blog.gov.jeSix weeks has passed since my last update on our progress towards introducing a digital ID scheme for Jersey, so this is a good time to update you on recent activity.
For those who haven’t been following this series up until now, please review the previous blog posts on this subject so that you understand the context.
The pace of progress has really increased over the last couple of months as we now have two SOJ staff working on the project full-time in addition to some of us contributing part-time. We also have a team of local and UK-based specialists helping us.
“Stream A” – OIX alpha project looking in more detail at reusing the GOV.UK Verify model
Stream A is comprised of three sub-projects:
- Testing our assumption that Islanders would be willing to create and use a digital identity to access government services online
Over the last couple of weeks we’ve held the first two of three rounds of user research. Ten volunteer members of the public have come in to 4Insight’s studio for 45 minute sessions with our facilitator, Pete Gale. During each session the volunteer was asked to run through the short process of registering for a digital ID and then using it to log in to a government online service. The series of web pages are based on those of the GOV.UK Verify system but with States of Jersey branding and appropriately customised to Jersey’s needs. It was our first opportunity to gauge people’s reaction to the process – did they understand the value of having a username and password that would allow them to log in to multiple government online services? How would they decide between a choice of several companies that could verify their identity? Were each of the steps in the process clear and easy to understand? Was there any difference in reaction to the system between older and younger people? Were people who aren’t very confident with computers comfortable with the process?
Overall, the testing has been successful. Noël Mallet from C5 has made some immediate tweaks to the process based on the feedback. We are now planning for the third round of testing next week when we will trial a slightly different user journey.
Amongst the things that we’ve seen so far during testing is that – as suspected – when choosing a company to verify their identity, people are most likely to pick one that they’re familiar with. We also saw that there needs to be a compelling set of services that Islanders will be able to access with their newly-acquired digital ID, so that there is clear value in their minds that makes it worth going through the verification process. (This learning applies equally to whichever solution we go with.)
- Testing whether an ‘identity hub’ – a key component of GOV.UK Verify – could be built locally using on-island skills
For the purposes of the alpha project, we are using Microsoft’s cloud-based consumer identity and access management system, which has the catchy name of ‘Microsoft Azure Active Directory B2C‘. This is enabling us to create an ‘identity hub’, a component that will broker communication between the identity providers and the government services that need to verify people’s identities. In the GOV.UK Verify model, this component is key to ensuring some of the privacy principles of the identity scheme. A UK-based Microsoft partner has spent time in the Island carrying out skills transfer to staff from C5 Alliance so that the component could be supported locally if we decide to go ahead with a UK-style identity scheme. C5 are now working on configuring the component and applying some States of Jersey branding.
- Establishing the availability of data from within the States of Jersey and from external sources that will be necessary for the verification of Islanders’ identities.
Whether you prove your identity face-to-face or entirely online, and whether the resulting digital identity is issued by government or a third-party, the process will depend on comparing the information that you provide against authoritative sources of data. Some of that will be government data, and some may be external. We have been reviewing which data sources we have within the Jersey government that could help establish that a person exists with the given name, address, date of birth and gender, and that is the same person that is trying to obtain a digital identity. For each potential data source we’ve been establishing who the data controller is and the quality and demographic coverage of that data. We also want to establish an estimated cost for any new interfaces required. We have got off to a good start, and the work will continue for the next few weeks.
“Stream B” – alternative options
Last month we appointed a globally-recognised consultancy with expertise in identity solutions – Consult Hyperion – to help us look for good alternatives to the UK model. The company has advised governments in a range of other countries and is in contact with many of the suppliers of systems worldwide.
On 14 September we had a workshop led by Consult Hyperion where we looked at eight reference models of digital ID systems. We were able to narrow these down to the four that best meet our criteria.
With an enhanced understanding of Jersey’s needs, the company will now prepare summaries of a number of suppliers’ solutions within those models.
A second workshop is scheduled for the first week of October, after which we will be able to evaluate the options, comparing one or more valid options against the UK model.
We expect that by early November we will have an agreed way forward and will swiftly move into an implementation phase, with the intention of having a system ready for beta testing in Q2 2017 and live later next year.