GDS is building a single sign-on and identity solution, with help and support from colleagues right across government. This is the third mission of the GDS strategy for 2021-2024: “A simple digital identity solution that works for everyone”.
We recently passed a service assessment for our alpha on identity checking, so we thought we’d share some of our learnings.
Prototyping was our fastest route to learning
In pre-discovery we reviewed over 100 rounds of research from GOV.UK Verify and spent hours learning from colleagues across the public sector who run identity services, such as the Home Office and NHS Digital.
We also decided to start prototyping in our discovery phase, since we felt we would learn more - and learn faster - from thinking about our own user journeys and prototyping them than we would repeating research that had already been done by others.
Getting the whole team generating divergent ideas for user journeys in discovery flushed out major design, technical and scope questions to explore in alpha, and we were testing our first prototype and learning from real users in week one of alpha.
Inclusion works on several levels
Inclusion is a hugely important part of our work, because anyone should be able to prove their identity to access government services, and it’s often the most vulnerable people who are at most risk of being excluded. To be honest we didn’t get this right with GOV.UK Verify. We have an opportunity and obligation to do much better this time.
But as soon as we started exploring this space, it became clear it’s a concept with more than one meaning.
First, there’s digital inclusion, which is a concept relevant to any online service. We owe a lot to our colleagues at Universal Credit and DWP for helping us to think about different barriers to inclusion, which could relate to digital skills, confidence, time, or someone’s financial situation.
Second, there’s an identity-specific dimension to inclusion, which is about which documents or evidence sources someone can use to prove who they are. Millions of people in the UK don’t have a passport or driving licence and there’s no magic document that lets everyone prove their identity. To include everyone in identity checking we will need to accept a broad range of documents and evidence types: there’s no silver bullet. And although we often talk about ‘digital identity’, it’s clear that we will need to go beyond online channels to include everyone.
These two types of inclusion are distinct but they intersect and interact.
For example, someone with a strong credit record and two types of photo ID but with poor internet access, low digital confidence and a wariness of sharing personal information online could be excluded from proving their identity. And so might a young, highly educated, urban renter who does everything online but who has never needed a driving licence, moves address frequently, isn’t named on any bills, and is short on time.
Our understanding of inclusion in this context has benefitted from thinking about these two levels - general barriers to inclusion plus documents and data sources - and the interaction between them.
A mobile app is the quickest and most convenient route for some users
Most user needs can be met without an app, but there are exceptions to this.
Mobile apps are a helpful tool in identity checking because they allow users to do things that can’t easily be done in a browser. For example, someone with a document containing a near-field communication chip (like a UK passport or a biometric residence permit) can scan that document using a smartphone to open the chip and read the contents. This is a high value check that provides assurance about the validity of the document which can then remove the need for additional checks that would take longer and might require the same user to share extra personal information.
Not everyone will want to use an app or even be able to, and that’s OK. But if a mobile app can be cost-effective, secure, and help us meet the needs of some users better than we’d ever be able to without one, we should offer them one.
So, GDS is developing an app as one of several routes for people to easily prove who they are, when they need to access government services. Use of the app will always be optional, not mandatory. And, we will be running a discovery in parallel with this work to explore whether there would be value in further uses of mobile app technology to personalise and improve the experience of GOV.UK.
Strength + document + channel = journey
From exploring the array of user journeys we could offer, we realised there are three dimensions that identity checking can vary across:
- the strength of the identity check that the user needs to do, which the service decides depending on the riskiness of the transaction
- that document or evidence that the user provides and the way it’s checked
- the channel
This creates a large number of possible combinations. For a rough indication of scale, let’s say there are 4 strength levels, 10 accepted documents which can each be checked in 2 ways, across 3 channels. That’s already 240 unique user journeys. This has been a helpful framework not only to understand journeys, but also to define our initial scope and help us understand complexity
For private beta, we will be starting with one strength level, one document, and one channel. This will let us build something quickly, get it into the hands of real users, and start augmenting our research and interviews with observed user behaviour and feedback.
Identity is complicated, but proving your identity shouldn’t be
Identity checking is an inherently complex problem. All too often this gets translated into a difficult and unwieldy process. We don’t think it has to be this way and we’re experimenting with how to keep things as simple as possible.
