Gov denies Verify could be used to spy on you

The government has denied its new identity assurance service, Gov.uk Verify, could lead to mass surveillance of citizens, following claims made by a group of academics.

Verify reduces the privacy of citizens due to technical flaws in the system's architecture, wrote the three authors of a paper titled Toward Mending Two Nation-Scale Brokered Identification Systems.

The Government Digital Service (GDS) designed Verify as a way for people to prove they are who they say they are when using government services online, and HMRC is already using it with allegedly mixed success.

Verify relies on a central hub to mediate interactions between the departments providing a service, companies performing the identity checks and the citizens using Verify.

Users of Verify are passed to identity authentication providers, who ask questions and use official documentation to confirm citizens' IDs, the idea being to limit the amount of information the government or the providers have on people.

But the authors of the research, Lus Brando, Nicolas Christin, and George Danezis warned too much trust has been placed in the hub, through which all the information travels, as it has the power to read encrypted information coming from identity checks and users themselves.

"The excessive trust placed on the hub could be notably used to support undetected mass surveillance," the report read.

"Leaving the hub outside of the scope of privacy and security goals triggers serious problems. As currently inferred, [Gov.uk Verify] may actually degrade the privacy of citizens."

However, the GDS published a blog post this morning denying Verify could be used to spy on people.

It read: "Gov.uk Verify does not allow for mass surveillance. It does not have any other connection with or ability to monitor people or their data.

"Only minimal data passes through the Gov.uk Verify hub. The person's name, address and date of birth [and gender] is sent through the hub to a government department the person is trying to access.

"No data about the person's interactions or activities within certified companies or government departments passes through the hub."

But the GDS did say the report's findings added to the pool of knowledge around digital identity assurance issues, and has welcomed Danezis as a member of the government's privacy and consumer advisory group.

Verify's use by HMRC came under scrutiny this month after thousands were understood to have missed out on a marriage tax break because they were asked to provide documents many people did not actually have.

In response, HMRC is introducing an alternative process for those who have been unable to use Verify to apply for the tax break.