The National Audit Office (NAO) has joined the chorus of a criticism of GOV.UK Verify programme with a report that says the continuation of the programme has not been justified.
It says that the identity assurance platform, which has been developed by the Government Digital Service (GDS) in the Cabinet Office, has performed below the standards initially set and that take-up among the public and government departments has been much lower than expected.
This has created a situation in which potential users do not know what price they will have to pay to verify identities in the future, departments cannot assess their likely costs, and it is not possible to assess future demand for the service.
In its conclusion, the NAO says: “Verify is an example of many of the failings in major programmes that we often see, including optimism bias and failure to set clear objectives. Even in the context of GDS’s redefined objectives for the programme, it is difficult to conclude that successive decisions to continue with Verify have been sufficiently justified.”
Verify went live in May 2016, providing public sector organisations with the option of authenticating people’s identities for online services through a group of private sector identity providers that carry out the initial verification. It was originally intended for the service to be self-funding by 2018, and in the Government Transformation Strategy of 2016 it was forecast it would have 25 million people signed up by 2020.
But progress has been highly disappointing. The NAO reports that by February of this year only 3.6 million people had signed up, just 19 government services were using Verify – of which 11 could be accessed through other online systems – and the vast majority of its funds are still coming from central government.
Several failings
The report lists a number of failings against the original plan for the programme:
-
The estimated financial benefits to government have been revised down from £873 billion up to 2019-20 to £217 million.
-
The verification success rate for people signing up to Verify was reported at just 48% last month, against an earlier projection of 90%.
-
While the biggest customer for Verify is the Department for Work and Pensions (DWP) for universal credit claims, but claimants had experienced problems and only 38% of those using it had been able to prove their identity online, prompting the DWP to provide £12 million to support its operation until March of next year and work with GDS on an improvement plan.
-
The cost has been at least £154 million up to December 2018, but this is likely to be an underestimate as it does not include costs of departments reconfiguring their systems.
-
Only one of the seven departments using Verify (HM Revenue & Customs) has paid for the service.
Since the programme was launched in 2011 it has been subject to over 20 internal and external reviews, the most damning of which came in July 2018 when the Infrastructure and Projects Authority recommended that Verify be closed as quickly as practicable.
But GDS has pushed ahead. Last October there was a reset in which responsibility for increasing take-up was passed to the remaining private sector identity providers, the Government indicated it will provide no more money from April of next year, and at the same time GDS will withdraw from its operational role.
Following this, GDS set up a cross-departmental governance board for Verify – the Secure Government Services Board – to support its delivery and work on optimising it for universal credit. And in December it pointed to a fresh push to increase usage in public and private sectors.
Forward plans
A couple of more forward looking plans emerge from the report. One is that the board is also looking at the data and standards needed to underpin an effective digital identity market and ensure Verify can work with international identity schemes. This is accompanied by GDS working with the Department for Digital, Culture, Media and Sport (DCMS) on mechanisms to support the development of the market.
In addition, GDS and DCMS are coordinating with the Home Office so that government identity data can be safely queried in the public and private sectors.
Publication of the report prompted a sharp criticism of the programme from Meg Hillier, chair of the Commons Public Accounts Committee.
“The government’s flagship identity verification platform is a textbook case of government’s over-optimism and programme management failure,” she said. “Despite spending at least £154 million on Verify, only half the people that try to sign up are able to use it and take-up is much lower than expected.
“More worrying, it is not yet clear what it will cost for government departments to continue using Verify when government funding stops next year.”
Government response
In response to the report, the Cabinet Office issued a statement saying: "Verify is saving taxpayers money and is a world leading project in its field. The NAO report reflects that it has been a challenging project – but challenges like these are to be expected when the Government is working at the forefront of new technology.
“We now believe that Verify is at a point where it can be taken forward by the private sector to provide a single source for people to confirm their identities online.
“This will see the Government’s investment in the project cut back as the private sector takes it forward. This ensures Verify will continue to enable people to access services easily online, while protecting them from organised crime, identity fraud, and other malicious online activity."
However, IT industry association techUK has supported the critical message in the NAO report. Its director of market programmes, Matthew Evans, commented: "techUK finds much to agree with in the report from the National Audit Office on Verify.
"It is clear that there is a pressing need in the UK for secure digital identities which can be widely used by companies and individuals. This is essential if the UK is to fully reap the benefits of the shift to a digital economy and of innovative digital services.
"We note that the Government intends the Verify scheme to be operated by private providers by 2020 – but this is will be too little too late. We are in danger of falling behind as other countries surge ahead with digital IDs."
Last month techUK urged the Government to urgently publish plans for the future development of Verify and to establish a policy for digital identity ecosystem.
The final word is likely to come from the IPA, which is planning to conduct a concluding review as Verify comes to the end of its time as a government project.
Image from GOV.UK, Open Government Licence v3.0
