old Klondike slogan: "There's truth in them thar data". What it boils down to is a naive conviction that the more data you have, the closer you will get to the truth. No more relying on small, potentially unrepresentative samples and misleading averages. Instead the plain, unvarnished truth. This "truth" however, comes in the form of correlations: the discovery, for example, that influenza outbreaks go hand in hand with certain kinds of Google searches. Never mind that Google doesn't know anything about what causes flu. So the knowledge that comes from big data is generally an inference that two things are related, not knowledge of why they might be related. (Or not, as the case may be: it turns out that Google's brief foray into epidemiology came unstuck. A new outbreak of the disease had the search engine completely foxed.)

... In the end, the crippled epistemology of the big data movement may prove to be our biggest problem ...
"Naïve conviction" and "crippled epistemology" are not votes of confidence.


Updated 7.9.16

You remember, please see above, how Azure, Microsoft's cloud service, is controlled by the Autopilot and COSMOS algorithms but not by humans, it may take steps you don't know about, no one person is keeping track, stick your data and your applications in the cloud and you lose control of them, you're relinquishing a lot of control to this system, at the kind of scale they're operating chaos can emerge from orderly, deterministic processes ...?

Well good news. MoD gets top billing as Microsoft Cloud makes UK debut:
The Ministry of Defence (MoD) has become one of Microsoft’s standout public sector reference sites for its Office 365 and Azure services as the Microsoft Cloud opens today ...

Microsoft's secure and transparent cloud service in the UK fits perfectly with the MOD's digital transformation agenda ...

... the MoD has been able to push Microsoft at the highest levels to deliver. For example, providing asynchronous cloud for service delivery on submarines ...

Microsoft is also targeting other parts of the public sector for Office 365 and Azure, notably the NHS and local authorities, for digital transformation ...

Whitehall on top of the cloud


Cloud computing:
"you're relinquishing a lot of control to this system"
Mike Neil, Windows Azure general manager

Anyone read The Fear Index by Robert Harris? DMossEsq has, and it's jolly exciting – "nothing spreads like fear".

It's all about an algorithm called VIXAL-4 that "learns" how to exploit its environment and ensures its survival by disarming its competitors.

VIXAL-4 was written by a physicist at CERN. He gets thrown out of CERN because his work is too dangerous so he sets up a hedge fund. Armed with huge amounts of historical price data and a real-time web-based surveillance system, VIXAL-4 cleans up in the global securities markets.

The hedge fund's compliance officer is a bit of a threat, so VIXAL-4 gets rid of him. The major threat is VIXAL-4's own author, the ex-CERN physicist. He powers down two gigantic data centres to try to stop VIXAL-4 but, would you believe it, there's obviously another data centre somewhere because the physicist ends up looking like nothing more than a psychopathic pyromaniac, while VIXAL-4 sails on unopposed.

Great fun, but quite unrealistic, of course.

Or is it?

Wednesday 28 May 2014

David Gauke MP and the UK's tax revolution 2


This is turning into a slow-motion political train wreck,
with the care.data scandal
and the revelation
that the hospital episode statistics data sold to numerous companies
contained patient postcodes and dates of birth,
so the anonymity claims were simply false.

UK government departments and their agents store reams of personal information about us. They have to, to do their job.

That data is kept confidential. There are certain uses to which it can legitimately be put. Beyond that – verboten.

There are always poachers circling the game reserve. Most recently, it was Stephan Shakespeare. Then Tim Kelsey. And then David Gauke.

They all want to make more personal data available to researchers or entrepreneurs, to improve policy-making, to improve administration, to stimulate growth in the economy or to make medical break-throughs.

It is questionable whether any of those objectives would be achieved.

Stephan Shakespeare
An Independent Review of Public Sector Information
May 2013

Recommendation 2

...

Detail:

i) We should define 'National Core Reference Data' as the most important data held by each government department and other publicly funded bodies ...

ii) Every government department and other publicly funded bodies should make an immediate commitment to publish their Core Reference Data ...

iii) Alongside this high-quality core data, departments and other public sector bodies should commit to publishing all their datasets (in anonymised form) ...

