Friday 12 June 2015

RIP IDA – Walter Mitty and the machinery of government

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

GOV.UK is the award-winning on-line face of government in the UK and, as Public Servant of the Year ex-Guardian man Mike Bracken CBE CDO CDO told us back in October 2012, "GOV.UK is not Government on the Internet, but of the Internet".

What does that mean?

It's all something to do with riots. That's what he told the Code for America Summit a year later in October 2013. GOV.UK is the only defence against a recurrence of riots in the streets of the UK.

And it's all something to do with what Tim O'Reilly has called "Government as a Platform" (GaaP).

Some academics disagree. Professor Mike Martin of Newcastle University Business School for example. He points out that GOV.UK is a website, and not a government. Mark Thompson on the other hand, a lecturer at the University of Cambridge's Judge Business School, reckons that if only we plot certainty against ubiquity, GaaP will come to power.

Whichever, Mr Bracken is in no doubt about the general election we have just enjoyed here in the UK: "It was great to see GOV.UK handle the change of government so smoothly".

That was back on 19 May 2015. Having handled the change of administration single-handed, what was in store now for digital government in the UK? The sense of ambition without limit was palpable. When the new government laid out its legislative programme in the Queen's Speech, would there be room for anything else, or would it be all about GOV.UK?

Twitter was all over the story ...


... and ...


... and:


The Conservative Party, who won the general election and formed the new government, had promised in their manifesto to protect children from pornography on the web. The Guardian newspaper article referred to in that last Tweet was written in the language of GOV.UK Verify (RIP). It seemed legitimate to suggest that the government would use GOV.UK Verify (RIP) to protect children.

Legitimate, but wrong, as the Government Digital Service (GDS) primly told us, GOV.UK Verify (RIP) can't help:


Who knew that GDS have a roadmap? They're not meant to. That's like having a policy – verboten.

In the event, against all expectations, the Queen's Speech didn't mention digital government once. These politicians. Useless. They simply don't understand.

Worse, the Prime Minister subsequently announced that "responsibility for the Digital Economy Unit will transfer from the Secretary of State for Business, Innovation and Skills to the Secretary of State for Culture, Media and Sport", for all the world as though digital is nothing but a branch of the entertainments industry, please see Machinery of Government changes: 1 June 2015.

While the nation mourned, hopes dashed, one journalist kept his head. Neil Merrett, mentioned in those Tweets above and long recommended by DMossEsq, read him early and read him often.

In GOV.UK Verify (RIP) potential in focus as private sector talks begin Mr Merrett tells us that "the Cabinet Office is understood to have brought forward talks on identity assurance with private sector internet service providers, raising the possibility of an expanded remit for its GOV.UK Verify (RIP) platform to include online services such as adult content sites".

And the upshot of those talks? Apologies for the long quotation but it does make the point, repeatedly, that GOV.UK Verify (RIP) is too little, too late:
Ultimately, it is thought that the government's ID assurance platform may not be at an advanced enough stage to be useful to current market demands and the needs of internet service providers for a cost effective, intuitive and anonymised service.

... key industry figures working online in areas such as the adult entertainment industry say that rather than waiting for government to fully develop its in-house ID assurance solution, the private sector is already searching for and - in some cases - implementing solutions to tackle a changing landscape for identify and age restrictions.

... having spoken with the Cabinet Office around ID assurance and potential support, he [Chris Ratcliff, managing director at broadcaster Portland TV and a council member of the Digital Policy Alliance] said he did not see any possible rollout of the beta service happening quickly at present, with the market already having to move forward with adopting available solutions.

From the perspective of the needs of online service providers, including adult services and pornographic sites, for a fully functioning ID assurance platform, Ratcliff said GOV.UK Verify (RIP) was likely to arrive too late to serve as a one-stop cross-industry solution.

"This is a solution that I needed about three and a half years ago and not something in beta," he said.

While not ruling out potential use of the government's ID assurance platform entirely, Ratcliff claimed that Portland already had a broad number of options to verify age of subscribers and service users.

He added that the adult entertainment industry and online suppliers of films, alcohol, tobacco and other age restricted products, together with the Digital Policy Alliance, were looking for more innovative means to verify customers, where possible allowing for the potential for anonymised checks that could remove any possible abuse of confidential and personal details.

The UK finance sector has also sought guidance from GDS along with other private providers as part aims to build an innovative "digital passport" ID assurance solution to support online applications for savings accounts and related services ...

"This is an issue that we will bear in mind as we build the prototype. Consumer security and cybercrime considerations are paramount and we do acknowledge that whilst we are working with [GDS], GOV.UK Verify (RIP) may not be the answer for this project," said Dalton-Brown [director general of the Tax Incentivised Savings Association].
GOV.UK Verify (RIP) is no use to HMRC. Or anyone else in either central government or local government. Those "identity providers" who have signed up to GOV.UK Verify (RIP) have wasted their shareholders' money. And it's no use to the private sector.

RIP IDA.

RIP IDA – Walter Mitty and the machinery of government

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

GOV.UK is the award-winning on-line face of government in the UK and, as Public Servant of the Year ex-Guardian man Mike Bracken CBE CDO CDO told us back in October 2012, "GOV.UK is not Government on the Internet, but of the Internet".

What does that mean?

It's all something to do with riots. That's what he told the Code for America Summit a year later in October 2013. GOV.UK is the only defence against a recurrence of riots in the streets of the UK.

And it's all something to do with what Tim O'Reilly has called "Government as a Platform" (GaaP).

Some academics disagree. Professor Mike Martin of Newcastle University Business School for example. He points out that GOV.UK is a website, and not a government. Mark Thompson on the other hand, a lecturer at the University of Cambridge's Judge Business School, reckons that if only we plot certainty against ubiquity, GaaP will come to power.

Whichever, Mr Bracken is in no doubt about the general election we have just enjoyed here in the UK: "It was great to see GOV.UK handle the change of government so smoothly".

RIP IDA – tax credits: another nail in the digital-by-default coffin

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

"If there's a tricky job facing the Government Digital Service (GDS), or indeed an impossible job", we were saying on 19 April 2015 and 20 April 2015, "what do they do? Call for Janet Hughes".

