GDS lays down law on council Verify adoption criteria
lucbouchard 9 September 2016
Local authorities are being invited by the Government Digital Service (GDS) to apply to help build and trial services to assign concessionary travel for the elderly and parking permits based on the GOV.UK Verify platform.
After the completion of discovery work focused on potential options to expand the central government identity assurance platform for specific services offered by local authorities, GDS has now set out stringent criteria and timescales that authorities need to meet to take part in the pilots to develop solutions.
In return, the organisation said it would provide free GOV.UK Verify accounts for use by local authorities during private beta service phases.
Some critics have questioned why Verify, which is presently used by select Whitehall departments to allow individual users to apply for services online with medium to low assurance needs, would be needed for some of the local council permit services.
Particular concern was raised with regard to its use on parking permit service where a registered vehicle can already be checked against a certain area range to prove eligibility.
However, GDS claimed that both parking permits and travel passes had been chosen for pilots as they were in use by many councils and could benefit from use of GOV.UK Verify.
The platform allows users to select one of several pre-chosen companies to perform a check on their identity in order to access government online services at a level of assurance (LOA) 2 security standard. This equates to a level of assurance for identity services that would stand up in a civil court.
"Our plan is to work with as many councils as we can to meet our requirements and transform each pilot service from end-to-end," said a GDS blog post on the work.
"Councils will commit to collaboratively redesigning the local service to make it as great as it can be, using common standards and GOV.UK Verify. GDS will support the process with service design, user research and technical guidance, business case development, and project coordination."
With GDS expected to support councils with service design, user research and wider technical guidance and coordination, authorities will be expected to meet a number of criteria including managing any potential solution in-house and making the technology available in an open source format.
These requirements include requesting applicable authorities have a team in place to develop the pilot services that must include a single point of contact, as well as technical, information security, customer services and parking or concessionary travel service experience.
Councils will also be expected to commit to the GDS Service Standard in developing end-to-end functionality built around Verify, along with the Cabinet Office Code of Interoperability and the government's identity assurance principles.
In line with these standards, applicable authorities must also select a second senior manager, as well as having a senior information risk owner or chief information security officer to sign up to the project to display sufficient engagement within the council.
"Councils must manage the service in-house and have the ability to change any part of the service, from web forms to customer relationship management (CRM) systems, throughout the project period" added GDS. "If suppliers are required to make these changes, councils need their commitment to working within the terms of the pilot."
GDS said it was now looking for councils to take an informed decision over signing up for the pilot projects and how they may wish to tackle key operational needs for these services over the next 12 months.
"Likewise, for those that can't join at this stage, we hope this information helps them prepare to work with us in the future," the organisation said.
A source with knowledge of global identity initiatives has questioned why parking permits would need to make use of an ID assurance solution like Verify as opposed to existing records and information held by groups like insurance companies.
In the case of council services that require a level of assurance to allow online access that is beyond the low to medium scope of Verify, questions were also raised about the overall effectiveness of the ID platform.
"For (at least local) government, you can sensibly have high assurance enrolment offline (to be done once) and subsequent lesser assurance (in a variety of ways, public or private) to allow a user say it's me again," said the source. "Not an online Utopia, but why wait for that?"
An alternative gateway
Meanwhile, there is also uncertainty over the future of the legacy Government Gateway service, used by public sector authorities including departments like HM Revenue and Customs (HMRC) to access its online business service functions that are out of Verify's scope.
The Government Gateway is presently used as the centralised registration system to access local and national government services online, requiring users or organisations to create an account and provide a number of personal details to ensure secure access.
Plans to move off the gateway are said by the Department of Work and Pensions to be in the process of being "firmed up", with the department in May selecting Dell to help maintain and decommission the legacy technology under a two year contract valued at £819,686.
It is understood that the contract will actually focus on transitioning from outdated hardware used to support the gateway, rather than putting in place an entirely new service – effectively extending the current system's lifespan.
However, the identity initiative source was critical over the long-term future for continued use for local government of the gateway, arguing that the lifespan of the "creaking system" was expected to be quietly extended before an eventual shutdown.
New GOV.UK Verify lead mulls devolution and NHS potential
Government Gateway replacement plan to be "firmed up"
Verizon "temporarily removed" as GOV.UK Verify ID provider