Identity checking can’t be a one-size-fits-all journey (there’s no magic document) but we don’t want to create a confusing maze of possibilities. One of our main discoveries from usability testing was that a task list-based design pattern works well as a simple, flexible and extensible way of assembling user journeys from different types of checks to fit different demographics.
Another learning was a ‘just in time’ principle for introducing concepts. For example, our first prototype tried to educate users at the start of the journey about the value of having a reusable identity, but it was too abstract and confusing. We knew it was important for users to understand that they’re creating something that can be reused, but the right moment to introduce this idea is when someone has finished proving their identity and has the option to save it. This has tested much better and makes the journey more seamless.
Live traffic is the next big step in learning
In alpha we learned a huge amount from six rounds of usability testing, countless technical spikes, and some frankly mind-bending team workshops as we dove into the complex world of identity checking.
But just as we decided in discovery that we needed to start prototyping to keep up the pace of our learning, a few months later - and after an intense alpha - we concluded that doing real identity checking with real users will unlock the next big frontier of learning.
To continue learning at the same pace, we need to make things real. That’s why we headed to our service assessment, and why we’re excited to move into private beta.
25 comments
Comment by Selina J. Morales posted on
What we learned during our identity alpha includes statistics ranging from how many people actively use email to how many are using Facebook Messenger. There are just over 3 billion monthly active users on Facebook Messenger, which is more than any messaging app or software combined.
Comment by Howard Walker posted on
all I can say about digital government services is that having spent the last 3 days trying to gain access to my income tax self assessment form is that if this is how the rest of them are its about time you got a set of programmers who are logical.
Every other organization that I have written code for has a simple method of checking id.
They send a code to my phone and I have to input it into their web site, or just say yes. That would seem to be too complicated for your system. That's the mind of the bureaucrat for you. You cannot even parse the text on this page properly. Any changes and the word gets deleted.
Take a course in programming. The Open university did a great one for me in 1982. I
Comment by Adrian Field posted on
Hi GDS team,
thanks for sharing the update. Have you considered looking at some of the private sector solutions that are emerging under the DCMS trust framework (e.g. OneID)?
There are other ways of checking identity, e.g. via someone's bank account over Open Banking, that are more inclusive than scanning paper documents (97% of adults have a bank account), and re-use the fact that the identity has already been checked by a bank rather than creating a new one from scratch. This is easier for the citizen and cheaper for the service provider.
This will accelerate the time to mass adoption and benefits for all. Other countries enable their citizens to access Government services with a Bank ID, why not enable this in the UK?
Regards
Adrian
Comment by The GDS Team posted on
Hi Adrian,
Thanks for your comment. We are exploring how we will use data to enable users to prove who they are. The new single sign-on system is being built in alignment with the requirements of the trust framework and its common standards.
Thanks,
The GDS Team
Comment by Nick posted on
Richard, useful insight into progress being made. Are you able to confirm that the GDS Single Sign On will be just one of many Government & Commercial Identity Schemes governed by the overarching DCMS Trust Framework and adhering to the principles set out by it. It is vital that all schemes are subject to the same framework rules and that none are seen to be above those rules.
Comment by The GDS Team posted on
Hi Nick,
We are working with DCMS to ensure the new single sign-on system will meet the certification requirements of the framework.
Thanks,
The GDS Team
Comment by Sarah Axon posted on
Having just spent the best part of 24 hours trying to prove my ID to the government, change cannot come fast enough. I originally verified via Experian, only to find that that service had been discontinued. I then attempted to verify using the Post Office, who required me to take a photo of my six year old passport and one of myself, and used AI to attempt to match the two. Naturally it failed. Time after time.Entering old addresses overwrote the existing one. Poor poor design. No excuse. Terrible.
Comment by The GDS Team posted on
Hi Sarah,
Thank you for your comment, and we’re sorry to hear about your experience. We are learning from how people currently use digital services, including those featuring digital identity, to develop our new single sign-on and identity solution.
Thanks,
The GDS Team
Comment by Patrick McEvoy posted on
Brilliant to see this published in the open. Identifying the myriad of journeys and targeting each as a specific problem that also needs a specific solution, all while framing it as one big system, is essential to meet all user needs. Well done!
However don't forget identity verification isn't once and done. It's an on-going relationship based on a flow of transactions and interactions that typically require different levels of identity assurance.
Embedding transaction-based integration into consuming services is what will make the real user journey slick. No one actually wants to verify their identity, they just want to transaction with government.
