Gov denies Verify could be used to spy on you

GDS issues rebuttal to paper claiming identity assurance scheme degrades your privacy


The government has denied its new identity assurance service, Verify, could lead to mass surveillance of citizens, following claims made by a group of academics.

Verify reduces the privacy of citizens due to technical flaws in the system's architecture, wrote the three authors of a paper titled Toward Mending Two Nation-Scale Brokered Identification Systems.

Advertisement - Article continues below

The Government Digital Service (GDS) designed Verify as a way for people to prove they are who they say they are when using government services online, and HMRC is already using it with allegedly mixed success.

Verify relies on a central hub to mediate interactions between the departments providing a service, companies performing the identity checks and the citizens using Verify.

Users of Verify are passed to identity authentication providers, who ask questions and use official documentation to confirm citizens' IDs, the idea being to limit the amount of information the government or the providers have on people.

But the authors of the research, Lus Brando, Nicolas Christin, and George Danezis warned too much trust has been placed in the hub, through which all the information travels, as it has the power to read encrypted information coming from identity checks and users themselves.

Advertisement - Article continues below

"The excessive trust placed on the hub could be notably used to support undetected mass surveillance," the report read.

Advertisement - Article continues below

"Leaving the hub outside of the scope of privacy and security goals triggers serious problems. As currently inferred, [ Verify] may actually degrade the privacy of citizens."

However, the GDS published a blog post this morning denying Verify could be used to spy on people.

It read: " Verify does not allow for mass surveillance. It does not have any other connection with or ability to monitor people or their data.

"Only minimal data passes through the Verify hub. The person's name, address and date of birth [and gender] is sent through the hub to a government department the person is trying to access.

"No data about the person's interactions or activities within certified companies or government departments passes through the hub."

But the GDS did say the report's findings added to the pool of knowledge around digital identity assurance issues, and has welcomed Danezis as a member of the government's privacy and consumer advisory group.

Advertisement - Article continues below

Verify's use by HMRC came under scrutiny this month after thousands were understood to have missed out on a marriage tax break because they were asked to provide documents many people did not actually have.

In response, HMRC is introducing an alternative process for those who have been unable to use Verify to apply for the tax break.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now



Microsoft issues warning about new PonyFinal ransomware attacks

3 Jun 2020
data breaches

Amtrak Guest Reward suffers a data breach

3 Jun 2020
cyber security

Brand-impersonation and form-based attacks are rising

3 Jun 2020
ethical hacking

Developer scores $100,000 bounty from Apple for exposing a critical vulnerability

1 Jun 2020

Most Popular


Ransomware collective claims to have hacked NASA IT contractor

3 Jun 2020

VMware Cloud Director exploit lets hackers seize corporate servers

2 Jun 2020

How data science is transforming business

29 May 2020