GDS have had to call for her again, please see Basic identity accounts trial.

Her Majesty's Revenue and Customs (HMRC) have been lured into using GOV.UK Verify (RIP) to make sure they know who they're dealing with on-line. The problem is that GOV.UK Verify (RIP) doesn't work.

Ms Hughes takes as her example HMRC's on-line Tax credit renewals service. Who is that on the other end of the line? HMRC need to know. They can't hand out money to just anyone. "... even when the service is live, there will be some people whose identity it’s not possible to verify entirely digitally", Ms Hughes tells us, "for example, it will always be difficult to verify the identity of someone who has no evidence (like a passport, driving licence, bank account) that it’s really them and not someone pretending to be them".

That's the problem.

And the proposed solution?

"Last week we started to trial  a new part of GOV.UK Verify (RIP). Working with HMRC on the Tax Credits service, we've introduced basic identity accounts (also known as LOA1) alongside our existing verified identity accounts (also known as LOA2)".

How do basic identity accounts solve the problem?

They don't:

"As part of the trial of basic identity accounts, people who can’t fully verify their identity account can now set up a basic identity account. HMRC will then ask some additional security questions and give them access to the Tax Credits service. This is sufficient to allow someone to do relatively low-risk things online, like confirm existing details are correct, or save and return later to a form".

Basic identity accounts don't allow claimants to renew their tax credits. They may well be "a new part of GOV.UK Verify (RIP)" but they don't allow HMRC to verify your identity. They may help you to return to a partially completed form but they won't let you renew your tax credits.

Any claimant who can't get a full, non-basic identity account can renew their tax credits claim but only thanks to HMRC asking "some additional security questions".

Tax credits isn't the only on-line service in which GOV.UK Verify (RIP) poses problems for HMRC. The Daily Mail newspaper led the other day with an exposé of HMRC's Transferable tax allowance service, please see Thousands miss out in marriage tax fiasco, "HMRC's problem centres on a £25million computer system called Verify".

Poor old HMRC. They've plighted their troth to the wrong liege. They now have to route round GOV.UK Verify (RIP). They have to do without it. They don't need it. It's not up to the job. They need something that works.

Who else could explain that GOV.UK Verify (RIP) is dead while simultaneously claiming that events are all going according to plan? No-one. Only Janet Hughes.

RIP IDA – tax credits: another nail in the digital-by-default coffin

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

"If there's a tricky job facing the Government Digital Service (GDS), or indeed an impossible job", we were saying on 19 April 2015 and 20 April 2015, "what do they do? Call for Janet Hughes".

GDS have had to call for her again, please see Basic identity accounts trial.

Her Majesty's Revenue and Customs (HMRC) have been lured into using GOV.UK Verify (RIP) to make sure they know who they're dealing with on-line. The problem is that GOV.UK Verify (RIP) doesn't work.

Ms Hughes takes as her example HMRC's on-line Tax credit renewals service. Who is that on the other end of the line? HMRC need to know. They can't hand out money to just anyone. "... even when the service is live, there will be some people whose identity it’s not possible to verify entirely digitally", Ms Hughes tells us, "for example, it will always be difficult to verify the identity of someone who has no evidence (like a passport, driving licence, bank account) that it’s really them and not someone pretending to be them".

That's the problem.

And the proposed solution?

Friday 5 June 2015

RIP IDA – GOV.UK Verify (RIP), a brief history of progress

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

Four times the Government Digital Service (GDS) have published a post with the same title, The next 6 months: services that plan to start using GOV.UK Verify (RIP), on 29 October 2014, 5 January 2015, 20 February 2015 and 14 May 2015.

The four progress reports have been consolidated in the big table below, also available more legibly in a Microsoft Excel workbook, and summarised here:

Department
No. services
Max no. 2015 service-users
Max no. 2015 service-users%
BIS / Insolvency Service
1
15,000
0.41%
Defra
1
100,000
2.73%
DfT / DVLA
1
125,000
3.42%
DWP
2
999
0.03%
HMRC
12
3,414,999
93.41%
17
3,655,998
100%

Why are there no 2015 plans to add GOV.UK Verify (RIP) identity assurance to GDS's electoral registration application? Why aren't GDS working with the Foreign Office? Or the Home Office? Or the Ministry of Defence? Or the Department of Health or the Department for Education?

Five digital services in four central government departments are due to have GOV.UK Verify (RIP) standing guard at the gate in 2015. It's really only four services because Change of address (service d in the table below) disappeared after the January progress report.

Four digital services for four departments but 12 for HMRC alone, Her Majesty's Revenue and Customs, whose job it is to raise about £650 billion a year from us taxpayers. GOV.UK Verify (RIP) looks like spending its last few months alive working on HMRC applications, it is to all intents and purposes an HMRC project.

The wrong HMRC project.

HMRC currently use the Government Gateway for access control. They have done for 15 years. They don't need a new system that doesn't work. They need to spend some money on the Government Gateway, which has been starved of resources for many years now, in an incomprehensible act of vandalism.

BIS / Insolvency Service
The Insolvency Service is "an executive agency, sponsored by the Department for Business, Innovation & Skills".

Please see service a in the table below.

On 29 October 2014 GDS promised that 15,000 users would be connected to the Insolvency Service's Redundancy payments digital service by GOV.UK Verify (RIP) "in first 6 months (ie by April 2015)". Did they achieve that two months ago? No. By the time of the 14 May 2015 progress report, GDS were promising 15,000 GOV.UK Verify (RIP) service-users by November 2015.

Tantalus was the unfortunate chap in Greek mythology who stood in a pool of water but could never get anything to drink and by a fruit tree but he could never get anything to eat. BIS have been tantalised for seven months now by 15,000 users who always seem close but never get any closer.

Take a look at the Redundancy payments service on GDS's performance dashboard and under Digital take-up it says "no data".

Take a look at the Insolvency Service's website and they offer you a telephone number (0330 331 0020) or an email address (redundancyclaims@insolvency.gsi.gov.uk) but no on-line application form for redundancy payments. Click on Your rights if your employer is insolvent and then Claiming money owed to you, and you get taken to a page that tells you to ring the redundancy payments enquiry line and ask for a form RP1 to be sent to you. And yet GDS's 14 May 2015 progress report says that the digital service is "in public beta".

