A new “verified identity” scheme for gov.uk is making it simpler to apply for a new driving licence, passport or to file a tax return online, allowing users to register securely using one log in that connects and securely stores their personal data.
After nearly a year of closed testing with a few thousand Britons, the “Gov.UK Verify” scheme quietly opened to general users on 14 October, expanding across more services. It could have as many as half a million users with a year.
The most popular services are expected to be one for tax credit renewals, and CAP farm information - both expected to have around 100,000 users by April next year, and on their own making up nearly half of the total use.
The team behind the system claim this is a world first. Those countries that have developed advanced government services online, such as Estonia, rely on state identity cards - which the UK has rejected.
“This is a federated model of identity, not a centralised one,” said Janet Hughes, head of policy and engagement at the Government Digital Service’s identity assurance program, which developed and tested the system.
How it works
The Verify system has taken three years to develop, and involves checking a user’s identity against details from a range of sources, including credit reference agencies, utility bills, driving licences and mobile provider bills.
But it does not retain those pieces of information, and the credit checking companies do not know what service is being used. Only a mobile or landline number is kept in order to send verification codes for subsequent logins.
When people subsequently log in, they would have to provide a user ID and password, and verify their identity by entering a code sent to related stored phone number.
To enrol in the system, users have to be over 19, living in the UK, and been resident for over 12 months. A faked passport would not be sufficient: “they would need a very full false ID, and have to not appear on any list of fraudulent identities,” one source at the GDS told the Guardian.
Banks now following gov.uk’s lead
Government developers are confident that it presents a higher barrier to authentication than any other digital service - so that fraudulent transactions will be minimised. That has interested banks, which are understood to be expressing interest in using the same service to verify customer identities through an arms-length verification system.
The government system would not pass on people’s data, but would instead verify that someone is who they claim to be, much like Twitter and Facebook verify users’ identity to log in to third party sites, yet don’t share their users’ data.
The US, Canada and New Zealand have also expressed interest in following up the UK’s lead in the system, which requires separate pieces of verified information about themselves from different sources.
The system then cross-references that verified information with credit reference agencies and other sources, which can include a mobile phone provider, passport, bank account, utility bill or driving licence.
The level of confidence in an individual’s identity is split into four levels. The lowest is for the creation of simple accounts to receive reports or updates: “we don’t need to know who it is, only that it’s the same person returning,” said Hughes.
Level 2 requires that “on the balance of probability” someone is who they say they are - which is the level to which Verify will be able to identify people. Hughes says that this will cover the majority of services.
Level 3 requires identity “beyond reasonable doubt” - perhaps including the first application for a passport - and Level 4 would require biometric information to confirm individual identity.
Consultation with privacy groups
The government is cautiously optimistic about the Verify program after the NHS care.data scheme, which aimed to collate health records in a single “spine”, ran into objections from privacy campaigners. The backers of Verify are at pains to say that its use will be optional - though more convenient than having to go to a physical office to register or order secure documents and file taxes.
The service has been built in consultation with privacy pressure groups including No2ID, Big Brother Watch, the University of Oxford’s Internet Institute, the Consumers Association, and the privacy regulator, the Information Commissioner’s Office.
Emma Carr, director of Big Brother Watch, told the Guardian: “It feels inevitable that this will happen because of the government’s ‘digital by default’ drive” - which aims to make all government services available digitally. “If it’s done in a proportionate and secure way, that’s good. But it has to feel like it isn’t imposed, and it has to be clear how it works. This is the first time that private companies are being asked to verify peoples’ identities. How it works might confuse some people.”
Privacy groups have worked with the government to create a list of principles for interacting with the Verify system.
It should take no more than 10 minutes to enrol in the system for the first time - and after that, users will be able to log in much more quickly using their identity. Users are asked to verify their identity via a credit reference agency: presently Experian and Verizon, though Digidentity and the Post Office will join soon.
A Cabinet Office spokesperson said: “Hardworking people expect to be able to access public services at their convenience so we are moving to digital-by-default services, designed around users. Our first wave of 25 ‘exemplar’ online services will help save £1.7bn a year after the next general election, as part of this government’s long-term economic plan.
“We want to make it easier for everyone to verify their identity online - without building new, single databases or reintroducing an illiberal ID card scheme - so we are building an online verification scheme which empowers the citizen to select the provider they want.”
Comments (…)
Sign in or create your Guardian account to join the discussion