Towards a digital ID – part 7

As we near the end of 2016 the ‘discovery’ phase of our journey towards a digital ID for Jersey is coming to an end. I am optimistic that we can move into an implementation phase in early 2017, though this will be challenging for the reasons explained below.

If you’ve not been following these series of blog posts, or if you need a refresher on how we’ve got to this point, please review the previous blog posts on this subject so that you understand the context.

Conclusion of our research into GOV.UK Verify

In August we started an alpha project to further explore the GOV.UK Verify model. This was run using the project framework of the Open Identity Exchange (OIX). The outputs of all OIX projects are published in the public domain. We are looking forward to publishing the results of the project in January and will link to it here.

Alternative options

There is a strong preference to be able to single out a national digital identity system that ticks all of our boxes in terms of the set of requirements that I linked to in part 5 of this blog series back in August.

In September we engaged Consult Hyperion to help us understand how each of the different flavours of digital identity solutions work. They identified some 50 existing or so emergent solutions which they grouped into eight categories. From these we identified the three that were the best fit.

Compromises

Through Consult Hyperion’s work it became clear that none of the solutions on offer are a perfect fit. Each option involves some element of compromise –  for example:

• There might be an option that has been live in a jurisdiction for years but is no longer state-of-the-art;
• At the other end of the spectrum there may be an option that uses cutting-edge technology but has no customers live, anywhere in the world;
• A solution might adequately meet our current needs, but have an unclear future roadmap and might quickly fall out of fashion;
• A solution that works well in a jurisdiction where identity cards are compulsory (as is the case in many European countries) might be much more difficult to implement here in the absence of such legislation;
• A solution might work fine for Jersey residents wishing to use government services, but not provide a form of ID that is also accepted by your bank or when transacting online in the UK or other countries;
• Another might tick all the boxes but at a cost that the Island cannot afford.

Budget challenge

On the subject of money, during the discovery process we have established a more detailed view of what the various options might cost. Back in February 2014 we had planned for £150,000 of software licences and build costs, with project management and business analysis bringing the total to £390k. We now know that the discovery phase will account for most of that amount, and that implementing digital ID to the necessary high standards standards of privacy, security, usability and so on comes at a similar cost in a small jurisdiction to a large one. The overall purchase and running cost over five years will be a number of million, depending on which option we select, with funding from the Public Sector Reform budget. The business case has to be strong, with a projection of how digital ID will enable corresponding savings in the new online services that will use it.

Not a straight-forward decision

We are entrusted with a decision that will impact the lives of most of the population of the Island. We will be spending a large amount of public money. Given the pace of innovation in the digital ID space, we find ourselves in a potential “VHS vs. Betamax” situation: several options look viable, but which will stand the test of time and which will wither on the vine?

Jersey’s tech community are likely to want to leap to our aid here, but we have already engaged two globally-respected consultancy firms who specialise in this area, so we have no shortage of informed opinions yet no consensus. We are also restricted in the amount of detail we can share publicly about the options under consideration. This is due to the non-disclosure agreements we have needed to sign in order to have sight of commercially-sensitive business plans and technical specifications.

So – what next?

To have spent over 18 months researching the market and bringing in specialist knowledge has been the right thing to do, but unfortunately hasn’t yet got us to the point where we can make a confident decision. So what are our options now?

• One school of thought is that we should focus on the pressing need to implement a solution in 2017 and therefore go for a more tactical solution that can be implemented at a lower cost, mindful that we might need to revisit it in three or four years’ time;
• The opposite school of thought is that we cannot afford to compromise in this important area, and that we should find the money to buy the most comprehensive solution available. This would include features that were not identified as requirements at the outset, such as digital signatures, and could form the basis of a ‘financial services passport’ (much sought-after by our financial services sector). But extending the scope means a delay in launching a digital ID solution, which would compromise the delivery of other interdependent parts of the eGov programme. To understand what these potential additional requirements are that were not in scope at the outset it is worth reading a report published this month by UBS. (The report also explains why digital ID systems will continue to evolve at pace, meaning we’ll be continually aiming at a moving target);
• A third point of view is that we should wait until the market matures, and solutions become commoditised and inexpensive, with a clear international standard which we can adopt with confidence. That might sound appealing, but the experts tell us this is years away. A risk-averse ‘wait and see’ approach would significantly compromise initiatives that Jersey is committed to, such as introducing the ability to manage your income tax online, or e-voting, and would see us fall further behind other advanced digital jurisdictions.

A project that started out as a straight forward software procurement exercise has quickly become a complex matter with no easy answer.