As part of our ongoing work to increase GOV.UK Verify’s demographic coverage, we have been looking at projects that consider the use of different sources of activity history when proving an individual is who they say they are. This is because adding more data sources and a choice of methods will open up GOV.UK Verify to more people. We thought we’d share some of our latest work in this area, specifically exploring online activity history.
There 5 different elements involved in identity verification, and your chosen certified company has to achieve specific thresholds in each one before they can verify your identity. Although the creation of many online accounts does not require details of a real identity at the point the account is set up, the accounts themselves are potentially a useful source of evidence that an identity has been active over time. This means the accounts can provide evidence of activity history, as described in the Good Practice Guide 45, under Element E.
Testing a hypothesis with the OIX
Because of this, we recently took part in an Open Identity Exchange (OIX) Alpha project, together with Post Office, Experian, Verizon, LexisNexis and Veridu. The project looked at the online activity (social network data) of users and explored how an individual might release this in order to prove activity related to their identity over time. The project tested the following hypothesis: ‘A service providing online activity verification data allows for assertion of activity history of an individual and contributes to establishing a trustworthy digital identity for access to online services’.
The project took place between March and June 2016 and consisted of two parts:
- User research where we tested the concept with the user
- Testing of the service developed by Veridu specifically for this project
This was a follow on to an OIX project conducted in 2013 that looked at the use of social login data for digital identities.
What we discovered with user research
The user research involved 12 one-to-one sessions with users. We took users through the prototype of the user journey where we introduced a page that allowed them to choose from a number of online accounts to prove their activity history.
The overall reaction to using online accounts such as Facebook, PayPal, LinkedIn and others as part of the process of proving their identity was positive.
The younger the participant, the more likely they were to complete the task with ease. Users from the older demographic, while still completing the task, were more likely to raise privacy concerns or to be worried that their data would be used for purposes other than identity verification.
Because we always operate within the identity assurance principles, any new data source or method for identity proofing would only be implemented by certified companies if a user gave their explicit and informed consent. And it would be one of many options certified companies give users to assert their identity.
Compared to the findings from 2013-2014, our recent research suggests that people appear to be becoming more amenable to using online activity verification and allowing certified companies access to their personal online accounts to acquire a verified identity that gives safer, faster access to government services. Since 2013, there have also been developments in technology that allows for detection of whether the user is a real person or not. With these advancements the activity history of online accounts is much more valuable in an identity verification context.
The Veridu service
After completing the user research, Veridu built a service that aligned with our standards for Element E - activity history. The service allowed users to assert their online account activity to see whether it would fulfil requirements for Element E.
We had 86 people, from across participating organisations, testing the service using their real online accounts. The service looked at the activity history within (one or more) online accounts asserted by the users. Veridu reviewed almost 240,000 activity events and scored them as per Element E of the standards. More than 86% of participants - using their online activity from Facebook, Twitter and other social media sites - met the requirements of Element E.
Potential increase to demographic coverage
Office for National Statistics survey data commissioned by GDS suggests that 52% of UK adults have a social media account they use on a regular basis (at least once a month). The data we’ve gathered shows that if activity from such accounts could be used for activity history, GOV.UK Verify’s demographic coverage of the adult population overall could increase by 9%, and for the 16-25 demographic could see a potential increase of up to 38%.
The project has now completed and the report summarising all the findings can be found on the OIX website.
We are taking forward a number of projects with private sector organisations that investigate how they can help their customers and improve GOV.UK Verify’s coverage. We’re interested in hearing from others who are developing identity services based on new data sources - do get in touch using the comments section below.
6 comments
Comment by Howard Gannaway posted on
For older people why not use Amazon?
Comment by Rebecca Hales posted on
Hi Howard
Thanks so much for your suggestion - the study does consider Amazon and we've also passed your on to the team looking at expanding data sources.
Comment by Cameron posted on
Is is possible to obtain some more information around you research results and discovery?
Comment by emilychng posted on
Hi Cameron,
Thanks for your comment and your interest in this work.
There’s an overview of the Alpha available on the OIX website here: http://oixuk.org/?page_id=3386 and, as mentioned in the post, you can read the full details of the report and its findings in the White Paper published by OIX here: http://oixuk.org/wp-content/uploads/2016/07/UseofonlineactivityaspartoftheidentityverificationFINAL-1.pdf
This work will all feed into the ongoing improvement of GOV.UK Verify and we’ll keep you up-to-date on any developments that directly result from this research here on the blog.
Comment by Stephen posted on
Will bio-metrics (eg facial recognition) being used by FB et al become part of this ID channel?
Comment by Emily Ch'ng posted on
Hello Stephen. Our certified companies are free to innovate and provide a variety of methods that meet the high standards for identity assurance set by Government. Some of the certified companies already provide this kind of service to their users.