RIP IDA – GOV.UK Retrench

No need to say it, it goes without saying, it should be obvious to all but,

just in case it isn't obvious to all,

IDA is dead.

IDA, now known as "GOV.UK Verify (RIP)",

is the Cabinet Office Identity Assurance programme.

And it's dead.

"If Verify is the answer, what was the question?"

@GOVUKverify can you tell me why PayPal didn't make the cut? — Kirsty Styles (@kirstystyles1) May 20, 2016

@kirstystyles1 Hi Kirsty, we've blogged about the certified companies that joined us after completing a rigorous onboarding process (1/2) — GOV UK Verify (@GOVUKverify) May 20, 2016

@kirstystyles1 https://t.co/S0g3SJZxvq Please direct any questions you have about that to Cabinet Office Press Office, thanks (2/2) — GOV UK Verify (@GOVUKverify) May 20, 2016

Kirsty Styles edits the New Statesman magazine's B2B tech site. She asks the Government Digital Service (GDS) about GOV.UK Verify (RIP). And back comes a response, possibly from an automaton, something to do with "rigorous onboarding", which looks co-operative but which doesn't answer the question.

You've got to take your hat off to the GOV.UK Verify (RIP) team. They've been doing this day in, day out, for years.

They can still say with a straight face that all their "identity providers" are certified when half of them aren't.

Even after all these years, they still claim to have eight "identity providers" while telling new applicants for a GOV.UK Verify (RIP) account that five of them "probably can't verify you".

They're still adamant that GOV.UK Verify (RIP) is secure and that it abides by all nine of the identity assurance privacy principles – it doesn't abide by a single one and everyone knows that there is no such thing as unqualified security.

And their response to the US National Institute of Standards and Technology's claim that GOV.UK Verify (RIP) doesn't do identity-proofing and offers no more than self-certification is pluckily ... to ignore it.

They look as though they could keep this up forever.

But they can't.

Tuesday 24 May 2016 was a big day. That was the day GOV.UK Verify (RIP) was finally declared live. They'd gone off the edge of the cliff and their little legs were turning furiously, they were still in the air but that was the day they finally looked down.

That was the day they gave a long interview to Government Computing. Now that GOV.UK Verify (RIP) is live, what can we expect?

We can expect that GOV.UK Verify (RIP) will not replace the Government Gateway. Janet Hughes, programme director of GOV.UK Verify (RIP), "said it was decided not to use Verify for corporate access needs". The very opposite of all the previous Walter Mitty-like announcements, that means that GOV.UK Verify (RIP) will not be involved in the vast majority of central government transactions. The vast majority both by volume and by value.

If GOV.UK Verify (RIP) isn't involved, then some other system must be. So GOV.UK Verify (RIP) can't after all be the single pan-government identity authentication platform, "we couldn't see a case for a cross-government approach". Bang goes Government as a Platform.

"The other thing [GOV.UK Verify (RIP) going live] does mean is that we are ready to start thinking much more actively how Verify might be used outside of central government ... we're now thinking much more actively, in collaboration with the private sector, local authorities and others, about bits of or all of Verify that can be reused".

Such as?

Which bits of GOV.UK Verify (RIP) can be reused/rescued?

@GOVUKverify @stuherbert What're the odds that this'll be the thing they want to use to do online "age verification"? — Gareth Llewellyn (@NetworkString) May 25, 2016

What sort of collaboration with the private sector, local authorities and others?

Age verification?

No.

Ms Hughes "said this was an area her team had quite deliberately not sought to get actively involved in". GOV.UK Verify (RIP) is live and now we know that it will not help with age verification.

With GOV.UK Verify (RIP), what is sometimes called the "minimum data set" and sometimes the "matching data set" includes your name, address, age and, optionally, your sex. If there's one thing that GOV.UK Verify (RIP) ought to be able to help with, it's confirming your age. But it won't. Disappointment, once again, for the Walter Mittys of yore. More retrenchment. "Quite deliberately".

So what will GOV.UK Verify (RIP) "get actively involved in"?

Blue badge.

Oh no, not that again.

For years, Ian Litton of Warwickshire County Council has been trying to improve the on-line application process for blue badges. He has toured the country extolling the benefits of GOV.UK Verify (RIP) and for years GDS have been no help to him, his prototype demonstration of the blue badge application scheme is still nothing more than a mock-up.

GOV.UK Verify (RIP) can't do age verification, we are told, but we are also supposed to believe that it can do the more complicated attribute exchange needed for blue badge? We can all dream. Walter Mitty can. And so can the rest of us.

More dreaming? GOV.UK Verify (RIP) and the payments sector? The British Standards Institution and MIDAS are now working on their own identity authentication scheme for payments. GDS's comment: "We're really actively involved in that sector, both in the banking sector and financial sector". If GDS say so.

What the cartoon character sees when he looks down is reality accelerating up towards him at 9.81 ms^-2. OMG going live is for real and it's terrifying. "The end of verify's beta phase was more of a symbolic, if exciting development for the platform"? No. All the swagger dissipated. No ambition left, the fire went out of GDS's belly.

Be bold? Maybe. But not recklessly imprudent. Armed only with GOV.UK Verify (RIP), the UK Exchequer would have no revenue when the Government Gateway is decommissioned in March 2018. So now we read HMRC plans extra authentication channel and Don't tell the Cabinet Office: HMRC is building its own online ID system.

And as the rôle of GOV.UK Verify (RIP) diminishes at 9.81 ms^-2, what else do we read? Government services using GOV.UK Verify - May 2016 update. What new on-line public services are to be connected via GOV.UK Verify (RIP)?

• Register a child’s birth in Northern Ireland – TBC (to be confirmed).
• File for uncontested divorce – TBC.
• Inheritance tax online – TBC.
• View your medical benefit – TBC.
• Voluntary dissolution of a company – TBC.
• Amend your driver record – TBC.
• Sign your mortgage deed – TBC.
• Apply for the Personal Independence Payment – TBC.
• Child maintenance – TBC.
• Bereavement support – TBC ...

The announcement of GOV.UK Verify (RIP) going live couldn't be made last month when it was meant to be, presumably because the departments of state refused to confirm that they would rely on it. Now the announcement has been made. And the best we can manage is ... TBC.