(pp.11-2)

----------

Tim Kelsey
Long live the database state
July 2009

If the next government, of whichever party, wants a better public sector it must encourage more use of personal data; not less. What should be done? Data sharing must be made easier, first by removing the legislative obstacles to sharing government databases. The government should also pledge to publish as much new anonymised data as possible ...

----------

David Gauke
HM Revenue & Customs
Sharing and publishing data for public benefit – Consultation document
July 2013

Q3 Do you agree that HMRC should be able to share anonymised individual level data for the purposes of research and analysis to deliver public benefits wider than HMRC’s own functions? Please give reasons for your answer.

Q4 Do you agree with the proposed safeguards on the proposal to share anonymised individual level data? Should any further controls be considered on what can be shared, with whom or how?

Q5 How should the generation and release of anonymised or aggregated data be funded? Please give reasons for your answer.

(p.27)
Even if the case for releasing more personal data could be made, there remains the problem of privacy/confidentiality. And Messrs Shakespeare, Kelsey and Gauke all offer the same safeguard – anonymisation.

If the research data is anonymised, then people can't be identified, so their privacy isn't breached, no confidence has been broken. True? Or false? Does anonymisation work? Is your privacy safeguarded by it?

The answer isn't clear.

Messrs Shakespeare and Gauke both recognise that it isn't easy to anonymise people's personal data. You can remove all sorts of details from a file of research data in the name of anonymisation, and yet the data subject can still be identified by cross-referencing what's left against other files.

They both cite work done by the Administrative Data Taskforce to improve the reliability of anonymisation. Mr Shakespeare tells us that the Information Commissioner's Office is working on the same problem and so is the Office for National Statistics.

But are they getting anywhere? Or can your identity still be deduced by cross-referring anonymised data against other files?

Professor Martyn Thomas sounded a note of caution when he gave evidence to the House of Commons Science and Technology Committee a year ago on 5 June 2013. "Anonymised research data" is an oxymoron, he said. If the data has really been anonymised, then it's no use for research and if it is useful for research, then it can't have been anonymised.

Then last month, on 4 April 2014, Professor Ross Anderson gave a lecture to the Open Data Institute (ODI) entitled Why anonymity fails. The ODI are obviously convinced by his arguments and describe the current travails of Tim Kelsey's care.data as a "slow-motion political train wreck".

So does anonymisation work or doesn't it?

Article 29 of the European data protection directive (95/46/EC) establishes a working party to monitor and update the directive. They published an opinion on 10 April 2014 (hat tip: Pinsent Masons).

Yes, anonymisation does work, says the working party ...
The Opinion concludes that anonymisation techniques can provide privacy guarantees and may be used to generate efficient anonymisation processes ...
... although it's still risky ...
Finally, data controllers should consider that an anonymised dataset can still present residual risks to data subjects.
... and even if it does work at one point, it can stop working later:
... anonymisation should not be regarded as a one-off exercise and the attending risks should be reassessed regularly by data controllers.
No doubt the Administrative Data Taskforce, the Information Commissioner's Office and the Office for National Statistics have done all sorts of good work. Nevertheless, when you hear the gung-ho Messrs Shakespeare, Kelsey and Gauke or anyone else assuring us that our anonymised personal data can be safely released for research without identifying us, unless you enjoy train crashes it's best to listen sceptically.

David Gauke MP and the UK's tax revolution 2


This is turning into a slow-motion political train wreck,
with the care.data scandal
and the revelation
that the hospital episode statistics data sold to numerous companies
contained patient postcodes and dates of birth,
so the anonymity claims were simply false.

UK government departments and their agents store reams of personal information about us. They have to, to do their job.

That data is kept confidential. There are certain uses to which it can legitimately be put. Beyond that – verboten.

There are always poachers circling the game reserve. Most recently, it was Stephan Shakespeare. Then Tim Kelsey. And then David Gauke.

