Consumer empowerment think-tank Ctrl-Shift is carrying an interview with me on the significance of the Identity Assurance programme, in which I speculate on how IDA will grow over the coming months and years:
How do you see the identity assurance market developing?
Over the next 18 months the selected IDPs will collaborate to develop their service offerings and a delivery Scheme which can handle the branding and governance for IDA services. DWP will pay those IDPs to register and maintain identities on a 'per active user, per annum' basis. After that time, other companies will be able to enter the IDP market, and we're likely to see new financial models emerging; for example, social networks which operate at a lower Level of Assurance might offer free transactions to government in order to enhance their own online services, or mobile network operators could integrate IDA services into their customers' accounts.
I would anticipate this resulting in an 'attribute-driven' market for IDA services, whereby government ceases to pay for identification of individuals, and instead pays providers to verify information asserted by those individuals; for example, DWP would not pay my IDP to know that I am Toby, but would pay my IDP to confirm my last year's earnings when I assert them to DWP. This will create a demand-driven market for credit reference data and personal data stores which will disrupt the way that data providers sell to government.
You can find the full version of the interview here.
Subscribe to blog feed
1. In How I learned to stop worrying and love identity assurance, 16 October 2012, you say that you came to support IdA because “nature abhors a vacuum, and without a clear strategy for population-scale ID, what would fill that space?” and “in an environment where we lack any trusted population-scale online authentication mechanism, IDA is better than all the other options”. Could you elaborate on the logic, please, I don’t follow it.
2. You also say that “public bodies can't be Identity Providers (IDPs) - IDPs will be exclusively private sector” and “(Declaration of Interest: I have been supporting the Post Office's work on IDA)”. The Post Office isn’t a private sector body. And yet it’s just been appointed an IDP, as noted in your DWP Announces First Identity Assurance Providers, 13 November 2012. Is it correct to say that the claim that “public bodies can't be Identity Providers” is false?
3. Today’s post, 14 November 2012, enters the world of midata, the Department for Business Innovation and Skills (BIS) consumer empowerment initiative.
You describe Ctrl-Shift as a “consumer empowerment think-tank”. Some of your readers may not realise but BIS are a client of Ctrl-Shift, they pay Ctrl-Shift, and Ctrl-Shift have produced at least one report* which extols the benefits of midata without mentioning that BIS are their client.
Ctrl-Shift has 106 ordinary shares in issue of which 30 are owned by William Heath, who was a director of Ctrl-Shift until he resigned. He still retains his shares, though.
Alan Mitchell is a director of Ctrl-Shift. He and William Heath are founders of Mydex. William Heath is the chairman and Alan Mitchell is the strategy director of Mydex.
The Ctrl-Shift report in question* extols the benefits of Mydex without mentioning these facts. Mydex in turn extols the benefits of BIS’s midata and, to cap it all, William Heath sits on the BIS strategy board for midata. Yesterday, Mydex were named as one of the UK’s seven identity providers.
Three points: (a) you very properly declare your Post Office interest, perhaps you could in future make Ctrl-Shift’s interest clear; (b) to what extent is Mydex a private sector company given the facts above and given that it is likely – I don’t know for sure – to have received funding from BIS’s Technology Strategy Board and from the Cabinet Office in connection with identity assurance?; and (c) can we please change the name "identity provider", which sounds either laughable or sinister, to something like "electronic identity provider"?
----------
* http://www.dmossesq.com/2011/12/case-for-midata.html , http://www.dmossesq.com/2012/11/identity-assurance-only-future-is.html
David,
Since William has already responded to point 3, I'll keep out of that. In response to your first two questions:
1. In the absence of a population-scale trust network (e.g. the sort of mechanisms we see in Finland, Estonia), and given the under-investment in trust schemes in the UK over the period 2002-2010 (caused by the NIS), it seems probable that without coordination many different sectoral or regional schemes will emerge, driven by a mix of government departments, local authorities and entrepreneurs. Some of these might be 'good' from a privacy perspective, but some won't be, and some will be downright ugly. The overall effect will be to drag down mean levels of consumer confidence in online trust.
Furthermore, if a Labour government were to gain power in 2015, there are still many supporters of the NIS within senior party ranks, and if we still have a vacuum at that time then it seems probable that they would want to fill it with some variant of the NIS.
Hence my argument that we have to build the best thing we can now.
2. For the record, Post Office Ltd is a private company whose shares are held by the Secretary of State for Business. Post Office Ltd has to bid for government business in the same way as any other company, and there are specific legal restrictions to ensure that it does not receive any favouritism in the process.
I hope that answers your points.
Toby