Please Can The Public Sector Prove My ID Once … And Get On With It …

Please Can The Public Sector Prove My ID Once … And Get On With It …

Please can I have my identity back, and stop asking me to prove it?

Our Blockpass ID Lab focuses on identity, and where we look at citizen privacy and how citizens can gain access to services in a trusted way. In our current research work, we are integrating cryptography methods that support citizens gaining trusted credentials once, and then using them many times. We hope to break down data silos, and support the free movement of citizens across our borders.

Stuck in the 20th Century

Today I tried to register for the Scottish NHS Vaccination Status App, and I just wasted my time. As far as I can see, I couldn’t use the existing ID that I have used for my “unsecured” PDF verification and was now faced with a new verification system. Personally, I really don’t understand why I keep having to prove my identity to so many government and health care services. A while back I registered for Yoti to prove my ID, and it guided me through the process and kept me up-to-date on everything I needed. I could then keep all my trusted ID proofs within the App, and could then log in to a Scottish Government service using my App. It was a great experience. So, why hasn’t this approach been scaled — along with other trusted identity providers — in order to access every government and health care service?

We have been talking about the integration of citizen identity in Scotland in the health and social care for over a decade, and yet there are very few signs of this ever progressing past the most basic services.

And so …

And so for the Scottish NHS Vaccination Status App, I scanned in my driving licence and it didn’t recognise my face. The reason? Well, the new driving has poor photo quality, so is not much use in proving identities. So I turned to my passport, and which worked well, but when I went to verify my face:

The App showed the oval for my face, but my face was not there. It said “Too close” or “Too far”, but there was no face in there, and I couldn’t get it to verify. I think it is probably a camera rights thing and probably to do with IOS 15, but there’s no place I could allow the camera rights from the Control Panel. I allowed access along the way whenever prompted, but I just couldn’t get my face to appear.

So, off I went to my iPad, and luckily it managed to scan my passport (not easy on the iPad) and my face:

And then I was faced with adding my details:

Luckily I know my CHI number and entered it, and it pre-populated all the required details. These looked fine, and it even knew my postcode. But when asked to verify the details, it failed to find me:

I tried without my CHI number. I tried without my middle name. I tried with a space in my postcode. I tried all uppercase. I tried all lowercase. I tried “Bill” instead of “William”. I tried everything I could think of, but I still couldn’t get registered. There was no feedback on what was missing or no fuzzy matching. I was suprised by this, as it was the one which has initially actually gave me all my details based on my CHI number. So why did it find me for that, but then just playing the data back? It lost me as someone who is highly technical and designs this type of system, as it all seemed like fairly novice things that would be spotted in testing.

So, I’m going back to my unsecured PDF version of my vaccine status. A little bit of fuzzy matching would have helped here, and where it finds near matches, and perhaps asks for additional verification details. Overall, I had no idea why it couldn’t find me. Perhaps I don’t exist, anymore? I already have a login for the NHS and my GP’s site has all my details, so why not just use that?

Citizen-focused systems?

Governments and the public sector talk a good game when it comes to citizen integration. For over a decade I have attended conferences where citizen-focused systems was the main focus, and every single time nothing happens. Overall, our governments and the public sector are generally very poor at integrating the citizen, and have little motivation in linking systems up — while preserving privacy. I have lost count of the number of times that the NHS has asked me for my details, and they often have little idea of who I really am, apart from knowing my CHI number.

Recently, I used Yoti to verify my identity and access a government service, and it was a dream. Whenever I logged in, the App would give me the status check, and where I could just scan in a QR code, rather than remembering passwords. If the service wanted some of my details, Yoti would ask me if it was okay to provide them. For the NHS, I get asked so many times for my CHI number, and which they should know, and, anyway, they should know my identity by now.

Having waited for three months to get my driving licence updated, I really think we need new thinking and more digital integration, and for the citizen to do things once, and pass many times.

Here were my thoughts in March 2021:

Conclusions

If you are interested, we are working on the GLASS project, and which aims to harmonize access to online government services across the EU. For this, we are using a citizen wallet to hold trusted credentials. I hope Scotland can match to this, too, and build a public sector that is digitally fit for the 21st Century. Otherwise, we will stay in the 20th Century, and build systems that work for civil servants, and not for citizens.