They all want to make more personal data available to researchers or entrepreneurs, to improve policy-making, to improve administration, to stimulate growth in the economy or to make medical break-throughs.

It is questionable whether any of those objectives would be achieved.

Sunday 25 May 2014

The non-existent personal-data control-shift

DMossEsq's millions of readers may have got the wrong impression of Ctrl-Shift – "The opportunities for organisations arising from a new personal information economy are game changing. Ctrl-Shift is the world’s leading market analyst and consulting business helping organisations to capitalise on these opportunities".

Control shift
Ctrl-Shift have the Department for Business Innovation and Skills (BIS) as a client, among others.

They have an encyclopaedic knowledge of the apps market: "Tallyzoo, a service dedicated to self monitoring, allows users to measure anything from their caffeine intake to the number of times they cut their grass".

They have a social scientist's grasp of psychology: "There is further investment in the quantified self space as Canadian company Retrofit announces $8 million in new funding ...".

They have an admirably unquenchable belief that they are expert in modern marketing techniques: "Users collect data using a mobile device or website program which creates interactive flashbased graphs enabling them to spot trends and patterns in their consumption habits, work, health and fitness goals".

And they promote economic theories which DMossEsq has been unkind enough to label "mooncalf economics" but perhaps it's better simply to refer to them as hypothetical: "Ctrl-Shift’s research finds that the market for these new streams of information [caffeine intake, mowing the lawn, that kind of thing] could grow to be worth £20bn in the UK over the next ten years".

But their output isn't all ditzy. Sometimes Ctrl-Shift write something recognisably tethered to the planet. To wit, Trust frameworks: harnessing trust in an information economy.

Trust frameworks
They are addressing the concerns raised about massive data-sharing. The sort of data-sharing that Francis "JFDI" Maude is promoting and Stephan Shakespeare and Tim Kelsey. The sort of data-sharing that supports Google, Facebook and others in a lavish life-style. The sort of data-sharing that destroys privacy and which can lead to identity fraud.

People don't like it. We put up with it. Sometimes there's no alternative – if you want to buy an airline ticket you just have to hand over your passport number. Sometimes we even connive in it, not least because Google and Facebook, for example, are "free" as far as most of us are concerned. But we don't like it.

Better, Ctrl-Shift say, if the trade in personal data was conducted within "trust frameworks" where we could all keep our personal data under our control.

With their characteristic candour, Ctrl-Shift open the main body of their report by saying: "There are no agreed definitions of what a Trust Framework is or does". Trust frameworks, they say, are a bit like "Kitemarks, Codes of Practice and Standards".

The governing body of a trust framework needs to be able to enforce the code of practice that participants subscribe to. But how? Ctrl-Shift identify the problems. Among others, the failure of the Data Protection Act: "Interestingly none of the frameworks Ctrl-Shift has looked at so far base their enforcement/compliance measures on existing data protection regulations". But no solutions.

Enforcement costs money. How is it to be paid for? Everything is still up in the air. The best Ctrl-Shift can say is that "as the market develops we would expect to see a wider variety of commercial models being developed and deployed".

And that's it. For the moment, according to Ctrl-Shift, there are no effective trust frameworks to contain the trade in personal data. They remain undefined, the basis for enforcement is unknown and there's no settled way to pay for them. There's no reliable button to press, box to tick, handle to turn ... and out pops trust.

Mydex
All of which must come as a shock to Ctrl-Shift's sister company, Mydex: "Our mission is to empower individuals, to give them personal control over their personal data".

How can Mydex grant people control over their personal data? Through a trust framework. That's what they say: "The Mydex Trust Framework is a set of legal and technical rules by which members of a network agree to operate in order to achieve trust online".

And how can Mydex enforce the "set of legal and technical rules by which members of a network agree to operate"? They don't say.

Because they can't? That's the inference. Which undermines trust in Mydex's claim. The very trust the framework is meant to create.

