After Universal Credit delays, GDS's silence over Gov.uk Verify is embarrassing and shameful

In the past couple of weeks, nearly a million people have signed up for Universal Credit as a result of the Covid-19 coronavirus crisis. Never has the UK government’s move to a digital-first world faced a greater examination.

Mostly, the Department for Work and Pensions (DWP) has passed that test. In unprecedented numbers, financially worried claimants have, eventually, managed to register their applications. Given the mess that DWP made of its first attempts to develop a digital Universal Credit system back in 2012/13, they deserve a lot of credit.

The same cannot be said for the Government Digital Service (GDS) and its Gov.uk Verify identity assurance system.

The troubled history of Verify has been well documented in Computer Weekly. April 2020 was already going to be a major milestone for the system – the start of a new public sector financial year that would see government investment in Verify cease, with the system becoming self-funding and led by the private sector. This was promised in an official statement by Oliver Dowden, then a Cabinet Office minister, in October 2018. Ministers – and especially those who go on to be promoted to the Cabinet – don’t like it when their promises go unheeded.

At the same time this month, all but two of the third-party identity providers (IDPs) upon which Verify relies, left the scheme – no longer accepting new registrations, but supporting their existing users for 12 months.

In the run-up to this key date, GDS has maintained a complete silence on the implications of these changes, even while continuing attempts behind the scenes to convince ministers that Verify has a future. Rumours of an announcement in the March Budget proved unfounded.

GDS was already going to reach April with hugely important questions still unanswered about a system that has cost the taxpayer at least £175m so far and which has, in the eyes of the private sector, the National Audit Office, the Public Accounts Committee, the Infrastructure and Projects Authority, and the vast majority of the digital identity community, failed.

And then the coronavirus hit.

As Computer Weekly was first to reveal, people suddenly forced to apply for Universal Credit (UC) came across enormous online queues in the tens – on occasions hundreds – of thousands, starting at the point of the UC application process where they encountered Verify, when they needed to digitally prove they are who they say they are. Social media exploded with people complaining in understandable frustration and anger.

Verify simply could not cope with the volume, and people reported waiting hours – sometimes overnight – before they could complete their identity verification.

In a typical week, Verify sees about 36,000 users signing up, spread across five IDPs to ease the load on each. Between 23 and 29 March, over 164,000 people slowly and painfully registered for Verify. The previous week, over 118,000 signed up.

To be fair, Verify was never designed for such volume, but neither should it take eight hours or more to complete its processing or leave people at number 80,000 in a queue. On GDS’s Verify website, it says, “It normally takes between five and 15 minutes to verify your identity the first time you use Gov.uk Verify”.

Observant readers may notice a discrepancy here. About 283,000 people signed up for Verify – which is a mandatory step in applying for UC. Yet nearly a million people signed up for UC.

That’s because – as has been the case since Verify was first tested on UC as long ago as 2015 – only 35% of people who apply for UC are able to prove their identity on Verify.

The other 65% went through the arduous process of trying to prove their identity – using passports, driving licences, credit cards and so on, if they had them – only to find they were rejected, and had to go through a call centre after all. Of course, those call centres were overwhelmed too, but DWP is moving over 10,000 staff to help answer the phones.

What has GDS done to sort out the Verify delays? We have no idea. Apparently they are “working hard” to reduce queues. Computer Weekly has asked GDS to provide more details of what it is doing, how it plans to address the issue, anything really, to give the public some clue to what’s going on. We got nothing. Zero. Nil.

And now, here’s April, and the problem just got worse.

There are now only two IDPs supporting Verify and taking on new users. The loss of three former IDPs was reported by Computer Weekly in August 2019. To this day, GDS has not publicly acknowledged or announced that fact. And yet, if you try to apply for UC now, you will only be offered the Post Office or a Dutch firm called Digidentity as your verification options.

That’s two IDPs trying to carry the load formerly carried by five. You think that’s bad?

The reality is there is only one IDP. The Post Office service is simply a front-end to Digidentity – the former being a trusted brand that has become the IDP with the highest number of Verify accounts. But when you choose Post Office as your Verify provider, it’s simply a “white label” version of the same system you go through if you select Digidentity.

So any further UC claimants from now on are all going through the same identity verification engine. Perhaps just as well those million applications came in before April.

Oh, and by the way – any of those million UC applicants who used one of the other three IDPs that have now pulled out of the scheme, will need to re-register with Post Office / Digidentity at some point during the next 12 months, going through the same arduous identity verification process all over again. Someone best tell them not to all do so at the same time.

When we asked GDS what its plans are to cope with this technical bottleneck (not to mention commercial monopoly), a Cabinet Office spokesperson said: “Gov.uk Verify identity providers are offering their existing services to Gov.uk Verify users. Discussions on the next steps for Gov.uk Verify are ongoing and will be announced in due course.”

Well, that’s clear and helpful.

I’m told that GDS is urgently trying to convince ministers to provide additional funding, pointing to the recent burst of Verify users as a sign that the system is viable. In the current circumstances, ministers will have little choice but to provide those funds, because UC is not ready or able to ditch Verify (although DWP is working towards it).

Any further cash given to Verify needs to come with the strictest conditions, and a watertight plan to wind it down and do something better. And a promise from GDS to explain what it’s doing and why would be very welcome too.