Identity disorder: Does UK govt need Verify more than we do?
A bit less self-assurance goes a long way
Comment One problem writing about government IT is that after a while it feels a bit like Groundhog Day – a syndrome that must be even more pronounced for the folk working in it.
Six years ago I remember clearly being walked through the reasons why the British government needed an online identification tool to enable citizens to use online services.
Some of the admirable thinking behind Verify at the time was to create a federated means of identity that did not rely on a central citizen database akin to Labour's much-maligned and scrapped ID card system. So instead users choose from a range of trusted identity providers, which so far has mostly been Experian. Unfortunately, the design of the tool has been deeply flawed.
Back in 2011 the business case for the Government Digital Service was clear to the likes of former Cabinet Office minister Francis Maude: shove as many users to online services and save cash by shutting physical contact points.
When Maude used to talk about not only a "digital by default" government, but where possible an "online only" one, you could practically see the pound signs flash in his eyes.
Former GDS head Mike Bracken used to talk about the billions to be saved from this kind of channel shift. Hence the need for a secure, easy-to-use online ID tool that provided instant identity assurance of users.
Fast forward and its obvious no such channel shift has happened.
So where does that leave the business case for GDS? Fans of the service will point to other successes, such as a change in attitude to how government does IT.
But when it comes to cold, hard numbers it's difficult find much by way of savings by digital transformation beyond the spend controls. For which you don't exactly need a budget of £450m and 700 people.
Insiders have said the main business case behind GDS's current budget is to scale Verify, which it announced would have 25 million users by 2020. So far it has 1.1 million accounts. In contrast, the current online identity Government Gateway portal has 50 million accounts. At the moment just over half of the people who attempt to register on Verify are unable to to do so, with only one-third able to complete their attempt to access a digital service using a registered account.
However, it's impossible to know for sure how GDS's budget breaks down, as a "control-f £" search of the much-delayed transformation strategy doesn't throw up much. That lack of spending transparency and targets has also been noted by the Institute for Government.
A huge fly in the ointment of achieving the 25 million target was HMRC's announcement that it has decided to go its own way and create its own online ID system.
It was no secret that the department had been working on this for some time, which The Register wrote about last May. The fact the service does not work for businesses and failed for recipients of married tax allowance and farmers played a key part in that.
One contact pointed out that the difficulties GDS had in persuading big departments like HMRC to use Verify suggests "a poor discovery phase". To borrow GDS's own language, the organisation failed to understand "user needs" by not including businesses and agents in the tool from the beginning. That is a core part of HMRC's business.
Given that "agile" is meant to deliver often and early, it's odd that Verify has all the characteristics of an old waterfall programme: multiple missed deadlines and not delivering what people need, our contact added.
The clunky, but perfectly secure and working, Government Gateway system has been in place for 15 years and now has 50 million accounts. HMRC's plan is to replace the existing Gateway system itself (which unlike Verify, was created in just 90 days).
Without the backing of such a key department, for crucial transactional services the whole point of having a cross-departmental identification platform in the form of Verify disappears. It's hard to blame HMRC for not twiddling its thumbs and waiting for Verify to work.
However, Verify remains important to GDS. As one insider said: "If you were to take away Verify then a huge chunk of budget and GDS goes with it, along with existential grief about what GDS is for."
Some have suggested the only way for GDS to meet its target of 25 million in the next three years will be to use Verify for low-level services that don't really require the user to identify themselves. In other words solving a problem that doesn't need to be fixed.
Originally HMRC's blog declared the department is developing its own identity solution for individuals as well as businesses and agents. "Other departments will use Gov.uk Verify for all individual citizen services." That line has now disappeared. HMRC then quickly back-tracked, insisting it would promote Verify for individuals, suggesting it was brought "on message" by the Cabinet Office.
But even if four million individual self-assessment users were forced on to Verify, that would still mean a further four million would need to use HMRC's system because they use accountants, noted one contact.
The Department for Work and Pensions Universal Credit would be another obvious user base, he said, putting aside the likelihood of the programme ever being rolled out and Verify actually working.
"That would leave tax disk renewals and TV licences, which I don't think you need authentication for. That might leave them focusing on local services – council tax etc (though, again, hard to make the case for authentication.
"So my guess is either they won't meet that target or they will do it with low-level services that don't need full authentication – they will get you signed up to Verify but you wouldn't be able to do anything serious – so login with Facebook or just email and password."
Someone else also suggested Verify might be used for the mandatory online porn checks to be brought in on the Digital Economy Bill.
Asked whether the target of 25 million individuals was feasible, another insider said: "Possibly – if it's the only access to universal credit and some other services. But by 2020? Doubtful. It will have been running ten years by then – and so older than the legacy Government Gateway they inherited!"
Those who do not learn history are doomed to repeat it. GDS could do a lot worse to look at what others have achieved before and be honest about its own mistakes and successes.
Perhaps then we'd all have a clearer idea about its current purpose. ®
Sponsored: Becoming a Pragmatic Security Leader