Mydex is a member of tScheme, "the independent, industry-led, self-regulatory scheme set up to create strict assessment criteria, against which it will approve Trust Services", and they sometimes give the impression that they have been certified trustworthy by tScheme, see for example midata – the service you can trust and RIP IDA – JFDI and the Black Pencil. But they haven't been certified. They haven't even applied for certification.

That undermines trust not only in Mydex but also in midata, a BIS initiative which depends on Mydex. And it undermines trust in the Government Digital Service's identity assurance programme (IDA), which also depends on Mydex, as a so-called "identity provider".

This "empowerment" that Mydex are offering to "individuals". It's based on trust which doesn't exist. And it's based on enforcement that doesn't exist. So the empowerment doesn't exist. So the midata prospectus is a false prospectus and so is the IDA prospectus.

Some of us have been trying to tell Mydex that for years. The control shift Mydex offer is not in their gift and can't be delivered. Now Ctrl-Shift are telling them as well.

----------

Updated 28 May 2014

DMossEsq's copy of Ctrl-Shift's weekly Market Watch turned up yesterday. Always entertaining, you are enjoined to sign up for it.

Marketing experts vie with each other to devise the most guru-like epigram.

The competition is usually won by Peter Vander Auwera. Talking of the ocean of data now available, he once assured us that:
We are a species from the land that have to learn to live in the ocean. Like camels that used to live in the desert, that now have to survive in the ocean ...
There is a new contender, though, Hugo Pinto, who came up with this at Ctrl-Shift's recent Personal Information Economy summit:
The value exchange is the trust serum of the data driven economy.
Think about it.

Anyway, this is what Market Watch had on the menu yesterday:
  • Google acquires Divide, an app that separates personal and professional data on your phone - IBNLive
  • Banks trump government on public trust over personal data | Guardian Professional
  • Call for ‘privacy charter’ to protect personal data online - Computing
  • Your banker wants to know if you are pregnant - Forbes
  • Facebook in new privacy push - The Telegraph
  • Internet ‘Do Not Track’ system is in shatters - Computerworld
  • Looking for opportunity in smart devices? Start with the user - Forbes
  • Reading privacy policies lowers trust - Science Daily
  • The Internet of you - MIT Technology Review
  • Why companies should compete for your privacy - Harvard Business School
Note that third item, the call for a "privacy charter" to protect personal data on-line. We're still having to call for such a charter. It doesn't exist. This is serious. There is no trust framework for the personal information economy. As everyone including Ctrl-Shift keeps trying to tell Mydex.

Updated 9.6.14

The venue for the unveiling of Ctrl-Shift's report has at last been announced – KPMG, 15 Canada Square London E14 5GL, 9:00-16:15.

What will the bigwigs of KPMG, HRG, Atkins, Aurora, Bank of America, Lloyds, Barclays and NIST make of it?

Remember, "value exchange is the trust serum of the data driven economy", see above.

And what will they make of the Government Digital Service's 10-minute presentation on IDA, the non-existent identity assurance service?


Updated 12.8.14

The 7 August 2014 copy of Ctrl-Shift News arrives and this time it includes an interview with David Alexander, the CEO of Mydex.

Ctrl-Shift and Mydex are closely associated companies. David Alexander is pretty well interviewing himself. Not that you'd know it from the text.

Mydex is a new sort of company, he tells us, a community interest company (CIC), where individuals become the centre of the circles in which data about them moves, under their control. Actually, if you look at some of Mr Alexander's other presentations, what you see is Mydex at the centre, not the individual, but let that pass for the moment.

How do Mydex claim to empower individuals in this way? According to Mr Alexander, by providing a platform and a trust framework:
The CIC structure was the only way it could work from what we could see, it was all about Trust, everyone had to trust the platform, individuals and organisations. It had to take itself out of the game and create the place where it could all happen safely and securely. We felt this would create a halo of trust for the individual and everyone involved.
A "halo of trust"? He really should talk to Ctrl-Shift about that. There are no trust frameworks. That's what Ctrl-Shift said, see above. And certainly no halos of trust. And so there is no empowerment on offer.

