@gdsteam, the first casualty of war

Here's a selection of GDS posts and a film in the week leading up to purdah:

24-03-2015	Janet Hughes	Introducing GOV.UK Verify
25-03-2015	Chris Mitchell	Ready for Live: Digital Self-Assessment
25-03-2015	Janet Hughes	Procurement 2: New identity suppliers to join GOV.UK Verify
25-03-2015	Janet Hughes	GOV.UK Verify and Mydex CIC
26-03-2015	Janet Hughes and Stephen Dunn	GOV.UK Verify: Objectives for live
26-03-2015	Mike Bracken	It’s people who make transformation happen
27-03-2015	David Rennie	Working with the private sector to verify identity
27-03-2015	Mike Bracken	Turning the tanker: digital transformation done right
27-03-2015	Mike Beavan	Looking back at the exemplars
28-03-2015	Mike Bracken	Not the HMRC of old
28-03-2015	Mike Bracken	Data as a public asset
29-03-2015	Mike Bracken	Government as a Platform: the next phase of digital transformation
29-03-2015	Liam Maxwell	Better for less
30-03-2015	Martha Lane Fox	The Richard Dimbleby Lecture (text) (text) (text)

Six-fourteenths of our way through the review of the pre-purdah posts, and a surprising theme is developing.

Misleading
We noted in our review of Chris Mitchell's 25 March 2015 offering, Ready for Live: Digital Self-Assessment, that the Government Digital Service (GDS) were potentially misleading the public.

They claimed that their work, in connection with UK tax returns, "will make self-assessment fully digital for about 10 million people". In fact, digital self-assessment has been available from Her Majesty's Revenue and Customs (HMRC) since at least 31 January 2008, long before GDS existed.

Far from creating the digital self-assessment service – which is the impression given – all that GDS did was to add an email facility which cuts out some of the letters which have previously been sent.

"Perhaps GDS simply didn't notice the ambiguity", you may say.

But they did. We know that from the Service Assessment which was conducted by GDS and published on their blog on 21 March 2014, over a year ago:

... the assessment team did agree that the service in its current form is a feature of “Your tax account”, rather than a service in its own right.

It looks as though GDS have knowingly allowed their potentially misleading reports to persist for over a year.

Deceptive
We noted in our review of Mike Beavan's 27 March 2015 offering, Looking back at the exemplars, that there is some deception when it comes to how many of GDS's 25 exemplar services are live. Figures vary between 8 and 20. Which is it?

"It's only DMossEsq who finds this deceptive", you may say.

Not so. Look at the comments on Mr Beavan's post:

Peter — 02/04/2015 Hi Mike [Beavan], this blog says: "Of the 25 services, 20 are publicly accessible. Fifteen of those are fully live and the rest are in beta " I've clicked through the services and of the 15 that are stated as "fully live". 5 seem to be in public Beta whilst one, digital self-assessment, appears to only be a redirect page. List below: + Visas + Make a claim to an Employment Tribunal + Find an apprenticeship + Digital self-assessment + PAYE + Your tax account Could you clarify what is meant by "fully live"? Thanks

There follows 10 days of deceitful-looking prevarication in the comments section of the blog about the meaning of "live" and a questionable claim that GDS's hands are tied during purdah ... but no satisfactory answer to Peter's question.

Social media house rules
GDS say:

We will block and/or report users on Twitter who direct tweets at us which we believe are: Abusive or obscene Deceptive or misleading In violation of any intellectual property rights In violation of any law or regulation Spam (persistent negative and/or abusive tweeting in which the aim is to provoke a response)

Presumably what applies to Twitter applies just as much to GDS blogs. And presumably what applies to users applies just as much to GDS themselves. Including rule #2 above, about being "deceptive or misleading".

And now, on with the review – eight more items to go.

@gdsteam, the first casualty of war

Here's a selection of GDS posts and a film in the week leading up to purdah:

24-03-2015	Janet Hughes	Introducing GOV.UK Verify
25-03-2015	Chris Mitchell	Ready for Live: Digital Self-Assessment
25-03-2015	Janet Hughes	Procurement 2: New identity suppliers to join GOV.UK Verify
25-03-2015	Janet Hughes	GOV.UK Verify and Mydex CIC
26-03-2015	Janet Hughes and Stephen Dunn	GOV.UK Verify: Objectives for live
26-03-2015	Mike Bracken	It’s people who make transformation happen
27-03-2015	David Rennie	Working with the private sector to verify identity
27-03-2015	Mike Bracken	Turning the tanker: digital transformation done right
27-03-2015	Mike Beavan	Looking back at the exemplars
28-03-2015	Mike Bracken	Not the HMRC of old
28-03-2015	Mike Bracken	Data as a public asset
29-03-2015	Mike Bracken	Government as a Platform: the next phase of digital transformation
29-03-2015	Liam Maxwell	Better for less
30-03-2015	Martha Lane Fox	The Richard Dimbleby Lecture (text) (text) (text)

Six-fourteenths of our way through the review of the pre-purdah posts, and a surprising theme is developing.

