Interoperability, adoption now critical questions facing UK digital identity effort

Like an old social media post buried deep in someone’s feed, past policy positions can be dug up to help illustrate what has changed – and what hasn’t.

The Association of Digital Verification Professionals (ADVP) has issued a response to the National Audit Office (NAO)’s recent report on managing digital identity in the UK. It draws on a policy report issued in March 2008 by James Crosby, then serving as the Deputy Chair of the Financial Services Authority – and says “read aside NAO’s report, the continuity is striking.”

The ADVP points specifically to Crosby’s key differentiation between “ID management,” which “serves the interests of whoever owns the database,” and “identity assurance,” which is by contrast “a consumer-led project.” Only systems that serve the user, Crosby argued, get used.

The digital identity industry association’s statement argues that the UK’s independent public spending watchdog arrives at the same conclusions as Crosby, just by a different route. The path in question leads through the private sector, and specifically to providers certified under the Digital Verification Services (DVS) trust framework – which, the ADVP says, has enabled the market to deliver a viable, functional, existing ecosystem for digital identity in the UK.

The NAO’s report, it says, is an “independent, evidence-based validation of the position this Association has argued consistently: digital identity is not a single product to be procured, and the UK does not need to start again. It is an ecosystem of services, credentials, standards, providers and governance arrangements spanning both the public and private sectors – and the UK already has one.”

Government must make its intentions known

The major challenge, then, is not architectural, nor technical, but in solving the connected problems of adoption and interoperability. “The NAO is clear that without greater consistency and clearer rules” on what digital IDs are accepted for what and where, “fragmentation persists and the benefits do not materialize.”

Moreover, disorganization at the government level over what it plans to build and what role it intends to play is liable to cause further public consternation about digital identity generally. The shambles of Keir Starmer’s abandoned digital identity scheme will remain for critics to point to as an example of waste, incompetence and untrustworthiness. And, the ADVP says, they “undermine confidence and investment. That is not an abstract risk.”

The ADVP’s policy recommendation, then, is for a clearly established model in which “government sets the standards” and “the certified market delivers.” It suggests that clarity on this point is “worth more to investment and adoption than any single product decision.”

It also believes the UK must find an answer to the question of digital ID interoperability with the forthcoming EU Digital Identity Wallet program, and must increase its engagement with the private sector DVS firms operating on the front lines of identity.

Growing role for CBAs as DVS certification starts to matter more

The ADVP’s note on how to widen acceptance may be the most consequential from a market perspective. “Certification should mean something in practice,” it says. “Where an approved digital identity is good enough for a right to work check, the rules on where else it can be used should be consistent and clearly stated.”

The subtext here is that the government has incubated a private digital identity sector of trusted UK providers and bothered to create a DVS trust framework that certifies them – so, it should use it. Trust is trust, and that should apply across use cases. DVS providers have put in the work to be certified against the government’s rules, and as such they are a critical piece in the overall adoption equation.

Both government and industry should be moving toward a state of affairs in which the UK CertifID trust mark, awarded to providers who are certified against the 1.0 publication of the DVS framework, can answer key security questions about a provider, the same way the seal of a national dental association can answer questions about the quality of a particular toothpaste.

Put simply, as digital identity goes mainstream, certification matters more and more as an established measure of trust. That means a larger role for Conformity Assessment Bodies (CABs).

Currently, there are only a handful of CABs approved under the pilot certification process operated by the Office for Digital Identities and Attributes (OfDIA). The Kantara Initiative was the first to be approved to offer DVS certification. BSI Assurance UK Limited is also an approved assessment body.

More will be needed to serve the growing market for digital ID products in the UK, if the private sector is to earn the lasting trust of the public as stewards of the country’s digital identity ecosystem. And there is a time limit in play: as of October 1, many use cases for private sector digital identity will only be legal if carried out by a certified DVS service.

Article Topics

AVPA  |  conformity assessment body (CAB)  |  digital identity  |  digital verification service (DVS)  |  UK CertifID  |  UK digital ID