It's not just Ctrl-Shift who believe that there's no such thing as a trust framework. Take a look at this:
Handing over competition sensitive, Personally Identifiable Information (PII), or related Intellectual Property information to a Cloud Provider is indeed an exercise in extreme trust without the ability to independently verify Cloud Provider coherence to purported security guarantees, controls, and associated contracts.

In 2014, in light of the CSA [the Cloud Security Alliance] assessment and analysis of threats to Cloud Providers [The Notorious Nine: Cloud Computing Top Threats in 2013], as well as governments’ perceived nefarious interactions with the telecommunications and data storage, social media, and search industries [see Edward Snowden passim]; it has become evident that blind trust in the service provider is a doomed strategy.
That's an extract from Cloud Insecurity and True Accountability, a primer for CIOs on Guardtime and Keyless Signature Infrastructure (KSI) for Attributed Networking written by Matthew C. Johnson, CTO of Guardtime.

Guardtime believe that "blind trust ... is a doomed strategy". Trust in your cloud services provider and all the related businesses involved in cloud computing can never be earned or awarded. So stop pretending that it can, they say, forget it. Instead, the best you can do is to use their keyless signature infrastructure products so that you and your suppliers will know that security has been breached – then you can try to do something about it.

Guardtime is an Estonian company. And, as we know, Estonia is our future.

Guardtime's products are being promoted by a consultancy called Rainmaker.

And Rainmaker, in turn, is being promoted by Chris Chant on the G-Cloud Twitter account:


Chris, of course, is the only begetter of G-Cloud, the UK government cloud initiative, and even though now retired, he keeps his hand in. The new head of G-Cloud, Tony Singleton, seems to be happy for Chris to promote Guardtime on @G_Cloud_UK and we must assume, therefore, that he supports the idea – the pursuit of trust frameworks is a wild goose chase, whether we're talking about G-Cloud, the PSN (public services network), IDA (the identity assurance service RIP), Mydex or midata.

David Alexander needs to think again. His halo is slipping.


Updated 12.11.14

Armed with his halo of trust, David Alexander, the CEO of Mydex CIC, accepted the invitation from the Open Data Institute (ODI) to write a guest post on the ODI's blog, Open data and personal data, context and consent.

The ODI want to make open data available to everyone, willy-nilly, whereas Mydex is committed to empowering people so that they can share their personal data with no-one except where they have freely given their informed consent.

So what contribution if any do the ODI and Mydex make to each other?

Mr Alexander argues that open data provides the context without which personal data has little meaning: "it's in the interaction with personal data that you often get the best out of open data – they are inextricably linked".

Can open data and personal data be "inextricably linked" without disempowering individuals? Can the halo of trust be kept in place?

Yes, says Mr Alexander:
This personal empowerment can be utterly transformative in public service provision and many other contexts. Equipped with their own personal data store, an individual is able to provide informed consent and share their data with whom they choose, safely and securely, under a legal and technically robust trust framework. And for service providers and developers the interchange can help drive insight, reduce costs, improve data accuracy and build better engagement over time.
But as his close colleagues at Ctrl-Shift can tell him, there is no such thing as a "legal and technically robust trust framework".

So no.


Updated 14.11.14

Probably about time to look at an example of a putative trust framework.

"Today we’re publishing two posts that explain what we’re doing to protect users' privacy when they use GOV.UK Verify", said the lovely Janet Hughes the other day.

One of those posts is How the GOV.UK Verify technical architecture protects users’ privacy, and why it’s appropriate. It promises much but the response to the questions raised in the Comments section is disappointing. Anyone asking how the technical architecture of GOV.UK Verify (previously IDA, GDS's identity assurance scheme) protects users' privacy is told that this is the wrong place to answer.

The other post is Protecting privacy in GOV.UK Verify where we are reminded by one of its members that the hard-working and independent Privacy and Consumer Advisory Group (PCAG) published its first draft identity assurance principles back in June 2013. Nothing much has been heard about them since then.

