Gov denies Verify could be used to spy on you

GDS issues rebuttal to paper claiming identity assurance scheme degrades your privacy

Government

The government has denied its new identity assurance service, Gov.uk Verify, could lead to mass surveillance of citizens, following claims made by a group of academics.

Verify reduces the privacy of citizens due to technical flaws in the system's architecture, wrote the three authors of a paper titled Toward Mending Two Nation-Scale Brokered Identification Systems.

The Government Digital Service (GDS) designed Verify as a way for people to prove they are who they say they are when using government services online, and HMRC is already using it with allegedly mixed success.

Verify relies on a central hub to mediate interactions between the departments providing a service, companies performing the identity checks and the citizens using Verify.

Users of Verify are passed to identity authentication providers, who ask questions and use official documentation to confirm citizens' IDs, the idea being to limit the amount of information the government or the providers have on people.

But the authors of the research, Lus Brando, Nicolas Christin, and George Danezis warned too much trust has been placed in the hub, through which all the information travels, as it has the power to read encrypted information coming from identity checks and users themselves.

"The excessive trust placed on the hub could be notably used to support undetected mass surveillance," the report read.

"Leaving the hub outside of the scope of privacy and security goals triggers serious problems. As currently inferred, [Gov.uk Verify] may actually degrade the privacy of citizens."

However, the GDS published a blog post this morning denying Verify could be used to spy on people.

It read: "Gov.uk Verify does not allow for mass surveillance. It does not have any other connection with or ability to monitor people or their data.

"Only minimal data passes through the Gov.uk Verify hub. The person's name, address and date of birth [and gender] is sent through the hub to a government department the person is trying to access.

"No data about the person's interactions or activities within certified companies or government departments passes through the hub."

But the GDS did say the report's findings added to the pool of knowledge around digital identity assurance issues, and has welcomed Danezis as a member of the government's privacy and consumer advisory group.

Verify's use by HMRC came under scrutiny this month after thousands were understood to have missed out on a marriage tax break because they were asked to provide documents many people did not actually have.

In response, HMRC is introducing an alternative process for those who have been unable to use Verify to apply for the tax break.

Featured Resources

Digital document processes in 2020: A spotlight on Western Europe

The shift from best practice to business necessity

Download now

Four security considerations for cloud migration

The good, the bad, and the ugly of cloud computing

Download now

VR leads the way in manufacturing

How VR is digitally transforming our world

Download now

Deeper than digital

Top-performing modern enterprises show why more perfect software is fundamental to success

Download now

Recommended

Cisco finds an increase in security concerns due to remote working
Security

Cisco finds an increase in security concerns due to remote working

21 Oct 2020
What is hacktivism?
hacking

What is hacktivism?

13 Oct 2020
Webhose and Signal Corp boost data breach detection
Security

Webhose and Signal Corp boost data breach detection

7 Oct 2020
Mozilla and Brave release one-click method for online privacy requests
web browser

Mozilla and Brave release one-click method for online privacy requests

7 Oct 2020

Most Popular

The enemy of security is complexity
Sponsored

The enemy of security is complexity

9 Oct 2020
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

5 Oct 2020
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

5 Oct 2020