Online ID in the UK

The UK government has launched the Office for Digital Identities and Attribute (OfDIA), a group within the Department for Science, Innovation, and Technology, tasked with encouraging the growth of the digital ID market under the leadership of chief executive Hannah Rutter.

In fact the Labour government is continuing with a Tory idea that was first announced by the previous government in 2022.

Rutter claimed that digital identity can make people's lives easier, and unlock billions of pounds of economic growth.

Rutter made sure to address one of the criticisms regarding the security of such schemes -- centralization -- by saying that the system her office is working on does not have a centralized digital database.

Currently, OfDIA is working to create a trusted and secure digital identity market and this work focuses on five areas, starting with developing and maintaining the digital identity and framework, and then being in charge of a register of accredited organizations that meet the framework's requirements.

Britain's cinemas are to introduce digital ID cards for adults and children as proof of age for entry to age restricted films.

The UK Cinema Association, which represents 90% of cinemas, will from Monday accept a digital ID app which confirms the age of an adult or child to box office staff based on a previously uploaded official ID document such as a passport.

The technology, developed by digital ID provider Yoti is part of a wider move towards digital IDs for adults and children where there are restrictions on age-related products.

The Home Office is trialling Yoti's AI facial photo checks that can estimate age and its apps at supermarket checkouts to prevent children buying alcohol. If successful, ministers will consider amending the law to allow digital age checks for alcohol sales. It is not allowed under current legislation.  About 3 million Brits have already downloaded the Yoti app.

To obtain the digital age ID app, the person has to prove identity with a document such as a passport then take a live picture to confirm. The information is stored in a government-grade database that Yoti  claims it does not have access to and which can be erased at any time by the individual. However it should be noted that similar systems used for online ID generally maintained a full database of usage supposedly for 'fraud prevention' auditing.

The digital ID card shows the verified photo of the individual and their age as over 18, 15 or 12. There is a hologram on the card that moves when the phone is tilted to prevent spoofing. However this suggests that phones will have to be handed over to cinema staff to check the hologram.

The government writes:

A new call for evidence will explore the role of government and the private sector in the development of digital identities - the way people prove they are who they say they are using digital technology - and seek views on how to achieve higher levels of trust between the public and organisations checking their identities.

Err...how about making it totally illegal for organisations to use sensitive data. How about no more government laws that let age verification providers do what the fuck they like with your porn browsing data? No more 'voluntary standards' governing the keeping of porn browsing data?

The government continues:

With people increasingly required to prove their identity to access services, whether it is to buy age-restricted items on and offline or make it easier to register at a new GP surgery, these plans aim to help make doing so easier and more secure.

By cutting down on the need for physical documents, which could be misplaced or stolen, they also aim to reduce fraud. Reports suggest that unlocking the value of digital identity could add 3 per cent to UK GDP by 2030 - positioning the country as a world-leading place to develop cutting-edge innovation.

Recent figures show identity fraud is a growing problem across the UK and last year the fraud prevention service Cifas reported 189,000 incidents of identity theft.

Err... so how is it going to make it safer to put all your ID eggs in one basket and pass the basket around to all and sundry.

The government continues:

A small pilot scheme will be launched to help people speed up their applications for services, for example applying for a credit card, by allowing organisations to digitally check their identity using British passport data, where they have used this to register for government services. It will begin with companies who currently provide digital identity services to Government.

Individuals applying to access selected services online could have their identity verified this way if they choose to. The scheme will then be opened up to a small cohort of additional private sector companies for use across a range of services.

Err... like Facebook, Google, Cambridge Analytica, Ashley Madison, Pornhub...

The government continues:

No organisation would be given access to government-held data under these proposals, identity providers would simply get a yes or no as to whether the document was validly issued, and no personal data not already provided by the individual would be used or shared.

Any new solutions will be compliant with recently strengthened data protection laws and set out requirements for the secure transfer of data. There will be no central identity database and individuals will be in control of their personal data.

The pilot scheme will also test if there is a market for these new types of digital identity checking services.

Despite concern among some groups of witnesses, a shift in approach in the UK Government's position seems on the horizon. The Minister for Digital and the Creative industries, for example, implied support for a universal digital ID in a recent interview with The Daily Telegraph in 2019:

think there are advantages of a universally acclaimed digital ID system which nowhere in the world has yet. There is a great prize to be won once the technology and the public's confidence are reconciled.