PCAG have now published an update, version 3.1, in which they set out their trust and control and anti-fraud and security objectives and say:
To deliver these objectives there has to be a framework that gives real meaning to terms such as “individual privacy” and “individual control”. Such a framework is set out in the nine Identity Assurance Principles contained in this document: these Principles have been developed by the independent Privacy and Consumer Advisory Group (PCAG), including open public consultation on earlier working drafts.
So here at last is our example of a trust framework. In summary, it looks like this:
Identity Assurance Principle
Summary of the control afforded to an individual
1. User Control
I can exercise control over identity assurance activities affecting me and these can only take place if I consent or approve them
2. Transparency
Identity assurance can only take place in ways I understand and when I am fully informed
3. Multiplicity
I can use and choose as many different identifiers or identity providers as I want to
4. Data Minimisation
My interactions only use the minimum data necessary to meet my needs
5. Data Quality
I choose when to update my records
6. Service User Access and Portability
I have to be provided with copies of all of my data on request; I can move / remove my data whenever I want
7. Certification
I can have confidence in the Identity Assurance Service because all the participants have to be certified against common governance requirements
8. Dispute Resolution
If I have a dispute, I can go to an independent Third Party for a resolution
9. Exceptional Circumstances
I know that any exception has to be approved by Parliament and is subject to independent scrutiny
Ctrl-Shift predict that this framework can't work, remember – there's no way to enforce it and no money to pay for it even if enforcement was possible.

Are Ctrl-Shift right?
  • Anyone signing up to GOV.UK Verify can have no idea whether exceptions to the principles need to be approved by Parliament (#9).
  • There is no privacy ombudsman and so #8 is being flouted.
  • #7 is an odd one. The fact that governance requirements might be common to all participants is not the point. The requirements need to be confidence-inspiring, not common. They might be common but fail to protect privacy. And the certification authority needs to be independent – there are were some probably unfounded doubts about the independence of tScheme.
  • GDS have made no statement about portability or deletion (#6) ...
  • ... nor about updating your records (#5).
  • What is the minimum amount of data necessary for your interactions with public services? Who decided that? No-one's told you, have they (#4).
  • The more "identity providers" you use, the more it costs GDS. They are already trying to limit your choice. Budget constraints don't disappear by magic (#3).
  • Take a look at the video presentation of the Post Office's registration process for GOV.UK Verify. No attempt whatever is made to explain to the user what they are giving their permission for. The user can't understand and is not fully informed. What's more, their consent is not given freely. What choice is there? Either grant consent like a blank cheque or withhold it and go without benefits (#2).
  • Having once given your consent, what control do you have over the way your data is used? To judge by the presentation, none. It may be shared with anyone (#1).
Yes, Ctrl-Shift are right.


Updated 19.11.14

What does diplomacy look like?

The author of Protecting privacy in GOV.UK Verify referred to above has just published a thoughtful and authoritative reflection on Privacy Seals and Privacy Snake Oil.

"One of the constant problems of privacy is knowing who to trust with your data", he says, "... it's only a matter of time before some bright spark suggests 'maybe we could have a privacy seal to prove we're trustworthy?' ... The problem is, it just doesn't work".

"There are a number of privacy seal schemes out there, but the majority are US-centric", he goes on, "... there are some significant potential downsides to privacy seals ... Firstly, the scheme can only be as good as its underlying standards ... Secondly, the schemes use different approaches to certification. [Some] are ... independently assessed by experts .., whereas the entry point for many other schemes is self-certification ... Thirdly ... is the ability of schemes to monitor and police their members. If you are a scheme operator, dependent upon your members for your income, then the last thing you want to do is to suspend a high-profile member ... or to strike off a member for proven poor privacy practices".

He barely mentions the UK, except to point out that "the [Federal Trade Commission] takes this stuff seriously, and has enforcement powers beyond the UK [Information Commissioner's Office]'s wildest dreams". And he doesn't mention the Government Digital Service once. Nor their identity assurance programme (IDA) and GOV.UK Verify. Nor tScheme. Nor even snake oil.