The more determined supplicants will find that there is an on-line form to fill in. DMossEsq tried to use it. His GOV.UK Verify (RIP) "identity provider" claimed to have sent a code to his phone to complete the login. It didn't arrive. He asked for it to be re-sent. The code that turned up then wouldn't allow him into the system. He asked again for it to be re-sent. A new code was submitted and DMossEsq was delivered to ...


... at which point, sorry too, he stopped investigating although several more codes then queued up like London buses on his phone.

The Redundancy payments service was no.3 on GDS's list of 25 so-called "exemplars" which together constituted their famous 400-day transformation programme. When GDS's transformation director announced, confusingly, after 800 days, that "the programme has ended ... we’re only just beginning", Redundancy payments was marked as being in "Public Beta", ...

... one down from "Live". Dead?

Defra
DEFRA is the Department for Environment Food and Rural Affairs, their Rural payments service is no.8 on GDS's transformation list, it's reached the "Public Beta" stage according to the 14 May 2015 progress report and, as with Redundancy payments, GOV.UK Verify (RIP) teases and tantalises with promises of users who are always close by in the wings but never appear on stage – Rural payments was promised 100,000 of them for April 2015 and they're still promised now, but not until November 2015, please see service b in the table below.

Empty promises of jam in the future are only half the story of Rural payments, though, where GOV.UK Verify (RIP) is the necrophiliac gatekeeper to a digital service that is stone cold dead.

"A multi-million pound government IT system to process EU subsidy payments for farmers in England has been largely abandoned after 'performance problems' ... The system will be re-launched next week with farmers asked to submit Basic Payment Scheme claims on paper forms", the BBC told us in March, "... farmers say they have struggled with the £154m website for months".

This fact is not mentioned in the 14 May 2015 progress report, where GDS tell us that GOV.UK Verify (RIP) has been "connected" since July 2014. Connected to what? A corpse?

As farmers keep pointing out, for £154 million DEFRA officials could take a taxi to visit each one of them to fill in the application form and there'd still be change.

The executive director of GDS assured us on 11 January 2013 that he was working on the Rural payments service himself , that development of the system "embraced agile completely", that it was "going to be another example of government as a platform" and that it was "going to help us deal with Europe in a different way".

Not so different in the event.

Rural payments come under the European Union's Common Agricultural Policy (CAP) and the National Audit Office told us in July 2014 that "... the total value of disallowance penalties accrued or provided for since the introduction of the CAP 2005 in 2008‐09, is currently £580 million".

Never mind GDS's executive director's personal involvement in agile government as a platform, the scene is set for a repeat. The same way of dealing with Europe as before. Another £580 million fine.

GDS are inordinately proud of their Digital Service Standard and the attention they pay to user needs and the thoroughness of their Digital by Default Service Standard Assessments. How is it then that Rural payments was ever allowed into Beta testing? And how is it that the users were blamed for Rural payments being unusable?

Despite being in Public Beta there is no performance dashboard for Rural payments.

DMossEsq tried to log on to Rural payments but once again only got as far as the cemetery:


DfT / DVLA
The Driver & Vehicle Licensing Agency is "an executive agency, sponsored by the Department for Transport".

The View your driving licence information service, service c in the table below, has been available for a long time now.

Tantalisingly, on 29 October 2014 GDS told us that we would be able to use the service through GOV.UK Verify (RIP) from December 2014. On 5 January 2015 it was going to be connected that month and usable by March 2015, which it wasn't and it still isn't. On 20 February 2015 the service was due to be connected by March 2015 and on 14 May 2015 it was due to be connected by July 2015.

Unlike Rural payments, View your driving licence information actually exists.

It's seven months since the first progress report, last October. And GOV.UK Verify (RIP) still isn't even connected.

What's the problem? How difficult can it be to add this extra identity assurance to an existing service operated by a particularly co-operative agency, DVLA?

If GDS can't add GOV.UK Verify (RIP) to View your driving licence information what can they add it to?

How can any other agency have confidence in GOV.UK Verify (RIP)? Why should central government departments want their users to "connect" through it? Or local government – would it be prudent for them to irritate their Council Taxpayers with repeatedly undelivered promises?

Whatever the answer – and needless to say GDS's progress reports don't tell us – we drivers still can't connect to the service using GOV.UK Verify (RIP).

Instead, we continue to use driving licence number, National Insurance number and post code. And DVLA themselves say of that combination of information that it "does not provide us with the level of confidence the user is who they say they are".

GDS promise that GOV.UK Verify (RIP) will deliver the requisite level of assurance. But when? "Due to connect by July 2015"? We've heard that before.

DWP
The Department for Work and Pensions is the UK government's biggest-spending department, with managed expenditure running at around £200 billion p.a. And they've heard it all before:
Identity assurance (IDA) will play a central role for the government in delivering digital public services - seen as an important way to cut the cost of the public sector. IDA is the process citizens will need to go through to verify who they are to access public services online. Part of the government's remit under the IDA project is to create a market of private sector identity assurance services to enable access ...

The first service to be delivered using identity assurance will be the Department for Work and Pensions' Universal Credits scheme ...

A prototype for IDA will be completed by the end of the year [2011]. The first services will be developed and tested by February 2012, with IDA due to be rolled out for initial public services by autumn 2012.
Computer Weekly magazine told us that.

On 13 September.

2011.

DWP issued an invitation to tender for identity assurance services in December 2011 valued at £240 million. GDS made them re-issue it on 28 February 2012. GDS are in charge of identity assurance. Their executive director is the senior responsible owner of the pan-government identity assurance programme. They "sanctioned DWP" to cut the price to £30 million and to specify that:
The initial DWP services will be required to provide identity assurance for approximately 21 000 000 claimants. As the HMG customer base is diverse, a wide range of suppliers will be required to ensure demographic coverage to ensure that no claimant sector is unfairly disadvantaged by limiting supplier choice.

To support the rollout of universal credit and personal independence payments, identity assurance suppliers will be selected in summer 2012 and systems will need to be fully operational from spring 2013.
21 million claimants. £30 million. Really?

Selected in the summer of 2012. Fully operational from the spring of 2013. Really?

