Guest blog: Britain forges digital identity path with GOV.UK Verify

By Alastair Treharne, GOV.UK Verify risk and assurance leadGOV.UK Verify is the new way to protect users of government services from identity fraud. With GOV.UK Verify, you prove your identity once – using your choice of certified company – and then have an account you can use to access an increasing range of online services. It takes around 10 minutes to verify your identity for the first time and about a minute each time you use GOV.UK Verify to access a service after that.GOV.UK Verify the first of its kind in the world, so building it to work for everyone, straightforwardly, is not easy. That complex work has involved putting user privacy and security at the heart of what we're doing: designing GOV.UK Verify around privacy and data protection standards, in close consultation with privacy groups, consumer groups and subject experts. GOV.UK Verify is on target to go from beta to live by this April and is constantly expanding and improving based on user feedback. We'll soon pass 500,000 identities verified. I thought it would be an ideal time to share how GOV.UK Verify – and our certified companies – have approached the secure handling of users' identity documents and how this ground-breaking programme, with its international reach – is shaping the wider identity market.The document checking serviceCertified companies undertake a set of checks to establish to a defined level of confidence that it's really you. To do this, they have a range of evidence and different methods to reach the required level of confidence, so that someone can't easily pretend to be you using just one or two pieces of evidence.As part of the process of verifying a user's identity, certified companies will ask users to provide evidence that it's really them. This might include providing official documents like a passport or driving licence. In the past, to check whether these documents were genuine, all an identity provider could do was physically look at the documents or a copy of them. This did not help in the cases of lost or stolen documents, or expert forgeries.To help combat this we've built the document checking service (DCS) so that certified companies can check digitally – immediately – to make sure that a UK passport or driving licence from Great Britain matches a valid record.The identity provider submits the document details to the DCS, which forwards them to the correct document issuer (HM Passport Office or Driver and Vehicle Licensing Agency) for checking.Once checked, the DCS responds by notifying the certified company if the document details are valid or not. A failure might be because the details are incorrect the document has been revoked, reported lost or reported stolen. The identity provider can then carry out further verification to see if the person is who they say they are.Scanning ID documentsA number of our certified companies are incorporating identity document scanner technology into their processes to assess documents before the DCS is checked. The scanners assess a number of the features of the documents to help mitigate document fraud. The use of document scanners is becoming more frequent for both face-to face-and online processes across the UK government.We want to coordinate how government assesses the performance and security of identity document scanners as the technology underpinning this process develops. The GOV.UK Verify team are working with a cross government group to develop consistent evaluation criteria and standards for identity document scanners.GOV.UK Verify and the private sectorGOV.UK Verify is building a new market for identity services in the UK, in Europe and globally.The market around identity assurance is evolving rapidly as new technologies and capabilities emerge. We work with industry through the Open Identity Exchange (OIX) to explore how these capabilities can be applied to meet user needs. GOV.UK Verify – through the Cabinet Office – joined the OIX as a mechanism to collaborate with the market of suppliers in parallel with our contractual relationships with GOV.UK Verify certified companies.The needs of users of digital government services change as the private sector market evolves, new technologies are adopted and users adapt their behaviour to take advantage of developments. Discovery and alpha projects conducted under the OIX rules allow competing organisations to work together to address some of the complex issues that the fast-moving identity assurance market reveals.Government working with the private sector transparently through an organisation like OIX means that there are clear rules of the game, a substantial demand for services meeting those rules from government and other sectors, and a clear incentive for the market to invest to build new solutions.International identityMany countries – including the US, Australia and Canada – are now looking to GOV.UK Verify as an example of how to approach secure, straightforward identity assurance for citizens. That's a huge responsibility. Closer to home, we've been working with colleagues in the European Commission to help make it possible for residents of EU Member States to use GOV.UK Verify to identify themselves when accessing services in other European countries. This could include car registration, paying taxes or setting up a business elsewhere in Europe.The European Commission's work in this area is part of a wider programme to create a digital single market, of which identity is an important part.In the future people may also be able to give consent for services to access information, such as health or education records, wherever they are in the EU. This could be important when seeking medical assistance abroad or applying to study in another European country.The GOV.UK Verify team is working on the technical infrastructure to make this all happen, although our priority is continuing that constant process of iteration and development to prepare the service for live in just 3 months time.

Also in the news:

SITA and Cluj Avram Iancu Airport forge collaboration to redefine airport innovation and sustainability Thai FM to cancel ePassport bidding Naranja chooses Auth0