Updated 15.2.15

February 2015, and Mydex have delivered themselves of another white paper in their series of sales literature, this time The opportunity of attribute exchange – Your data, your way.

Personal data stores (PDSs) are still the answer, whatever the question. Mydex continue to offer security on the web when everyone knows that that is not available. And they continue to promote their trust framework when even their cousins Control-Shift can tell them that there is no such thing. There has been only one change – the halo of trust has become a ladder:
Evidence is accumulated from each organisation that connects to an individual’s PDS. This builds up a 'proof of claim', a trusted confirmation of a fact about themselves or their lives. They can gradually 'climb up a ladder' of trust and certainty about their identity online reaching a higher and higher level of identity assurance. (p.8)
Mydex's claim in this white paper is that everyone would benefit if we individuals maintained a collection of digital certificates in our PDSs, issued by the relevant authorities, certifying that we have certain attributes.

We might for example need confirmation issued by the Department for Work and Pensions that we are on Income Support in order to prove our entitlement to free National Health Service prescriptions. In this example, DWP would issue a digital IsOnIncomeSupport certificate which you would store in your PDS and which a pharmacy could access to check that you don't have to pay for your prescriptions.

That all seems very convenient. No sending photocopies through the post, no hanging on the telephone waiting for the call centre to answer, just a single port of call, a single source of truth – the Mydex PDS – and you're out of the shop, armed with your antibiotics, having paid nothing.

How does the pharmacist know that the certificate was issued by DWP? Or that it was issued to you? How does Mydex know that this is a pharmacist making the enquiry? How does the pharmacist know that that's Mydex on the other end of the enquiry and not a spoof site?

There may be answers to these questions. Mydex don't tell us what they are. We must just leave those sales questions hanging for the moment.

There is one question we can pursue a bit further.

Your situation may change. You may be on Income Support one month but off it the next. And then back on, a few months later. DWP must, in Mydex's world, issue a new digital certificate each time and revoke the previous one – IsOnIncomeSupport as at February 2015 may have to be revoked and replaced with IsNotOnIncomeSupport as at March 2015.

But will IsOnIncomeSupport be replaced in your PDS? That's up to you, according to Mydex:
If the connecting organisation or the individual, changes a piece of information, this gets automatically updated in the individual's PDS, based on their preferences and consent. (p.11)
That's no good to the pharmacist. Just because there's an IsOnIncomeSupport certificate in your PDS doesn't prove that you're entitled to free drugs. The certificate may have been revoked by DWP since it was issued because your circumstances have changed. But you may have withheld consent to update your PDS.

So the pharmacist needs to seek confirmation from DWP themselves. Your PDS isn't good enough and drops out of the attribute exchange procedure.

Either that, or the revoked certificate is removed from your PDS whether you consent or not – the data in your PDS isn't under your control. Whereas Mydex say it is. They can't have it both ways.


Updated 17.2.15

The video has been published now of highlights of the debate about attribute exchange hosted on 4 February 2015 by theInformationDaily.com and sponsored by Mydex. Apparently, Attribute exchange could unlock billions of public sector savings.

No case is made to support this contention.

At 17'11" David Alexander, the CEO of Mydex, the sponsors, asserts that attribute exchange will cause transaction costs to drop by anywhere between 45% and 95%.

But what is included in "transaction costs"? Who will be made redundant to pay for the rosy future he paints of "improved social outcomes" and "streamlined public services" all "under your control"?

He doesn't say. Viewers have no idea as a result how these billions of savings are to be "unlocked".

Once again, the basis of control over people's personal information such that we can give our informed consent to share data, or alternatively withhold our permission, is supposed to be the Mydex trust framework.

And once again, the warnings of Mydex's sister company Ctrl-Shift to the effect that there is no such thing as a trust framework are ignored. The claim that Mydex can grant you control over your personal data once it's in a personal data store is false. It is not in Mydex's power to grant.