Unsurprisingly, it didn't happen.

On 29 October 2014, GDS said that IDA (identity assurance) – which by then had become GOV.UK Verify (RIP) – would "connect" the first Universal Credit users (service e in the table below) by April 2015. Few people can have been surprised when that didn't happen. Not even Tantalus.

Who's in charge of this four-year mess? Computer Weekly told us back in 2011. Public Servant of the Year ex-Guardian man Mike Bracken CBE CDO CDO, executive director of GDS ...
... is now the senior responsible owner for IDA. “It’s something that I put my hand up for because it’s so important. Unless we have better and wider used security protocols, it will be hard to identify users, allow transactions and link up services.
HMRC
Her Majesty's Revenue and Customs "are the UK’s tax and customs authority, responsible for making sure that the money is available to fund the UK’s public services and for helping families and individuals with targeted financial support. Through our customs service we facilitate legitimate trade and protect our economic, social and physical security".

They've got a few transactions and a few services to link up. There are have something over 30 digital services to link up and, according to GDS's Transactions Explorer, HMRC undertake 1.1 billion transactions a year.

It is, indeed, "important", as Mr Bracken says, that HMRC should be able to identify their users. HMRC are expected to collect around £667 billion in 2015-16 according to the UK's 2015 Budget (page.6). No HMRC, no public services.

Luckily, they already can identify their users via the Government Gateway, which is where we came in. Because at the present rate, it's going to be a tantalisingly long wait before HMRC can identify them through GOV.UK Verify (RIP).

----------

As at 14 may 2015, GDS say that:
Eleven of the services we listed as starting to use GOV.UK Verify (RIP) early this year are now connected to the hub. Seven of these are available as public betas:
The remaining 4 are in private beta with small numbers of invited users.
Thin gruel. Very thin in the case of the late Rural payments.

There is no mention of the problems people are having registering with GDS's "identity providers" – Experian, Digidentity, the Post Office and Verizon.

There is no mention of Experian's unfortunate experience in the US, where they found themselves providing personal data to a fraudster and no mention of Verizon's stated mission to use personal data to promote the sales of their clients. Nor of Verizon having its German government contract rescinded.

Digidentity is Dutch and Verizon are American. They have no database of people in the UK. They can only conduct registrations by checking with other organisations. Digidentity use Callcredit, the credit referencing agency. Who knows who Verizon use? Why insert Digidentity and Verizon into GOV.UK Verify (RIP)? Instead of middlemen, why not appoint Callcredit and whoever Verizon use as "identity providers"?

Another matter not mentioned – who gave Callcredit permission to pass information about you to Digidentity?

GDS acknowledge that it's impossible to identify everyone by their credit record (Experian and Callcredit). They need a wider selection of personal information about us all to identify us. They don't seem to have made any progress there, but that's not mentioned.

There is no mention of the security questions which arise. What defences does the GOV.UK Verify (RIP) hub have against hacking? It's a daily event. Here's today's – US officials report massive data breach at federal human resources agency.

Are GDS interested in security? They say explicitly that they're more interested in usability.

What provisions are there for compensation when GOV.UK Verify (RIP) users are hacked? You can search all through the consolidated GOV.UK Verify (RIP) progress reports to date but you won't find any mention of compensation (para.6):

----------

Updated 23.7.15

The fifth lack of progress report on GOV.UK Verify (RIP) has just been published, Services that plan to start using GOV.UK Verify.

It's 23 July 2015, eight days away from August.

On 20 February 2015 GDS told us to expect 20,000 GOV.UK Verify (RIP) users of HMRC's check/update your company car tax on-line service. Did you believe that?

Will we see those 20,000 users in eight days time?

No. We are now told that it will be November 2015 before we see them. Do you believe that?

If so, why? After all, back on 29 October 2014 GDS told us to expect these 20,000 users by April 2015. April didn't happen, so to speak, August isn't going to happen so why should November happen?

Back in October 2014 GDS told us that:
The Government’s aim is that all the services that need identity assurance for individuals will be using GOV.UK Verify [RIP] by March 2016.
Even if you believed that then, you can't now, can you?



Updated 3.11.15

The sixth lack of progress report on GOV.UK Verify (RIP) was published yesterday, Government services using GOV.UK Verify - November 2015 update.

The bellwether of GOV.UK Verify (RIP) is, of course, HMRC's check/update your company car tax on-line service. We were expecting 20,000 users by April 2015. Then by August 2015. And then by November 2015.

It is November 2015 now and do we have 20,000 users? No. The bad news is that we will have to wait until April 2016, a full year after the first deadline. On the other hand, the good news is that there will be 25,000-30,000 users. For sure.

There is other good news in the latest lack of progress report, futuristic facilities of unfettered ambition:
  • Some time between January and March 2016 12,000 of us will be able to declare ourselves bankrupt on-line.
  • And at some date yet to be confirmed 120,000 of us will be able to file for uncontested divorce on-line.
Then we get brought back down to earth.

The HMRC digital service that no-one seems to be able to use to transfer marriage allowance between spouses was "Connected Jun 2015 in private beta" and then "trial ended in July 2015". I.e. it doesn't work, no-one can register themselves with GOV.UK Verify (RIP).

So how does that GOV.UK Verify (RIP) connection qualify to be included in the table of "services already using GOV.UK Verify"?

Ditto DEFRA's claim rural payments service which appears in the same table. There is no such digital service.

It's odd but there is no mention in the November 2015 "update" of the fact that the identity verification tests are being diluted: "Whereas previously you would often need 3 pieces of evidence to prove your identity, now you will often only need 2 pieces of evidence".

And no mention of the introduction of magic into the verification process: "You can take a photo of yourself instead of answering questions based on credit history".

The level of assurance (LoA) offered by GOV.UK Verify (RIP) is meant to be 2 (civil courts) or even 3 (criminal courts). With this dilution and biometric magic, the connected digital services will be lucky to exceed an LoA of 1 (self-certification).

And there is no mention of GDS's exciting introduction of so-called "basic" GOV.UK Verify (RIP) accounts, unverified self-certification that you are you, on which no relying party like HMRC or DEFRA can sensibly ... rely.