RIP IDA – Mydex flies over the cuckoo's nest

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

Here's a selection of GDS posts and a film in the week leading up to purdah:

24-03-2015	Janet Hughes	Introducing GOV.UK Verify
25-03-2015	Chris Mitchell	Ready for Live: Digital Self-Assessment
25-03-2015	Janet Hughes	Procurement 2: New identity suppliers to join GOV.UK Verify
25-03-2015	Janet Hughes	GOV.UK Verify and Mydex CIC
26-03-2015	Janet Hughes and Stephen Dunn	GOV.UK Verify: Objectives for live
26-03-2015	Mike Bracken	It’s people who make transformation happen
27-03-2015	David Rennie	Working with the private sector to verify identity
27-03-2015	Mike Bracken	Turning the tanker: digital transformation done right
27-03-2015	Mike Beavan	Looking back at the exemplars
28-03-2015	Mike Bracken	Not the HMRC of old
28-03-2015	Mike Bracken	Data as a public asset
29-03-2015	Mike Bracken	Government as a Platform: the next phase of digital transformation
29-03-2015	Liam Maxwell	Better for less
30-03-2015	Martha Lane Fox	The Richard Dimbleby Lecture (text) (text) (text)

If there's a tricky job facing the Government Digital Service (GDS), or indeed an impossible job, what do they do? Call for Janet Hughes.

Let's take a look at her 25 March 2015 offering, GOV.UK Verify and Mydex CIC.

As we were saying, GDS have managed to appoint nine "identity providers" for the second phase of the GOV.UK Verify (RIP) obsequies.

Mydex Data Services Community Interest Company "will continue to work with the Identity Assurance Programme", Ms Hughes tells us. They will work not only on IDA but also with "the government more broadly". They will work "on the policy and delivery areas within specific areas of [their] expertise around verified attribute exchange and consent management for data sharing".

She goes on to say that Mydex have been "an important partner for GOV.UK Verify ... that partnership is ongoing and they are already an approved G-Cloud 6 supplier for their live ISO27001 certified services". Chris Ferguson, Director of the Identity Assurance Programme, is quoted as saying: "Mydex CIC has made a fantastic contribution to the development of GOV.UK Verify and we’ve greatly benefited from their input. We look forward to continuing to work with them through the OIX forum".

There's more where that came from: "Mydex CIC goals for citizens – the community they serve – remain aligned with HMG policy on respecting privacy and offering consent driven identity assurance and data sharing".

And more, but you get the picture – it's hard to overstate how marvellous Mydex are. The only thing is:

Mydex CIC will not be a certified company in the next framework for identity providers.

Why not?

No explanation is advanced. Did GDS refuse to have Mydex on board? Did Mydex refuse to join? We have no idea and there's no point guessing.

Mydex will not be "identity providers" to GOV.UK Verify (RIP) but Digidentity will. So will GB Group. And Morpho. How come? Why them, and not Mydex?

Ms Hughes's post is extraordinary. Nothing similar was written when Cassidian pulled out of the first framework agreement. Nor Ingeus. Nor PayPal. They're not worth memorialising but Mydex are? Why? And nothing similar has been written for all the organisations which applied to join the second framework and then didn't. Just Mydex. Why?

Why bother to write anything at all about Mydex not becoming an "identity provider"? Why bring attention to the matter? Who cares?

Clearly someone cares, for some reason, and that someone thinks that the non-appointment of Mydex needs to be written about. But who could possibly do the job? Only Janet Hughes. And she's succeeded. The perfect result has been achieved. The non-appointment has been documented and yet no-one (other than DMossEsq) is asking any questions in public. Well done, Janet.

The DMossEsq position, incidentally, is that it is commercially reckless for any organisation to get into the GOV.UK Verify (RIP) bed with GDS. In which case this is a good result for Mydex ...

... and a rotten result for the nine "identity providers" that have been appointed. They will look back with envy at Mydex's timely escape.