The assembled company were all confident that the Government Digital Service's identity assurance scheme, GOV.UK Verify, works:
  • Why? To what extent has it been tested that GOV.UK Verify proves that you are who you say you are on-line?
  • How is GOV.UK Verify proof against hacking in a way that no other on-line system seems to be?
  • How can it be sensible to rely on a single GOV.UK Verify credential to open access to all the on-line services you use?
  • Who is liable when GOV.UK Verify security is breached and your bank account is emptied or your benefits are paid to someone else?
  • What happens to the millions of people who can't register with GOV.UK Verify? What's to stop them just becoming excluded by default from public services?
No answers were given during the debate. But then the questions weren't asked. Where does the confidence come from?

A number of participants in the debate referred to "single customer records" and "personal data stores". To a certain bureaucratic mentality it is obviously attractive to have everything in one place. All your attributes, represented by digital certificates, stored in one record.

But attributes change, digital certificates are revoked and new ones issued to replace them.

If users have control over their data, they can withhold permission to update their personal data store when a certificate is revoked. Which means that the service provider can't rely on the personal data store or single customer record being up to date.

Service providers have to go back to the original certification authority to check whether a certificate has been revoked to be sure about your attributes. The "single source of truth" is a will o' the wisp. Stop chasing it.


Updated 17.5.17

As the millions of DMossEsq's readers know, Ctrl-Shift and its sister company, Mydex, want us all to store our personal information in personal data stores (PDSs), where apps can process it and advise us how best to live our lives.

The millions also know that Ctrl-Shift/Mydex promise everyone that PDSs will allow us to control access to our personal information.


"Our personal data is being manipulated for political gain – we need to take control of it", said a scandalised Liz Brandt in the Daily Telegraph newspaper yesterday.

Ms Brandt is the chief executive officer of Ctrl-Shift and she is horrified that a company called Cambridge Analytica is hired by administrations all over the world to try to influence people's opinion.


It's not clear why she's so upset. Ctrl-Shift and Mydex are in the same business of trying to influence people.

"While the likes of Facebook are doing their best to fight fake news", says Ms Brandt, "social media sites should be forced to gain users' explicit consent for the types of data they collect and share, as well as who they intend to share it with and why".

That rather lets the cat out of the bag.

Keeping control of your personal information requires a lot more than a PDS. The control that Ctrl-Shift and Mydex offer is not in their gift.

Facebook is normally regarded as one of the plunderers of personal information. For example, it is only yesterday that the Dutch data protection authority published a paper on how Facebook violates the law. Actually it's not just the Dutch but the French, the Spanish, the Germans and the Belgians, too.

That's how Facebook makes its billions. By taking people's personal information and selling it to advertisers and anyone else who will pay for it. There's no mystery. Everyone knows that and yet there's Ms Brandt trying to distinguish good Facebook ("doing their best to fight fake news") from bad social media (who "should be forced to gain users' explicit consent ..."). Ctrl-Shift even quote Facebook approvingly on the home page of their website.


Mercifully the Dutch, the French, the Spanish, the Germans and the Belgians are having none of that but what's got into Ctrl-Shift and Mydex? Is this a case of if-you-can't-beat-'em-join-'em?

Ctrl-Shift and Mydex are not quite alone. The Government Digital Service (GDS) also regard Facebook as the solution. Unlike the Dutch, the French, the Spanish, the Germans and the Belgians, who regard Facebook as the problem.

Trust and privacy: learning from business, said James Stewart of GDS, "Stephen Deadman, Deputy Global Chief Privacy Officer at Facebook, welcomed us for a talk and Q&A ... Having come across the work Stephen’s team are doing to explore attitudes and opportunities around privacy, I was keen to explore what government can learn from their work". Mr Stewart has subsequently left GDS – next time, take a longer spoon.

GDS are famously unreliable when it comes to the control of personal information. Now Ctrl-Shift and Mydex are, too.

The non-existent personal-data control-shift

DMossEsq's millions of readers may have got the wrong impression of Ctrl-Shift – "The opportunities for organisations arising from a new personal information economy are game changing. Ctrl-Shift is the world’s leading market analyst and consulting business helping organisations to capitalise on these opportunities".