On 11 June 2019, DCMS and the Cabinet Office announced their intentions to launch a consultation on digital identify verification in the coming weeks. The following actions were set out:

• A consultation to be issued in the coming weeks on how to deliver the effective organisation of the digital identity market.

• The creation of a new Digital Identity Unit, which is a collaboration between DCMS and Cabinet Office. The Unit will help bring the public and private sector together, ensure the adoption of interoperable standards, specification and schemes, and deliver on the outcome of the consultation.

• The start of engagement on the commercial framework for using digital identities from the private sector for the period from April 2020 to ensure the continued delivery of public services.

Single unique identifiers for citizens can transform the efficiency and transparency of Government services. We welcome the Government's announcement in June 2019 that it will consult shortly on digital identity. While we recognise that in the UK there are concerns about some of the features of a single unique identifier, as demonstrated by the public reaction to the 2006 Identity Card Act, we believe that the Government should recognise the value of consistent identity verification. The Government should facilitate a national debate on single unique identifiers for citizens to use for accessing public services along with the right of the citizen to know exactly what the Government is doing with their data.

Offline Comment: Privacy International explains some of the reasons why this is a bad idea

14th July 2019. See article from privacyinternational.org

The debate shouldn't be about having insight into how your identifier is used. It should be about making sure that identifiers are never usable.

After all, any unique identifier will not be limited to government use. Whether through design or commercial necessity, any such number will also find it's way into the private sector. This was another fear highlighted in the mid-2000s, but it has played out elsewhere. For example, the Indian Supreme Court, in their ruling on the Aadhaar system that provided a unique number to more than a billion people, that there were dangers of its use in the private sector: Allowing private entities to use Aadhaar numbers will lead to commercial exploitation of an individual's personal data without his/her consent and could lead to individual profiling.

Given everything that's happened since, the 13 years since the 2006 ID Card Act (that was repealed in 2010) can seem like a lifetime. But it's clear that the concerns expressed then remain prescient now. Now that we know so much more about the risks that the exploitation of people's data plays - and the targeting, profiling and manipulating of individuals and groups - we should be even more fearful today of such a system than we were a decade ago. Furthermore, it's been shown that we do not need such a unique identifier for people to securely access government services online, and it's on such concepts we must build going forward.

See the full article from privacyinternational.org

Digital ID was discussed by the Commons Science and Technology Committee on 13th November 2018.

Carol Monaghan Committee Member:  At the moment, platforms such as Facebook require age verification, but that simply means entering a date of birth, and children can change that. If you are planning to extend that, or look at how it might apply to other social media, how confident are you that the age verification processes would be robust enough to cope?

Margot James MP, Minister for Digital and the Creative Industries: At the moment, I do not think that we would be, but age verification tools and techniques are developing at pace, and we keep abreast of developments. At the moment , we think we have a robust means by which to verify people's age at 18; the challenge is to develop tools that can verify people's age at a younger age, such as 13. Those techniques are not robust enough yet, but a lot of technological research is going on, and I am reasonably confident that, over the next few years, there will be robust means by which to identify age at younger than 18.

Stephen Metcalfe Committee Member: My question is on the same point about how we can create a verification system that you cannot just get around by putting in a fake date of birth. I assume that the verification for 18 - plus is based around some sort of credit card, or some sort of bank card. The issue there is that, potentially, someone could borrow another person's card, because it does not require secret information--it requires just the entering of the 16-digit number, or something. But on the younger ages, given that we are talking about digital life and digital literacy, do you think that the time has come to talk about having a digital verified ID that young people get and which you cannot fiddle with--a bit like an online ID card, or digital passport? I know that that idea has been around a little while.

Margot James: It has. I do think that the time has come when that is required, but there are considerable hoops to go through before we can arrive at a system of digital identity, including someone's age, that is acknowledged, respected and entered into by the vast majority of people. As you probably know, the Government have committed in prior years to the Verify system, which we think has got as far as it can go, which is not far enough. We have a team of excellent policy officials in the DCMS looking afresh at other techniques of digital identity. It is a live issue and there have been many attempts at it; there is frustration, and not everybody would agree with what I have said. But you asked my view, and that is it--and the Department is focusing a lot of energy on that area of research.

