GOV.UK Verify – the digital identity platform for the UK public sector

GOV.UK Verify is a secure way for people to prove who they are online. It enables people to create a ‘digital identity’ that can be trusted by public or private sector organisations. We have worked to align and map identity standards and ensure that GOV.UK Verify can be internationally interoperable.

Innovation Summary

Innovation Overview

The Internet has evolved without an identity layer. A cartoon caption that first surfaced in the New Yorker in 1993 read “On the Internet, nobody knows you're a dog.” This cartoon is still used today to articulate the importance of identity in remote digital transactions. The requirement for identity is essential to be able to establish trust with a customer. As digital services have evolved organisations have addressed the identity challenge for their own perceived risks.

The result has been variegated identity verification standards that leave customer data exposed and customers confused. Fraudsters exploit the current complexity of users having to remember multiple usernames and passwords. Data hacks make commonly-used identity verification processes based on personal data increasingly insecure. Cybercrime is a growing threat and identity fraud now accounts for over half of all fraud. A secure approach to digital identity is important to prevent identity fraud and cybercrime. When planning for future threats and risks, strong identity checking protections are an important consideration.

The UK government recognised this landscape when it commissioned the development of GOV.UK Verify, a federated digital identity infrastructure. Seven private sector ‘identity providers’ have been certified as meeting government standards. A user of digital public services may choose an identity provider to verify his or her identity. The resulting ‘digital identity’ is maintained by the identity provider and may be used in any subsequent transaction.

Each identity provider has different ways of verifying your identity. The identity provider may ask you some questions or perform other checks using photo identification and financial information before confirming your identity to the government department you’re trying to use (e.g. to HMRC if you’re doing your tax). Using identity providers makes GOV.UK Verify a safer, simpler and faster way of accessing government services online. It’s safe because information is not stored in one place and there’s no unnecessary sharing of information. The identity provider you choose doesn’t know which service you’re trying to access and the government department doesn’t know which identity provider you’ve chosen. It is all done online, without having to prove your identity in person or wait for something in the post.

GOV.UK Verify places the citizen at the heart of the transaction, considering their security and privacy. A citizen will be able to use their digital identity across their full digital life without their actions being tracked or profiled. An independent group of privacy advocates has been set up to provide advice to government on the development of the service. The Government Digital Service (GDS) has developed the platform through which public services can access the user’s choice of identity provider. A ‘limited visibility’ solution has been implemented to avoid any inference being made about the user’s choice of identity provider.

In addition to continuing with the rollout of GOV.UK Verify across central government, we also continue to explore the wider applications for GOV.UK Verify for secure citizen identity verification in both the wider public and private sectors. Collaborative projects have been conducted with banks, pension companies, airlines, employers and other companies to inform how this market should operate.

GDS has worked with international governments to align and map identity standards and ensure that GOV.UK Verify will be internationally interoperable for public and private sector transactions. GOV.UK Verify is designed to allow technological evolution. It takes about 15 minutes to verify your identity the first time you use GOV.UK Verify and a couple of minutes any time after that.

Innovation Description

What Makes Your Project Innovative?

Most European governments run national identity schemes that typically involve centrally-run public sector databases and national ID cards. The growth of digital services has motivated governments to implement electronic ID cards to allow their citizens to assert their identity for remote digital services. The UK Government closed its national ID card scheme in 2010.

The core of the innovation for GOV.UK Verify is that it places the citizen in control of their identity and protects their privacy. This approach is completely opposite to traditional governmental thinking for services, where the government is able to track a citizen's activity. Research has shown that the willingness for citizens to engage when the state is involved is very limited. The GOV.UK Verify method recognises citizens' needs for trustworthy identity across both public and private sector services.

What is the current status of your innovation?

To deliver transformed online services, it is necessary to establish that the user is who they say they are to a high degree of confidence. A secure digital identity is a prerequisite for government departments’ digital transformation programmes. Following two years as a beta service, GOV.UK Verify went live in 2016 and now provides access to 16 UK government services. This year, the first digital mortgage deed was entered into the UK Land Register. This service uses GOV.UK Verify to enable borrowers to securely verify their identity before digitally signing their mortgage deed online. Work has also begun collaborating with the NHS.

