Completion of discovery phase of identity assurance programme leads to cautious assessment of prospects for GOV.UK Verify and other sources of digital identities
A report on the options for online identity assurance in Scotland has signalled a cautious attitude towards the adoption of GOV.UK Verify as a national solution, indicating a preference for people to have a choice of identity providers.
Consultancies ASE and Consult Hyperion have compiled the report on the recently completed discovery phase of the Scottish Government's Online Identity Assurance Programme, which it launched last year to build a common approach for people to prove their identities in accessing digital public services.
While it has stood back from a commitment to the GOV.UK Verify platform, which is being developed by the UK Government Digital Service, the report makes clear that it is regarded as one of the more serious options.
It has been considered with others, including those offered by the third party identity providers in the Verify programme, and Scotland’s myaccount sign-on, which is widely used by the country’s local authorities.
The project team in the Digital Directorate of the Scottish Government is now considering the contents of the technical discovery outputs, along with research on the service design paper, ahead of developing a plan for the alpha stage of the work.
The report says Verify “appears well placed to provide assured digital identity services”, but that “there are potential issues with its current reach” and that others could provide plausible alternatives. These include the individual identity providers.
It says myaccount does not offer a sufficiently strong level of authentication, but that financial technology providers may be able to do so.
Overall, it says that for now there is no single pool of digital identities that can do the job, but that some are expected to grow and are adding new capabilities.
This has prompted the consultants to advise the Scottish Government to take an approach that provides the flexibility to support different identity providers, and that it should start with those best placed to provide the necessary authentication for the services that will be supported first.
Among the outputs from the discovery phase – as outlined in a technical discovery document – are that the architecture of the solution should be based on personal attributes, decouple the parties involved, and protect the user from the complexity as far as possible.
The use of personal data stores – in which individuals can control which elements of their data is made available for specific processes – is also regarded as an optional requirement of identity providers.
A directorate blogpost on the progress says the key themes to emerge from the discovery are that: people are looking for an easier way to transact with public services, especially benefit applications; they have concerns about privacy and data security; and it is important that any solution is accessible through mobile phones and to people with disabilities.
An updated programme plan shows it is set to move into its alpha phase in August for six to nine months. This will be aimed at creating a prototype and followed by a beta phase, scheduled to begin in April of next year, in which the focus will be on service elements of the solution.
A service design report has outlined seven steps for a user journey with any solution. They begin with receiving a clear explanation of what is involved in created an online identity, followed by: creating a personal profile; gathering the documents to prove identity; using whichever tool works best, such as a photo or voice recording, to verify the person is who they say they are; receiving confirmation; saving further information relevant other services they may want to use; and receiving reminders to provide updates.
The blog adds that the team is now gathering feedback.
Image by Jeremy Keith, CC BY 2.0 through flickr
This story was amended on 4 June following a clarification that the assessment of the discovery phase was carried out by ASE and Consult Hyperion.