Posted on: Wednesday 14th of November 2012
Following the announcement of the private sector Identity Providers that will start offering an identity assurance service to DWP customers, we spoke with Toby Stevens who has been closely involved with the Identity Assurance programme for several years, to ask his opinion on where it will lead us.
What is the overall significance of the IDA programme and this week’s announcement?
DWP’s award of ID Assurance contracts represents a watershed for the government’s approach to identity: instead of government relying solely upon government-issued credentials (e.g. Government Gateway) to transact with individuals online, they will support a new commercial market of Identity Providers (IDPs) who can act on individuals’ behalf.
This change is not just skin-deep, it will fundamentally alter the way that the public sector consumes identity-related data. Gone is the idea of a ‘gold standard’ of identity, to be replaced by ‘Levels of Assurance’ which measure IDPs’ confidence in the accuracy of data about the individual, and will be proportionate to the transaction requested. Individuals will be able to hold as many or as few credentials as they wish, and will be under no compulsion to have a credential at all, or to keep their data up to date. And departments will be blocked from creating alternative ID approaches – the Cabinet Office will ensure that we have a single ID ecosystem in the public sector.
How do you see the identity assurance market developing?
Over the next 18 months the selected IDPs will collaborate to develop their service offerings and a delivery Scheme which can handle the branding and governance for IDA services. DWP will pay those IDPs to register and maintain identities on a ‘per active user, per annum’ basis. After that time, other companies will be able to enter the IDP market, and we’re likely to see new financial models emerging; for example, social networks which operate at a lower Level of Assurance might offer free transactions to government in order to enhance their own online services, or mobile network operators could integrate IDA services into their customers’ accounts.
I would anticipate this resulting in an ‘attribute-driven’ market for IDA services, whereby government ceases to pay for identification of individuals, and instead pays providers to verify information asserted by those individuals; for example, DWP would not pay my IDP to know that I am Toby, but would pay my IDP to confirm my last year’s earnings when I assert them to DWP. This will create a demand-driven market for credit reference data and personal data stores which will disrupt the way that data providers sell to government.
When will it extend to transactions in the private sector?
One can argue that IDA will extend to transactions in the private sector from the moment that services go live; after all, if I have obtained a credential from an IDP then I need to be able to use that credential to access my IDPs’ services, so the IDP must be able to ‘consume’ IDA services. If it can consume its’ own IDA services, then all we need is for government’s Federation Hub(s) to permit use of credentials between IDPs and we have a market for transactions in the private sector.
What are some of the commercial challenges to making this market attractive to suppliers?
Government’s key challenge for the successful delivery of an IDA market is to persuade suppliers that the potential rewards outweigh the considerable delivery risks. Companies proposing to integrate IDA services into their systems and processes, open up their databases and users to IDA services, or rely upon IDA data, need comfort that their considerable investment will not be scuppered by failures in regulation, technology problems or a policy U-turn by government. Consumers will need education to understand how they can use commercial IDs to access public services, and will require assurance that if things go wrong then the Scheme can be trusted to put them right again. DWP’s procurement is designed to incentivise the first tranche of IDPs by reducing these risks to acceptable levels and making the new market an attractive proposition.
How does the IDA programme support or enable the Government’s midata initiative?
The IDA programme has been working with the government’s midata initiative, and IDA is a critical dependency for midata’s success: many of the midata providers who plan to open up their data stores to their customers do not yet have sufficiently trustworthy online ID mechanisms to ensure that only authorised customers receive data, and they all require a mechanism to aid aggregation and sharing of data by their customers in a trusted way. IDA is our best hope to provide that mechanism, and I would hope that midata partners are amongst the first commercial organisations to consume IDA transactions when services go into production.