GOV.UK Verify is working on private sector involvement to grow the number of digital identities. The aim is for a ubiquitous digital identity for services in both the public and private sector. The aspiration is also that these would be interoperable with those from elsewhere. By working around the same standards, this interoperability can be ensured.

Innovation Development

Collaborations & Partnerships

GOV.UK Verify is delivered through collaboration between the public and private sector. The GOV.UK Verify team delivers the integration point to government services and the private sector companies deliver the identity provider technology and operational environments. The innovation is in the collaboration between both public and private sectors to achieve a trustworthy environment.

Users, Stakeholders & Beneficiaries

Core to developing GOV.UK Verify was the placement of the citizen at the centre of the service and therefore understanding their feedback was essential. Multiple user research activities were conducted and the feedback from these sessions were fed into an agile and iterative delivery process.

As privacy is a key aspect to secure digital identity, it was also essential to engage with the UK Privacy and Consumer Advisory Group (PCAG) to get their specific views on privacy.

Innovation Reflections

Results, Outcomes & Impacts

More than 3 million users are currently using Verify. It aims to provide a safe, secure, and simple service that will enable people to prove who they are online so they can access the services they need. We have seen a growing use of GOV.UK Verify, which now provides access to 16 government services, with more due to come online soon.

The act of creating GOV.UK Verify and the standards that surround it have had a profound effect on the identity ecosystem, both nationally and internationally. Verified identity is a basic building block of the digital economy, enabling users to interact with greater safety but also providing an approach for more meaningful digital transformation.

Challenges and Failures

The key challenge for GOV.UK Verify has been to engage with government departments and to convince them to adopt the service. It can be challenging to think of a customer-centric solution rather than a department-centric solution.

One of the challenges for the GOV.UK Verify team was innovating in a collaborative way across the public and private sector. By joining the board of Open Identity Exchange, we were able to drive forward innovation in an open, collaborative and transparent way. Proactive engagement with customers and understanding requirements from services, as well as appreciating the needs and expectations from industry and local authorities, have ensured continuous innovation.

The number of services using GOV.UK Verify is growing week by week but scaling the service has taken longer than originally anticipated, reflecting the complexity involved in building and transforming good digital services.

Conditions for Success

It’s critical to be solving a current service or delivery problem that is well understood, well defined and agreed by stakeholders. It must be a problem that requires a technology innovation to solve it and for which the answer won't be obvious or already available in the market. Ideally other organisations will be able to benefit from this challenge being solved so they too can use the solution.

In the case of digital ID, having this clear vision has set a strategic direction for the Government, which has unlocked a whole new market of identity services. There is real value in government showing leadership in the areas of standards and product development, as well as fostering a culture of collaboration. In the UK this has enabled successful cross-over with other sectors, for example, digital identity has a role in facilitating compliance with Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations.

Replication

The core innovation of thinking about the citizen first and placing them in direct control of their data could be leveraged across government departments for other citizen-facing services. The transition from service-led design to design informed by the needs of the citizen is challenging but essential. This is a cultural shift for many government departments. Engaging critics early on in the design process is also a practice that could be replicated by government departments.

Lessons Learned

There is significant value in working with a range of stakeholders to ensure balanced delivery. This includes engaging with critics and sceptics. A transparent approach to engagement across the public and private sectors ensures that all stakeholders are involved in the journey. Working to change something that will have a significant impact on people's lives can be a continual challenge.

For digital identity, communicating the security benefits is important, particularly the role of these benefits in preventing cybercrime and identity fraud. A secure approach to digital identity is essential to preventing cybercrime and mitigating the risk of a major data breach. When considering and mitigating against future online threats and risks, it is worthwhile to examine stronger identity checking protections for online transactions.

Anything Else?

Successful innovations need a strong team who can build confidence in the idea, with markets, users and other parts of government. The key to this is getting the upfront investment right, both in terms of strong senior support and enough money to allow the idea and team to move quickly. A clear policy will underpin the vision, which is outcome-focused ideally, rather than specifying solutions, to allow the team or the market to innovate in the space. The policy will add enough support to make it easy for people to invest time and money in the idea but not be so prescriptive that it stifles or curtails how the idea progresses.

🇬🇧