The next lack of progress update is expected in February or March 2016, just before GDS triumphantly declare GOV.UK Verify (RIP) to have gone live. RIP.


Updated 30.4.16

Over the years, the date on which the Government Digital Service (GDS) promised to introduce a live, government-backed identity assurance scheme into the UK has changed from autumn 2012 to April 2016.

Yesterday, 29 April 2016, GDS announced that there would be a delay, GOV.UK Verify: April update on progress towards live. "We’re very nearly there", they said, but not quite.

Reporting an interview with Janet Hughes, GDS's programme director of GOV.UK Verify (RIP), Computer Weekly magazine told us on 26 April 2016 that: "With the official 'live' date for the programme set for 29 April 2016, Hughes is confident everything is on track".

What changed in three days? In what way was Janet's confidence misplaced?

"We haven’t yet finished the Service Standard assessment process", Janet told us yesterday. She must have known that when she spoke to Computer Weekly. When will it be finished? She doesn't tell us. Presumably it's not a foregone conclusion that GOV.UK Verify (RIP) will pass, when it is at last assessed. Or has it already been assessed and failed? She doesn't tell us.

"Live will not be a dramatic change. It’s part of an ongoing gradual process of developing and scaling up the service and GOV.UK Verify will actually look exactly the same to users". If going live is so insignificant, then why not declare GOV.UK Verify (RIP) to be live yesterday?

But it can't be so insignificant. GDS have previously told us that GOV.UK Verify (RIP) must be capable of registering at least 90% of the UK population before it can go live. GDS's own computer model predicts that GOV.UK Verify (RIP) can't achieve 90% penetration of young people (63.58%), old people (69.71%), out of work people (73.46%), people on low incomes (70.09%), ...

If GOV.UK Verify (RIP) is to be declared live, either GDS have got to improve penetration or the goalposts have got to be moved to make it clear that a live GOV.UK Verify (RIP) could exclude around 30% of the population ...

... but in that case, why bother? Answer from Janet, "over 50 government services are planning to adopt GOV.UK Verify [RIP]. Twenty of these are planning to connect to GOV.UK Verify [RIP] in the next year". We've been told this ever since the 29 October 2014 lack-of-progress report above. Adoption remains forever on the horizon.

"We've now got 8 certified companies for users to choose from", says Janet, but GDS themselves recommend against using five of them, and what's more one of the remaining three, the Post Office, isn't certified:



In view of the circumstances, it undermines GDS's case somewhat to make the eight companies claim.

Ditto the claim that "GOV.UK Verify [RIP] has been used 1.3m times". As at 24 April 2016:
  • 185,000 of those occasions on which GOV.UK Verify (RIP) has been used were to create unverified, "basic" accounts.
  • 502,000 "uses" were to create verified accounts and that's not really "using" GOV.UK Verify (RIP), is it, just as acquiring a screw driver isn't the same as actually putting up a bookshelf.
  • That leaves us with 591,000 "sign-ins". Maybe that was 591,000 useful outings for GOV.UK Verify (RIP). Or maybe 502,000 of them were just people checking that the account they had just created works, leaving just 89,000 people viewing their driving licence details. Who knows?
What we do know is that, after four years in development and two years in testing, GOV.UK Verify (RIP)'s volumes are trivial. Look at HMRC:


A lot of those 1,850,000,000 HMRC transactions depend on people and companies being connected to HMRC via the Government Gateway.

Don't forget that GOV.UK Verify (RIP) can't handle companies. Only individuals. HMRC need the Government Gateway to remain open whether or not GOV.UK Verify (RIP) is declared to be live.

When you create a Government Gateway account, you hand over a bit of personal information to the government. If you create a GOV.UK Verify (RIP) account via Verizon, say, you hand over a lot of personal information to a company within the Verizon Group or other affiliated entity, Equifax, ID Checker, Zentry LLC, Techmahindra Ltd and Expert Solutions Support Centre. Who wants to do that? Why?

Janet almost never mentions the Government Gateway. But it's there, and it has been for 15 years, and it works. It undermines GDS's case somewhat, again, not to mention the Government Gateway and not to give it its own dashboard on GDS's flaky performance platform, unlike GOV.UK Verify (RIP) which does have its own dashboard.

People will want to know why we need GOV.UK Verify (RIP) given that we already have the Government Gateway. Why spend money on failing to deploy the former when it could be better spent on improving the latter?

As things stand, the senior decision-making team that declares GOV.UK Verify (RIP) to be live runs the risk of destroying its own credibility in the process.


Updated 30.5.16

Here we are, a month since the previous update:
  • First the US National Institute for Standards and Technology asserted that GOV.UK Verify (RIP) cannot do identity-proofing, i.e. it offers no more than self-certification.
  • Then Rt Hon Matt Hancock MP, Minister for the Cabinet Office, declared GOV.UK Verify (RIP) to be live.
  • Then we learnt that GOV.UK Verify ((RIP) won't replace the Government Gateway, nor will it be any use for age verification ...
  • ... and we learnt that the payments industry are now working on their own on-line identity authentication standard, PAS 499, GOV.UK Verify (RIP) not being up to snuff eIDAS-wise, GDPR and PSD2.
  • And then the seventh lack of progress report on GOV.UK Verify (RIP) was published, Government services using GOV.UK Verify - May 2016 update.
In the first lack of progress report back in October 2014 we were told that "the Government’s aim is that all the services that need identity assurance for individuals will be using GOV.UK Verify [RIP] by March 2016". Needless to say, that didn't happen.

Subsequent lack of progress reports have kept the forecast figures more or less unchanged but moved the target date/goalposts six months back. In this latest report, the target date is the best part of a year away, April 2017.

For example, following the November 2015 lack of progress report, we were hoping for between 25,000 and 30,000 GOV.UK Verify (RIP) users of HMRC's Check or update your company car tax service by April 2016. Now we have to hold our breath until April 2017 to see if we have between 100,000 and 200,000 users.

Has there been any progress or hasn't there? We don't know. GDS's report doesn't tell us. How about the GDS performance platform dashboard for Check or update your company car tax? No data has been added since December 2015. And the old data that is available doesn't tell us how many GOV.UK Verify (RIP) users there are.

So much for the government services GDS have been reporting on until now.

