GDS, HMRC and Verify: so much for cross-government digital collaboration

Less than a week after Cabinet Office minister Ben Gummer announced the new government transformation strategy, its central premise is already in question after HM Revenue & Customs (HMRC) rejected one of the core systems at the heart of the digital plan.

HMRC has been in a fight with the Cabinet Office for months over the use of Gov.uk Verify, the online identity assurance service being developed by the Government Digital Service (GDS) as the standard ID platform for the public sector.

Verify is central to the GDS plan – Gummer set a target of 25 million users by 2020 in the new strategy. GDS’s vision of digital government starts from the basis that every citizen who wants to transact online with public services will use Verify to prove who they say they are. GDS is so confident in the system’s eventual ubiquity that it is courting banks, e-commerce companies and local authorities to take part.

But Verify has now been rejected by the department with the biggest single base of online users. The fight is over and HMRC has declared independence.

A blog post published by HMRC programme director Mike Howes-Roberts reveals that the taxman is going its own way and will not be using Verify.

“HMRC is developing its own identity solution for individuals, businesses and agents. Other departments will use Gov.uk Verify for all individual citizen services,” he wrote.

[Update 1: 14 February 3.45pm – This above quote has mysteriously been erased from the original HMRC blog post since this article was published – the screen grab below shows the original version]

Howes-Roberts added: “We’re exploring options around other government departments also using this replacement service. This would be restricted to business and agent-facing services only as Cabinet Office requires all other departments to use Gov.uk Verify.”

The “replacement service” Howes-Roberts refers to is the successor to the Government Gateway – the identity system used by HMRC for tax self-assessment and business tax submissions, which is also at the heart of the Making Tax Digital project. Gateway was introduced in 2001 and is being phased out by March 2018 – it’s old and antiquated and needs replacing, but GDS intended that replacement to be Verify.

Gateway has survived many attempts to phase it out, but has continued to be used for so long for a very simple reason – it works.

Howes-Roberts says that Gateway supports 123 live digital services across government, 406 million identity authentications a year, and has more than 50 million active accounts.

Compare that with Verify, which after nearly five years of development has just 1.1 million users, has been used for 2.6 million authentications, and is used by only 12 online services – and five of those are HMRC services where Verify has been tested against Gateway and, it seems, has lost.

HMRC has continually sidestepped GDS over Verify. One well-placed source told me late last year that HMRC CEO and permanent secretary Jon Thompson told GDS chief Kevin Cunnington that his department had rejected Verify after another attempt to prove that Verify was the better option.

The same source also suggested that HMRC is working on its own version of Gov.uk Notify – the GDS platform for electronic status notifications – despite being told by the Cabinet Office that it should not.

Presumably, Gummer knew about HMRC’s intention when he launched the transformation strategy last week, and still believes that Verify can expand to 25 million users over the next three years – but surely that figure assumed HMRC’s users would be migrated to Verify?

The next largest government service on Verify should be Universal Credit – but that won’t be fully rolled out until 2022. Trials are underway with local authorities, but Whitehall has no power to mandate use of Verify to councils – clearly it can’t even mandate to its own departments.

And will banks and online companies really adopt Verify at scale, if even the government’s own biggest potential user has rejected it?

HMRC’s main issue with Verify has always been that it is only intended for individuals to use, whereas Gateway also offers ID assurance for businesses and intermediaries (such as accountants who file tax returns on behalf of clients). GDS has stubbornly refused to expand Verify for use by organisations as well as individuals – a decision that may prove to be fatal flaw.

It is patently stupid – not to mention a huge waste of money – for government to maintain multiple identity systems for citizens to use when accessing public services. For the greater good, someone has to lose face and take the inevitable flak. If HMRC is developing a successor to Gateway with a user base nearly 50 times that of Verify, why not simply re-use the HMRC system across government?

It would appear that the Gateway replacement is already going to be used across Whitehall for businesses and intermediaries – but with Verify used everywhere except HMRC for individuals. Seriously, who thinks that make sense?

Gummer talked last week about the importance of “culture change” and “collaboration” in delivering digital transformation across government – and he acknowledged that GDS and departments need to work better together. “When money is tight people have to look for new ways to do things, so it encourages reform. It encourages a degree of collaboration which is new,” he said.

If money is tight, it’s plainly nonsensical to develop two systems for the same purpose. If Gummer has failed to get the biggest potential Verify customer on board, what does that say for future attempts to promote collaboration and shared platforms? If culture change is needed, perhaps the culture in the Cabinet Office must do so first.

GDS needs to swallow hard and change course over Verify, no matter how much it feels let down by HMRC’s intransigence. The new transformation strategy promotes the idea of shared platforms, developed for use across government, and it encourages departments to share platforms wherever possible. GDS doesn’t have to build everything itself – and it doesn’t want to.

If HMRC is developing a new pan-government shared identity platform, it should become the standard. Let’s even call it Verify – that way you don’t have to reprint the new transformation strategy.

Update 2: 15 February 11.30am: After the HMRC blog post was amended, HMRC provided the following statement to Computer Weekly: “HMRC is committed to Verify as the single identification service for individuals and is fully focused on delivering this. The authentication service that HMRC is developing to replace the Government Gateway will complement the existing Verify service for business representatives.”

It’s worth noting that this line is almost the exact opposite of what was originally written in the blog post.