----------

Updated 21:41

@CyberSecKent It certainly does, apologies for omitting. — David Moss (@DMossEsq) April 19, 2015

RIP IDA – Mydex flies over the cuckoo's nest

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

Here's a selection of GDS posts and a film in the week leading up to purdah:

24-03-2015	Janet Hughes	Introducing GOV.UK Verify
25-03-2015	Chris Mitchell	Ready for Live: Digital Self-Assessment
25-03-2015	Janet Hughes	Procurement 2: New identity suppliers to join GOV.UK Verify
25-03-2015	Janet Hughes	GOV.UK Verify and Mydex CIC
26-03-2015	Janet Hughes and Stephen Dunn	GOV.UK Verify: Objectives for live
26-03-2015	Mike Bracken	It’s people who make transformation happen
27-03-2015	David Rennie	Working with the private sector to verify identity
27-03-2015	Mike Bracken	Turning the tanker: digital transformation done right
27-03-2015	Mike Beavan	Looking back at the exemplars
28-03-2015	Mike Bracken	Not the HMRC of old
28-03-2015	Mike Bracken	Data as a public asset
29-03-2015	Mike Bracken	Government as a Platform: the next phase of digital transformation
29-03-2015	Liam Maxwell	Better for less
30-03-2015	Martha Lane Fox	The Richard Dimbleby Lecture (text) (text) (text)

If there's a tricky job facing the Government Digital Service (GDS), or indeed an impossible job, what do they do? Call for Janet Hughes.

Let's take a look at her 25 March 2015 offering, GOV.UK Verify and Mydex CIC.

RIP IDA: Policy as a Dashboard (PaaD)

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

Here's a selection of GDS posts and a film in the week leading up to purdah:

24-03-2015	Janet Hughes	Introducing GOV.UK Verify
25-03-2015	Chris Mitchell	Ready for Live: Digital Self-Assessment
25-03-2015	Janet Hughes	Procurement 2: New identity suppliers to join GOV.UK Verify
25-03-2015	Janet Hughes	GOV.UK Verify and Mydex CIC
26-03-2015	Janet Hughes and Stephen Dunn	GOV.UK Verify: Objectives for live
26-03-2015	Mike Bracken	It’s people who make transformation happen
27-03-2015	David Rennie	Working with the private sector to verify identity
27-03-2015	Mike Bracken	Turning the tanker: digital transformation done right
27-03-2015	Mike Beavan	Looking back at the exemplars
28-03-2015	Mike Bracken	Not the HMRC of old
28-03-2015	Mike Bracken	Data as a public asset
29-03-2015	Mike Bracken	Government as a Platform: the next phase of digital transformation
29-03-2015	Liam Maxwell	Better for less
30-03-2015	Martha Lane Fox	The Richard Dimbleby Lecture (text) (text) (text)

Let's take a look at Janet Hughes's 25 March 2015 offering, New hopefuls join the cortège for GOV.UK Verify (RIP) ... something like that.

The Government Digital Service (GDS) have managed to appoint nine "identity providers" for the second phase of the GOV.UK Verify (RIP) obsequies. You could respond with the obvious objections yourselves.

But there is something new in Ms Hughes's post:

Procurement 2: New identity suppliers to join GOV.UK Verify We've completed our procurement exercise for a new framework for certified companies ...

Public Servant of the Year ex-Guardian man Mike Bracken CBE CDO CDO, executive director of GDS and senior responsible owner of the pan-government identity assurance programme now known as "GOV.UK Verify (RIP)", has strict rules for the vassals in his manor. "Be consistent, not uniform", for example.

You risk eternal damnation if you break these rules.

Not least in the case of: "Don't procure, commission".

What was Ms Hughes thinking of? Not only has she embarked on a procurement exercise, she admits (a) to having completed it and (b) to the fact that it's the second time – an open source of shame.

You may wonder what else she's supposed to do. How do you go about establishing an identity management scheme for 60 million Brits without doing a bit of procuring?

Shows how much you know.

In the new world of GDS you have to route round Whitehall. That's what Mr Bracken says. You have to change the organising principle of Whitehall. That's all there is to it. Don't argue, JFDI. Be agile. Don't let the law stand in your way. Think Estonia. Security is in the cloud and vice versa. Forget policy, make a dashboard. This is government as a platform. That's what the user needs. Write it on a Post-it® note and bake it into a cake. Because internet.

That is the superior wisdom. Now do you understand the error of Ms Hughes's ways?