Chair: Can you imagine that your legislation, when it comes, could include the concept, to which Stephen referred, of a digital identity for children?

Margot James: That is a long way off--or it is not next year, and probably not the year after, given how much consultation it would require. The new work has only just started, so it is not a short-term solution, and I do not expect to see it as part of our White Paper that we publish this winter. That does not mean to say that we do not think that it is important; we are working towards getting a system that we think could have public support.

To go slightly beyond the terms of your inquiry, with regard to the potential for delivering a proper digital relationship between citizen and G overnment through delivery of public services, a digital identity system will be important. We feel that public service delivery has a huge amount to gain from the digital solution.

Bill Grant Committee Member:: I am pleased to note that the Government are addressing issues that have been with us for nearly a decade--the dark side of social media and the risk to children, not least the risk that we all experience as parliamentarians. Can you offer any reason why it has taken so long for Government to begin that process? Would you be minded to accelerate the process to address the belated start?

Margot James: One reason is that progress has been made by working with technology companies. The Home Office has had considerable success in working with technology companies to eradicate terrorist content online. To a lesser but still significant extent, progress has also been made on a voluntary basis with the reduction in child abuse images and child sexual exploitation. I said "significant , " but this is a Home Office area--I am working closely with the Home Office, because the White Paper is being developed in concert with it--and it is clear that it does not feel that anything like enough is being done through voluntary measures.

Chair: Do you feel that?

Margot James: Yes, I do. A lot of the highly dangerous material has gone under the radar in the dark web, but too much material is still available, apparently, on various platforms, and it takes them too long to remove it.

Chair: Ultimately, the voluntary approach is not working adequately.

Margot James: Exactly--that is our view now. I was trying to address the hon. Member's question about why it had taken a long time. Partly it is that technology changes very fast , but, partly, it is because voluntary engagement was delivering, but it has impressed itself on us in the last 12 months that it is not delivering fast enough or adequately. We have not even talked about the vast range of other harms, some of which are illegal and some legal but harmful, and some in the grey area in between, where decidedly inadequate progress has been made as a result of the many instances of voluntary engagement, not just between the Government and the technology sector but between charitable organisations and non-governmental organisations, including the police.

Bill Grant: It was envisaged earlier that there would be some sort of regulator or ombudsman, but , over and above that , Martha Lane Fox's think - tank proposed the establishment of an office for responsible technology, which would be overarching, in whatever form the regulation comes. Would you be minded to take that on board?

Margot James: That is one proposal that we will certainly look at, yes. Martha Lane Fox does a lot of very good work in this area, has many years' experience of it, and runs a very good organisation in the "tech for good" environment, so her proposals are well worth consideration. That is one reason why I was unable to give a specific answer earlier, because there are good ideas, and they all need proper evaluation. When the White Paper is published, we will engage with you and any other interested party , and invite other organisations to contribute to our thinking, prior to the final legislation being put before Parliament and firming up the non-legislative measures, which are crucial. We all know that legislation does not solve every ill, and it is crucial that we continue the very good work being done by many internet companies to improve the overall environment.

An Online ID card will be launched in the UK next month. The scheme is initially targetted for transaction with government agencies such as the tax office and the DVLA.

The Government was a bit too quick to deny it was bringing in ID cards by the back door after it revealed plans to offer everyone a virtual ID. Government aides claimed in a rather circular argument that rather than bringing in ID cards by a different method the scheme would make any attempt to reintroduce a compulsory document less likely:

This removes once and for all the need for an identity card because it will be possible to prove your identity securely without one.

More than half a million people are expected to sign up to use the Verify project within a year. Under the programme, users will choose one of five private providers -- including Experian and the Post Office -- to complete an online security check.

This will give them a username and password, as well as a code sent to their mobile phone, which will give them access to government services.

Driving licences and some self-assessment tax returns will be among the first services to be offered as part of the scheme next month, with tax credits and benefits records expected to follow in March.

Emma Carr, director of Big Brother Watch, which has been involved in the scheme's development, said:

 It has to ensure that this is a scheme that the public can have full confidence in. They must make themselves very clear about how it will work, including details of what safeguards are in place to ensure that the private companies being used to verify a users identity won't wrongly gain access to any information.'