And the new services that we have been promised will be connected by GOV.UK Verify (RIP)?

There, GDS have given up making forecasts, in the main. They just say "TBC", which probably stands for "to be confirmed":

Service Status Anticipated GOV.UK Verify users in the next year
NHS England View your personal health record (NHS Liverpool Clinical Commissioning Group pilot) Planning to connect June 2016 5k
DfT / DVSA Apply for an operator licensing certificate Planning to connect July 2016 <5k
BIS/Insolvency Service Declare bankruptcy online Planning to connect July 2016 10k
BIS/ Land Registry Sign your mortgage deed Planning to connect September 2016 TBC, Summer 2016
DWP Activate your state pension Planning to connect October 2016 <5k
DWP Apply for the Personal Independence Payment Planning to connect October 2016 TBC, Summer 2016
HMRC Apply for childcare support Planning to connect November 2016 10-20k
HO / Disclosure and Barring Service Apply for a basic check Planning to connect December 2016 50k
DWP Access to work Planning to connect October to December 2016 15k
DWP Child maintenance Planning to connect 2017 TBC, Winter 2016
DWP Bereavement support Planning to connect 2017 TBC, Winter 2016
DfE / Ofsted Childminder or childcare provider Planning to connect 2017 5k
NI Register a child’s birth in Northern Ireland TBC TBC
MOJ File for uncontested divorce TBC TBC
HMRC Inheritance tax online TBC TBC
HMRC View your medical benefit TBC TBC
BIS / Companies House Voluntary dissolution of a company TBC TBC, Winter 2016
DfT / DVLA Amend your driver record TBC TBC

We were led to believe that there were up to 50 public services to be added to the portfolio as soon as GOV.UK Verify (RIP) was declared live. In the event, just 18 are listed. 18 is not 50. And of those 18, 10 have forecast details yet to be confirmed.

To be confirmed?

That's no way for a professional organisation to report to its valued users:
  • Either GDS know the missing dates and user numbers and don't want to tell us.
  • Or they don't know them and the announcement that these 10 TBC services are in the GOV.UK Verify (RIP) pipeline is premature and unconvincing.
Which is it?

It doesn't matter.

Two news organisations have now announced that HMRC are working on a successor to the Government Gateway. GOV.UK Verify. RIP.


Updated 28.3.17

There has been no update to Government services using GOV.UK Verify - May 2016 update. Why's that? Rigor mortis?

There's a bit of activity on the GOV.UK Verify (RIP) blog in the comments section of The latest improvements across GOV.UK Verify’s certified companies where a keen morbid pathologist asks:
Andrew 
Hi,
Any news about what's happening with DWPs Bereavement Allowance?
It was due to be verify compatible last year but there hasn't been an update.
Thanks,
Andrew
Link to this comment
  • Emily Ch'ng 
    Hi Andrew,
    Thanks for your query. DWP’s Bereavement Service was due to connect to Verify in 2017. However, this is a large scale project, and the service has recently prioritised improvements to other parts of the service which means adoption of Verify is likely to take place in a subsequent phase of the project. Claimants should continue to use the existing service until there are further updates from DWP.
    Link to this comment
"The service has recently prioritised improvements to other parts of the service", the Government Digital Service (GDS) tell us. Which other parts? They don't say.

"Adoption of Verify is likely to take place in a subsequent phase of the project". When's that? They don't say.

"This is a large scale project". How large? Too large for GOV.UK Verify (RIP)? Too large for GDS?

That could be it. In other news – Angling to meet user needs at Defra – we read that: "The Department for Environment, Food and Rural Affairs' (Defra) new online fishing rod licence service recently moved from private to public beta ... Head of Digital at Defra, Sally Meecham, explains why the service is so simple, a child can use it".


Updated 12.5.17

The Government Digital Service (GDS) started their series of progress reports, The next 6 months: services that plan to start using GOV.UK Verify (RIP), on 29 October 2014.

At no point did they mention that GOV.UK Verify (RIP) would be used for local government services.

Nevertheless, that is the plan and DMossEsq has been keeping readers abreast of progress, including the fact that more than half of the local authorities who started have now pulled out of GOV.UK Verify (RIP) trials.

PublicTechnology.net (PT) have covered the same story, please see Local government Verify pilot hit by council departures. Their article includes explanatory comments from all participants in the trials except GDS themselves. PT say: "The Cabinet Office and GDS were approached for comment on the trials, but a spokesperson said they would not provide a running commentary on the pilot during the pre-election period".

It seems a pity that GDS can't comment.

But is it?

Think back. In October 2014, GDS told us that people would be able to connect to HMRC's on-line Renew tax credits service using GOV.UK Verify (RIP) by March 2015. GDS said further that there would be 1,000,000 (max) users of this service connected by GOV.UK Verify (RIP) during 2015.

Today, 926 days later, log on to Renew tax credits, and this is what you see:


You have to log in using the Government Gateway, not GOV.UK Verify (RIP). GOV.UK Verify (RIP) didn't connect the public to Renew tax credits in March 2015 and it still doesn't. Far from 1,000,000 users connected by GOV.UK Verify (RIP) in 2015, there were and there still are none. Renew tax credits remains stubbornly missing from GDS's list of on-line government services using GOV.UK Verify (RIP).

Whether GDS are commenting or not, the story remains the same. GOV.UK Verify? RIP.


Updated 27.11.17

The Government Digital Service (GDS) have made seven predictions about the number of services that would be connected to their lifeless identity assurance service, GOV.UK Verify (RIP), on 29 October 20145 January 201520 February 201514 May 201523 July 20152 November 2015 and 25 May 2016.

