News analysis: GOV.UK Verify goes commercial in fresh attempt at take-off
“The importance of identity and trust is a central concern in the digital market. Organisations need to collaborate to solve the challenges because the digital environment is not yet fully trusted. Identity is fundamental to society.”
That is what David Rennie, head of industry engagement for the Cabinet Office’s GOV.UK Verify service, told the DataIQ Summit in 2015. It was early in the launch programme for a bold new digital identity service which would see users of government digital services register once and then reuse the same token from then on. To give the programme more depth - and a future beyond the public sector - seven commercial organisations were brought in to develop the standards and services which would be wrapped in.
If that was the bold vision, a written statement given by Oliver Dowden, minister for the implementation of GOV.UK Verify, on 9th October sounded a different note. While talking up the UK as a global leader in secure digital identity and its role as a critical enabler for the Government’s digital transformation, he also noted “challenges” and announced that, “this is therefore the last investment that the Government will provide to directly support the GOV.UK Verify programme.”
Government continues to be a customer - but perhaps the only one.
Instead, it is being transitioned into a private sector-led model with contracts having been signed with several providers for 18 months with capped expenditure.. According to Dowden, “the Government expects that commercial organisations will create and reuse digital identities, and accelerate the creation of an interoperable digital identity market.”
The government will continue to be a customer for these services - crucially, perhaps the only one. Of the seven original providers, Royal Mail and CitizenSafe have both stopped accepting any new accounts, suggesting they see little future beyond enabling tax payers to log in to HMRC with relatively little friction.
Getting to that point for users has been anything but frictionless, however. Mass adoption has not happened and only 40% of those who set out to create a digital identity actually complete the process. While HMRC spent one year promoting the benefit, little else has been done to push GOV.UK Verify and internal differences between the Department for Culture, Media and Sport and Government Digital Services have seen the programme nearly collapse on more than one occasion.
So will the remaining five players stay the distance? According to a spokesperson for the Post Office: “As the market-leading provider of Verify, we are delighted to continue delivering the service to the Government. We are also exploring a number of other opportunities, including those in the private sector, that will accelerate the adoption of Verify while ensuring convenience and security for its users.”
“We believe a Government-backed, standards-based identity framework is a great foundation to support the growth of the UK’s digital economy and Post Office is pleased to be playing a role in further helping to establish the UK as a global leader in digital identity,” it confirmed.
An Experian spokesperson said: “We remain fully committed to our contractual obligations associated with the service and we have recently signed another extension to supply ID services under Verify to HMG.”
“Turning Verify over to the private sector is not an admission of failure.”
Other providers were less forthcoming with Barclays and Digidentity failing to respond to requests from DataIQ and SecureIdentity offering no comment. In this perspective, the expansion of Verify into the commercial realm may not not accelerate in the way Dowden anticipates.
But Frank Joshi, director at Mvine which is a Hub Service Provider to GDS, has a different view. “Government proactively turning Verify over to the private sector is not an admission of failure, but a clear signal that it recognises what most of us already know: the private sector is able to deliver technological innovation at a pace and a quality that is now needed. Privacy campaigners have nothing to fear. The private sector is able to assure no back-doors exist in any of the technical and functional components which make up the sub-system.”
He recognises the hard road which the original seven providers have trodden, pinning most of the blame on “vacillation and opacity within central Government which almost kyboshed the entire scheme on more than one occasion.”
He argues that the private sector can drive sign-up rates while bringing down the cost per citizen identity as economies of scale kick in. “it should come as no surprise that Government wants to offload the capital cost of the infrastructure to the private sector. But it can only do that if it allows the private sector to arrange itself the way it needs to work - open competition guided by market rules and Government-assured framework,” said Joshi.
There are major brands still on board with Verify who have a clear interest in extending the service into new areas, not least the expanding eco-systems of digital platforms where multiple log-ins are a barrier to frictionless customer experience and trust in the security of personal data is low. This might not yet be the rebirth envisaged by the announcement, but it is not quite the death of Verify either.