Verify will only succeed with user discounts, says BCS

The government must offer discounts on public services if it wants people to use its identity assurance tool, Verify.

This is according to the BCS (The Chartered Institute for IT), which warned that Whitehall will not reach a critical mass of users for the ID verification platform unless it provides users with incentives.

Writing in a briefing note, the Institute wrote: "Government needs to accept that the commercial model should involve government supported incentives in the form of discounts to users.

"The critical mass needed for a robust and useful ID eco-system to evolve is unlikely to be achieved without an economic incentive."

These discounts could apply to some of the services Verify will soon be widely used for, BCS suggested, such as vehicle registration renewal, and could reflect the reduced cost of such services now they are digital. Verify is an early example of the Government Digital Service's (GDS) Government-as-a-Platform (GaaP) model, in which standardised platforms could replace expensive, unique IT systems procured separately by each department.

Instead, common components like Verify could be developed once and adopted across as many departments as suitable, cutting down on outsourcing costs.

Verify is still in beta trials and is being used by 11 departments including HMRC, either in a private or public beta.

But another 15 government services, such as those run by the Department for Work and Pensions and the NHS, plan to connect to Verify by July 2016.

The GDS said a further 20 services are in the early stages of looking at Verify.

However, the platform has experienced a host of problems lately, and BCS said users have abandoned the system in trials due to the lengthy sign-up process and complex identity documents they are required to have on them.

"Alpha and beta tests of the Gov.UK Verify scheme have shown that many users gave up because of the time involved and the need to have all the complex data required to hand when registering with an IDP [identity provider]," the organisation said.

The GDS should tackle this with a public awareness campaign to persuade them the platform is worth their time, the BCS added, as they would not need to re-register with the government to access other services.

Private partners

While the GaaP model could reduce private sector involvement in government IT, Verify has a number of approved identity providerssigned up as partners.

The platform works by cross-referencing government database data, like a person's passport, with that person's data stored in private sector databases, such as those belonging to credit reference agencies, acting as a hub in the middle to verify a person's data once, instead of building a huge national identity database.

However, identity providers will only be happy if the GDS allows the scheme to be used in the private sector, according to The Chartered Institute for IT, because it would be the only way they can recoup the costs of becoming a government-approved partner.

The report read: "Industry is unwilling to invest in public sector systems due to a lack of a working commercial model for Gov.UK Verify.

"Use of the scheme outside government services is necessary because that is the route for private sector providers to recover their costs of becoming government approved IDPs."

Security and trust

The BCS report followsthe GDS being forced to issue a denial after researchers claimed Verify had the capacity to spy on people due to technical flaws in its architecture.

Three experts warned too much trust had been placed in the hub, saying it could read encrypted information coming from private or public databases.

The GDS said only names, addresses and dates of birth are sent through the hub, rather than people's dealings with government or private companies.

But Verify must include steps to boost user trust and stop the UK lagging behind other countries in privacy protection, according to the BCS.

It said: "Citizens need to know that only authorised individuals have access to their information in data bases and that personal data is accurate and protected against fraud."

The government must ensure its databases are subject to quality control and accuracy tests, as well as working with the private sector to implement security frameworks that improve trust, it added.

"An adjudicator also needs to be appointed, who the public can appeal to and get redress through if things go wrong and their personal data is not protected or they are defrauded," said the BCS.

A Cabinet Office spokesman told IT Pro: "We can confirm that the incentive to use Verify is that it's easier and quicker to Verify [sic] your identity online using the service.

"The service is in the early phase of public use and is yet to go live'. We're collecting feedback from users and continuing to test, monitor, and improve the system. We're also working with a range of identity providers to ensure we offer choice, control and privacy for users."