“Don’t you know who I am?”

Teacamp is one of the best places to have a frank discussion about the state of digital projects. Yesterday Janet from the Identity Assurance team came to discuss how the programme is going, and gave a broad overview of the project as well as a nuanced and detailed description of some of the ways that the end product is going to work.

There were loads of interesting questions, especially considering that the idea of Government and Identity (capitals for big concepts) had a bit of a run-in in 2008 with the ID Card programme. Highlights included:

#teacamp what happens if an IAP goes bust? Or stops offering the service. Does the authentication remain valid?

— Terence Eden (@edent) May 1, 2014

At #teacamp. @JanetHughes is fucking impressive. — Paul Clarke (@paul_clarke) May 1, 2014

Answer from #teacamp – if your IAP goes bust, you have to reauthenticate. A sensible, if somewhat user unfriendly, solution.

— Terence Eden (@edent) May 1, 2014

And here is the nub of it all: this is complicated stuff. It isn’t easy. It isn’t going to be popular. It is going to be a faff. Rough edges can be smoothed by user testing, but this isn’t going to be an interaction that you would necessarily want to do.

Outsourcing the verification of your identity to the private sector is difficult. It shifts the burden of good data handling to organisations that (potentially) you might not want to handle your data. It remains to be seen whether this is something that can be ironed out, or if it is something that anyone cares about in user testing. Janet pointed out that in testing, no users had clicked on accompanying information about the rated performance of an identity provider. That’s worrying, not just because of the trusting nature of people, but also because it could politically remove the prioritisation for protecting the public from shady information handlers.

It’s interesting seeing the exemplar programme take shape, and seeing how the identity programme could eventually work. My trouble with it is though that it sounds difficult. It sounds like a hassle. I raised the point that in the Individual Voter Registration exemplar you can use your name, address and national insurance number to register. That’s it.

The thing is, if you are young and live in a city, you’re less likely to be on the bills. You might not even be on the tenancy agreement if you’re subletting. It gets harder and harder to prove your ID if you’re in a precarious living situation (as hundreds of thousands are in London and elsewhere). This is where tyranny of the majority can kick in with prioritisation, leaving you in a Kafka-esque situation of not being able to prove who you are. The IER demo above lets you register to change the government on three pieces of information. I can’t think of anything that would philosophically require more “security”.

It was also mentioned that it is illegal to use National Insurance as a UID. Ironically, this is coming from a government department. Law is eminently changeable.
On the other hand, some of the questions seemed a bit pointless. People saying that the old ID gateway (14 years old this year, so legally able to order a half of cider or perry with a meal in a pub) had a difficulty rating that meant that it was more secure (I assume, a version of the old “security through obscurity” routine) were particularly off piste. Good software is good. Binning old code isn’t necessarily good, but neither is it necessarily bad. Judge the end product and try to shape it first.

This project shouldn’t be greeted with heckling from the gallery. This is a knotty problem that basically no government has got totally right. I’m glad they’re trying as hard as they are, and Janet gave incredibly thoughtful answers. The thing is that this exemplar matters as much as the ID cards did in 2008.

Let’s hope there are more events like this, and that we see more about the project and the rationale for choices and more chance to influence the conversation.