During that period ...
  • Francis Maude was replaced first by Matt Hancock, then Ben Gummer and now Damian Green, supported by Caroline Nokes.
  • Matt Hancock has moved to the Department for Culture Media and Sport which has taken over some of GDS's responsibilities and become the Department for Digital Culture Media and Sport.
  • Responsibility for the Government Gateway has been taken away from the Department for Work and Pensions and given to Her Majesty's Revenue and Customs, who are working on a successor as GOV.UK Verify (RIP) is no use to them.
  • Only three local authorities are left out of 15 starters who were trying to use GOV.UK Verify (RIP) for residents' parking permits and only two out of the original 11 local authorities are left in the attempt to use it for concessionary travel.
  • The Open Identity Exchange have demonstrated several times that GOV.UK Verify (RIP) has nothing to offer either the financial sector or the major retailers.
  • Mike Bracken was replaced as head of GDS first by Stephen Foreshew-Cain, then by Kevin Cunnington. Janet Hughes, programme director of GOV.UK Verify (RIP), left. There hasn't been a single addition to GDS's identity assurance blog since 30 March 2017, all but eight months ago.
... and yet GDS continue to predict that there will be 25 million users of GOV.UK Verify (RIP) by 2020. How can they achieve that? Where are the users going to come from?

On 14 November 2017 PublicTechnology.net (PT) published Virtual mortgages and online divorces – the future of government digital services: "Within the next three years the government plans to create 89 new digital services – including online divorces and mortgages".

You've heard that before.

On 23 July 2015 GDS told us that an on-line uncontested divorce service would be tested from July 2016 onwards and that a test of electronic signatures for mortgages would start between January and March 2016.

They stuck to the mortgage dates in their 2 November 2015 progress report but the start date for on-line divorce had disappeared.

There was still no date for divorces in GDS's 25 May 2016 report and the date for mortgages had slipped from March 2016 to September 2016, the traditional six-month ever-receding horizon.

GDS now want up to three years, which would take us to November 2020, well over four years later than first promised/predicted.

The PT article includes this: "Nokes pointed to GDS's Government as a Platform programme an important example of a digital project that has made services 'easier to create, and cheaper to run'. A total of 26 government departments or agencies are currently using Government as a Platform tools to cumulatively deliver more than 100 services ...".

Don't be confused.

There's a bit of sleight of hand there.

There are 111 on-line services using GDS's GOV.UK Notify system. That's part of Government as a Platform. It's an email service. And/or text. Some central government departments and some local authorities are using it but HMRC, for example, continue to use their own email system. It's 20 years at least since anyone could claim a noteworthy success by getting an organisation to use email.

When it comes to GOV.UK Verify (RIP), another component of Government as a Platform, there are just 14 services using it. GDS claimed 13 services were already using GOV.UK Verify (RIP) in their 25 May 2016 report. In 18 months they've added just one? Just one out of the 18 services listed in that same report under the heading The next 3 months and beyond? They've failed with 17 of them?

GOV.UK Verify is dead. RIP. GDS embarrass themselves by pretending otherwise.

RIP IDA – GOV.UK Verify (RIP), a brief history of progress

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

Four times the Government Digital Service (GDS) have published a post with the same title, The next 6 months: services that plan to start using GOV.UK Verify (RIP), on 29 October 2014, 5 January 2015, 20 February 2015 and 14 May 2015.

The four progress reports have been consolidated in the big table below, also available more legibly in a Microsoft Excel workbook, and summarised here:

Department
No. services
Max no. 2015 service-users
Max no. 2015 service-users%
BIS / Insolvency Service
1
15,000
0.41%
Defra
1
100,000
2.73%
DfT / DVLA
1
125,000
3.42%
DWP
2
999
0.03%
HMRC
12
3,414,999
93.41%
17
3,655,998
100%

Why are there no 2015 plans to add GOV.UK Verify (RIP) identity assurance to GDS's electoral registration application? Why aren't GDS working with the Foreign Office? Or the Home Office? Or the Ministry of Defence? Or the Department of Health or the Department for Education?

Saturday 30 May 2015

RIP IDA – nil by mouth

No need to say it, it goes without saying, it should be obvious to all but,
just in case it isn't obvious to all,
IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",
is the Cabinet Office Identity Assurance programme.
And it's dead.

Last heard, 26 March 2015, GOV.UK Verify (RIP) was in maudlin mood, brooding about the meaning of life and the objectives for its vanishing future.

Speaking through its faithful assistants Janet Hughes and Stephen Dunn from its deathbed in the Kingsway hospice destined to be its final resting place, GOV.UK Verify (RIP) expatiated ungrammatically on its Objectives for live and "what ‘live’ means" for it as the end approaches. Ominously, there hasn't been a word from GOV.UK Verify (RIP) in the five weeks since.

It's what they don't say that counts, please see RIP IDA – what they omitted from the obituary. GOV.UK Verify (RIP) has now hobbled from having only three "identity providers" to four, but they didn't tell us that. As their energy seeps away, the only reason we know is that Neil Merrett (read him early, read him often) kindly told us on 14 May 2015 in Verizon joins GOV.UK Verify accredited suppliers list.

Maybe they just didn't have the heart. Following the story two days earlier, Sprint and Verizon to pay $158 MILLION over bogus 'cramming' fees, how were GOV.UK Verify (RIP) supposed to convince the British public that the unsavoury Verizon is an ornament to the Constitution and a safe repository for our personal information?

"We’ve written before about our work to expand the range of evidence people can use to verify their identity through GOV.UK Verify" they told us back in March, frustrated, and there's still no sign of a solution. What personal information/"evidence" does Verizon bring to the UK to help us to verify our identity? None.

You could ask the same of one of the other "identity providers", Digidentity, a Dutch company with no database of personal information about us Brits. But oddly enough, in their case, we know the answer to that one thanks to the following press release, Digidentity, working in partnership with Callcredit and Government Digital Services, announce the launch of their Virtual ID service for UK Citizens. Digidentity are working with Callcredit, a credit referencing agency, like Experian, one of the four accredited "identity providers".

So much for expanding "the range of evidence people can use to verify their identity". Another credit referencing agency. What is a person? As far as GOV.UK Verify (RIP) is concerned, a person is a credit history.

Why didn't GOV.UK Verify (RIP) tell us, their parishioners, that Digidentity are working with Callcredit? "We're building trust by being open", they've said in the past, "the sunlight of transparency is making things better". Doesn't look like it, does it. Who are Verizon working with? GOV.UK Verify (RIP) keep us in the dark.