Comment by The GDS Team posted on
Hi Patrick,
Thank you for your feedback and perspective. We agree – identity checking journeys are not straightforward. That’s why we’re finding out a lot from different service teams across government about their identity requirements and users, and will be working to make the user journeys as easy as possible.
Comment by AHZ posted on
Useful
Comment by lee jones posted on
Perfect, Diolch yn fawr
Comment by The GDS Team posted on
Croeso!
Comment by Matthew Harris posted on
The NHS App team would be keen to share our experience of how what was quite a 'thin' hybrid app has evolved to take advantage of native features that are hard to do web-only, like biometric authentication, push notifications, claimed URLs etc.
For example, we're using native push notifications to draw the user's attention to unread messages in an in-app inbox. We've 12 million user devices opted-in for push notifications and we hope this will enable us to reduce patient communications via paper letters and SMS which are often expensive and insecure. It would be really interesting to see if Notify could add a GOV.UK native app as a comms channel in the same way.
Comment by The GDS Team posted on
Hi Matthew,
Thank you for sharing this insight. We have been working with NHS colleagues and are keen to continue learning, so if not you’re not already in touch, please do fill out the form linked to in the post or email us.
Thanks,
The GDS Team
Comment by Simon Johnson posted on
Amazing work. I love how you took the most vulnerable people into consideration from the outset, rather than catering to the most IT-enabled first.
Comment by Leonie Tame posted on
Ditto!
Comment by Geoff Simpson posted on
Thank you for sharing this and being so open. It's really interesting to see how you're dealing with such a complex task.
Comment by Semi Essessi posted on
National Insurance number... NHS number... Passport number... Unique Taxpayer References... yet I'm still having to fill out forms with repeated details and mistakes are constantly made.
Single sign-on helps... but managing the data better would solve the real problems people face day-to-day, saving many departments millions in wasted time and employing people to do jobs that only exist to counter how horribly managed it currently is.
'embarassment' is putting the current state of affairs and how we reached it mildly.
Comment by Benjamin Taylor posted on
A great bit of working out loud and shared learning, thank you for this.
Two questions / comments:
- I notice that you didn't make any connections to the Scottish government digital identity work (and in particular I'm interested in the Mydex connection and possibility of user-owned identity validated by anonymous token exchange). Was this looked at as part of the learning? Are you connected in to that project?
- you say 'Use of the app will always be optional, not mandatory' - is that documented anywhere? I'm wondering what the authority of that statement it.
I'm honestly not sure that central government, as a political organisation with the Crown as ultimate authority, *can* ever promise that something like this might not change in the future?
Comment by The GDS Team posted on
Hi Benjamin,
Thank you for your feedback. Yes, we are exploring the options you mention as ways to give users more control over their data. Our intention is to create an inclusive solution that caters to the different needs of users and our research tells us that this will require different routes to proving identity. Use of the app is one of several routes users will be able to choose from.
Thanks,
The GDS Team
Comment by Neal posted on
Key things to think about here are:
1) Most citizens don't **want** a government account. They want as little to do with government as possible. And they certainly don't want to feel like big brother is watching.
2) They might be persuaded that it has value if (and only is) it work not just with services provided by central government, but also small "g" government services: local government, GPs, etc. It's not obvious how you'll reach a critical mass of utility that will make it of value to the citizen.
3) The citizen is not the only entity that interacts with government. Tax accounts, farm agents, legal aid lawyers all interact with government services "on behalf of" citizens, businesses, charities, etc. Verifying my accountant's identify is if precious little use if it does not enable him/her to submit my tax return.
Finally, HMRC is your biggest potential customer in government. If you don't have something that works for then then you'll end up with yet another "Government Gateway" or "GOV.UK Verify".
Comment by The GDS Team posted on
Hi Neal,
Thank you for taking the time to share your thoughts. We have been speaking with individuals and service teams - including some of those you mentioned - to better understand the different needs the solution will need to meet. And, importantly, we will continue this research as we further develop the system.
Thanks,
The GDS Team
Comment by lee jones posted on
Hi
All UK wide departments have a legal obligation to provide Welsh language services and current sign on is available in Welsh to meet this ask.
Can you confirm the plans for testing and developing this new service in Welsh please?
Comment by The GDS Team posted on
Hi Lee,
Yes we can confirm that the new service will be available in Welsh.
Thanks,
The GDS Team