Know your citizen: HMRC’s online identity system

aat comment

The UK’s House of Commons is famous — or perhaps infamous — for its lively conduct.

Our politicians have been known to tease and trade insults across the chamber with abandon. Anyone who thinks government bickering is limited to Westminster hasn’t been keeping up with events in Whitehall, home of the civil service, where earlier this year tensions flared over the issue of digital identity verification.

It all started when the Government Digital Service, a division of the Cabinet Office, launched its Verify online identity verification service in May 2016. Up until this point, citizens had to use the outdated Government Gateway portal to access government services.

Under the old system, individuals wanting to file their taxes or check the details of their driving license were subject to a lengthy verification process. First they were issued a verification code via post, which could take up to one week to arrive. Once it did, users were given 28 days to activate it.

Simplify with Verify

In the digital age, relying on ‘snail mail’ to relay vital information hardly seems efficient or effective. This is where Verify comes in: offering users a comparatively quick 15-minute identity verification process through the GOV.UK website. The system relies on a handful of certified companies — including Barclays, Experian and the Post Office — to perform necessary checks and confirm user identities to the government department being accessed.

“By using data gathered by others, HMRC avoids a need to reinvent the wheel,” explains Brian Palmer, AAT’s tax policy advisor and a member of HMRC’s joint initiative steering group, a forum for professional bodies to engage with tax policies. “Third-party services, such as Experian, Royal Mail, UK Banks and others have already invested heavily in establishing robust identification and verification systems. As a result, they are experts in the field.”

Verify is also an integral part of the government’s transformation strategy to improve online access to public services. The Cabinet Office plan, launched on 9 February, promised to accelerate the rollout of the identity programme, with the goal of having 25 million users by the end of the decade. With speed and security on its side, Verify appeared ready for mainstream adoption across the public sector — until HMRC put a spanner in the works.

In a blog post published just a few days after the government’s digital transformation plan, Mike Howes-Roberts, HMRC programme director for transforming Government Gateway, confirmed that the tax authority was developing its own identity verification system.

Gateway for security

There are a number of reasons that HMRC might want to develop its own bespoke identity verification service. First of all, the Verify system is designed to identify individual citizens, and not accountants or businesses, which is a function HMRC must perform. The programme has also had some notable uptake issues, with just 1.28 million users creating an account on the platform to date.

Verify’s own performance dashboard shows that on average fewer than half of users are able to successfully complete the Verify process. These aren’t necessarily numbers that will inspire faith in the system, especially when users are consenting to third parties handling their personally identifiable information.

According to the researchers from University College London, the system’s central hub — which facilitates communication between government departments, third parties and citizens — could easily give up users’ private information if compromised by hackers. In the wake of the WannaCry malware attack that paralysed the NHS earlier this month, cybersecurity in government organisations seems more important than ever.

“It makes sense for HMRC to reduce its operating costs by utilising the benefits of computer technology,” says Aleem Islan, technical consultation manager at AAT.  “The problem is that the Internet is an ‘open system’ that allows users anonymity and it is this anonymity that is exploited by fraudsters. So, identity verification systems are the first, and probably the most important, step in preventing and identifying frauds upon HMRC’s systems.”

However, issues with security and functionality have not steered the revenue service away from Verify for good. The authentication service that HMRC is developing will not be a substitute for Verify, but will provide complementary identity services for the UK’s businesses, a spokesperson told the BBC.

The long-running Government Gateway service is scheduled to come to an end in March 2018 and a transformation team has been set up to build its replacement. Only time will tell if HMRC will continue to use the Verify system to provide identity services to individuals, or whether it will switch to its own platform once it’s complete. Regardless of the outcome, citizens just want to know that their data is safe in the hands of the government.

Jesse Onslow Norton is a writer, editor and communications consultant at Flibl. A former coder, his editorial work focuses on fintech, digital transformation, policy and regulation. His clients include corporations, governments, startups and SMEs from across the world. Follow him on Twitter @JesseOnslow.

Related articles