There is one consolation for GOV.UK Verify (RIP) as it goes into that dark night. For some unknown reason the Americans have decided to model their public services IT on the UK's Government Digital Service (GDS), the operators of the Kingsway hospice whose achievements are the stuff of legend. Two US organisations, USDS and 18f, lose no opportunity to acknowledge their debt to GDS. The consolation is that at least GOV.UK Verify (RIP) will leave that American legacy, a visible testament to its short sojourn among us.

But just as the oscilloscope attached to GOV.UK Verify (RIP)'s wrist shows wan signs of life and a single pulse ping echoes around the intensive care unit what do 18f go and do? On 18 May 2015, et tu Brute, knife in the back, 18f only go and announce MyUSA – your one account for government. Is MyUSA modelled faithfully on GOV.UK Verify (RIP)? It doesn't look like it. They're not relying on Verizon. Or Digidentity. Far from the adolescent science fiction world of "identity providers", if anything the treacherous 18f's MyUSA looks more like the Scots myaccount initiative.

Dejected and rejected, crestfallen and broken-hearted, the patient slumps back into coma. And the doctors do what they always do. They put out a bulletin. The next 6 months: services that plan to start using GOV.UK Verify (RIP).

That was on 14 May 2015. The bulletin covers GOV.UK Verify (RIP)'s vital signs. E.g. the HMRC tax code/company car application. Number of users expected by November 2015? 20,000. That's 20,000 car-driving taxpayers, all identified by GOV.UK Verify (RIP), in six months time.

The doctors put out the same bulletin on 20 February 2015. Only that time they forecast 20,000 users by August 2015. The 5 January 2015 bulletin reckoned there would be 20,000 users by July 2015 and the 29 October 2014 version confidently promised 20,000 users by April 2015, a month or two ago.

The dates keep changing. But nothing else. GOV.UK Verify. RIP.

----------

Updated 20.12.17

2½ years ago we wrote:
On 18 May 2015, et tu Brute, knife in the back, 18f only go and announce MyUSA – your one account for government. Is MyUSA modelled faithfully on GOV.UK Verify (RIP)? It doesn't look like it. They're not relying on Verizon. Or Digidentity. Far from the adolescent science fiction world of "identity providers", if anything the treacherous 18f's MyUSA looks more like the Scots myaccount initiative.
How's it going, you ask? Tell us about MyUSA. And myaccount. And GOV.UK Verify (RIP).

Alright.

Here's Jason Miller of Federal News Radio to tell you that, following the failure of Federal Bridge and then E-Authentication and then Connect.gov and then MyUSA, the latest attempt at an identity assurance service for people to interact with on-line public services in the US is Login.gov. Quoting 18F, Mr Miller writes:
“To build this login platform, we’re using modern, user-friendly, strong authentication and effective identity proofing technology. This new platform will leverage the extensive lessons we’ve gained from agency efforts in the past, including lessons learned from our counterparts in the UK who built GOV.UK Verify [RIP].”
Mr Miller was writing in May 2016. MyUSA was already dead by then. So was GOV.UK Verify (RIP), of course, although that was the month when the surrealists at the Government Digital Service (GDS), 18F and USDS's "counterparts in the UK", declared the service to be live.

GOV.UK Verify (RIP)'s death notice was published last Friday 15 December 2017. Not by GDS, of course. In their Whitechapel terrarium GOV.UK Verify (RIP) is thriving. In the real world, Bryan Glick, the estimable editor of Computer Weekly magazine, delivered a masterly eulogy:
We will not see 25 million users of Gov.uk Verify – ever ...

A recent review of digital identity by McKinsey, commissioned by the Cabinet Office, focused on alternative schemes around the world ...

NHS England is now going its own way on digital identity, building its own platform for ID verification, according to its chief digital officer Juliet Bauer ...

HM Revenue & Customs (HMRC), ... has rejected Verify in favour of redeveloping its existing Government Gateway ID system ...
Mr Glick predicts that GOV.UK Verify (RIP) will become a brand name, a fig leaf for GDS. Working identity assurance schemes will be declared to be GOV.UK Verify (RIP)-compliant.

"Back in 2012, then-GDS chief Mike Bracken was clear in an interview with Computer Weekly [about] government’s role in online identity assurance", he says, and then quotes Mr Bracken: “It isn’t about building a product, it’s about supporting a protocol”. So why did Mr Bracken promptly set about building a product?

Piffle.

"The story will be that the money has been an important investment in understanding the requirements and getting the UK to a point where we can create a viable digital identity ecosystem".

More piffle.

We already had that understanding.

The identity ecosystem has done what all ecosystems do – killed all the useless adaptations. Federal Bridge, E-Authentication, Connect.gov, MyUSA and GOV.UK Verify (RIP) are all dead. The only survivor is the quite remarkably fit Government Gateway, which GDS in their ignorant arrogance ignored back in 2011 because they somehow knew better.

And how are the Scots getting on with myaccount? Another failed species, another victim of the ecosystem, not up to it, please see Stewart Hamilton's blog post on Scotland's new programme plan for on-line identity assurance:
David Moss says:

December 18, 2017 at 7:07 pm

Your Scottish Government Online Identity Assurance Programme Plan looks as though it has the same objectives as myaccount and involves pre-discovery and discovery work that must surely already have been done for myaccount.

In what way has myaccount failed?

It must have failed. Otherwise you wouldn’t be launching a new plan. Given that you are launching a new plan it is surprising that you would look to GOV.UK Verify (RIP) for inspiration.

GOV.UK Verify (RIP) has been rejected by most departments of central government and by local government and by the private sector.

It has a failure rate of over 60% when people try to use it, it can’t handle legal persons, it sprays personal information all over the world to so-called “identity providers”, their subsidiaries and their sub-contractors, its functionality has barely changed since it went “live” in May 2016 and the GOV.UK Verify (RIP) team stopped talking to the public months ago – no sort of an example to the Scottish Government Online Identity Assurance Project Team.

Take a look at ‘On digital identity in the UK – and the likely future for Gov.uk Verify’ [*] and you’ll see that the imminent demise of GOV.UK Verify (RIP) is predicted. Whatever the problems are with myaccount it’s unlikely that GOV.UK Verify (RIP) is any part of the solution.

———-

* http://www.computerweekly.com/blog/Computer-Weekly-Editors-Blog/On-digital-identity-in-the-UK-and-the-likely-future-for-Govuk-Verify