OGC Gateway Reviews published
(hat-tip Phil Booth of NO2ID, and of course the people who battled for these to be released, such as SpyBlog).
Some quick and dirty highlights from the documents (my comments italicised).
Identity fraud is estimated to cost the economy at least £1.3 billion every year and the level is rising. [we know this figure is itself fraudulent.]
On costs vs benefits – there was no cost-benefit analysis
The review team did not consider that the studies of costs and risks that have been completed are sufficiently robust to support any firm conclusions as to the outturn costs or delivery timetable.
There is an urgent requirement for considered analysis of the costs and benefits of the programme, and the various options within it, and of value for money. Although some work on costs and levels of charges has been undertaken, only limited attempts have been made so far to assess the time profile of costs or to quantify benefits from the programme. The expectation that ongoing costs of the programme can be covered by (monopoly) charges for passports and driver licences, thus making the programme self-financing, does not, of course, remove the need for a serious analysis of costs and benefits.
The scheme does less good than hoped, with perceived benefits seemingly not on a scale to justify the costs and some erosion of public support for the scheme.
The Police felt that the absence of any obligation to carry or produce identity cards would substantially remove the administrative savings and some of the other advantages that Identity Cards would offer.
Another important task for the period ahead will be a fuller and more considered assessment of risks, together with means for reducing or managing it and assignment of responsibilities for this.
The programme is as yet undefined. It cannot therefore be said to be aligned to the business strategy as policy has yet to be agreed.
There is no evidence that the skills and capabilities for this programme are readily available nor have arrangements been made so far to secure them. The Department is not yet well placed to manage the programme successfully.
Programme scale. The sheer scale of the programme could lead to difficulties.
Poor systems architecture. This could severely reduce benefits from the scheme and increase cost.
No appropriate framework is in place for risk management.
Unexpected data problems. This is an ever present danger.
Biometrics. Opinion seems divided on how effective or dependable biometrics will be. There is little past experience, in the UK or elsewhere, to go on. Pilots will be especially important. [The pilots, of course, didn't go well.]
On project definition and processes
The main task for the next few months will be programme and project definition, within the context of the government’s wider programmes for citizen information and establishing personal identity. Within this, key elements will be: Confirmation of the keenly focussed and precisely stated objectives, purposes and scope for the Programme that Home Office Ministers have already defined. It will be vital to confirm these (with slight refinement if necessary) and then to stick to them. …
processes for cleansing and maintenance of data. It seems evident that a single database will be required. [note that the government is now proposing two databases, the passport database and the DWP's Customer Information System]
On support and enthusiasm
Inadequate support and commitment (we noted with some concern that the main potential beneficiaries of an Identity Cards scheme, such as police, DVLA, Passport Agency, IND, DWP, Inland Revenue and the financial sector, though generally supportive, were not quite as enthusiastic about the programme as might have been hoped. [also a risk]
List of interviewees
Well, not one interviewee could be said to be independent from government, with the possible exception of the “[name redacted] Independent Consultant”.
Although a robust management framework, resources and plans are now in place with potential for success, many complex issues remain to be addressed and a great deal of further work is required to establish a solution that is feasible, affordable and achievable with a high degree of certainty. We have identified many critical areas where intensive work will be needed before the next review.
We felt that the current team structure placed insufficient focus on the vital task of budgeting and financial modelling and does not provide clear separation between financial control and contract management.
The Department has reached firm decisions (rightly in our view) to make the proposed Card an Identity Card rather than an Entitlement Card, to build the National Identity Register from scratch and to interview people (and collect the chosen biometrics) before populating the register. [of course this has now changed, hasn't it? The NIR will be based on the passport database and DWP's Customer Information System]
We understand that the Programme Board also leans towards the development of a common, integrated service team for conducting interviews and collecting biometrics rather than dividing this task between several different agencies. This too we would strongly support. [But late last year the Home Office was talking to retailers and the Post Office about setting up booths to gather biometric data.]
In considering the deliverables for the project, it will be important to see the Identity Cards programme as a whole system for enabling public services, the police and others who need to do so, to establish with a high degree of assurance the identity of persons they are dealing with. As with telephone handsets and credit / debit cards, the card itself will be a relatively small element in the whole.
The cost estimates date from work carried by consultants last summer. In our view, they cannot be considered to be adequate for the full business case.
On funding the Department have made clear that they will assign priority to the delivery of the Identity Cards programme and finding the necessary funds with help from HM Treasury. There are some concerns about funding in the Partner Departments.
Currently the team’s approach to risk management does not yet integrate the risk effects into the programme cost and schedule. The approach to risk management needs to be developed and some external help may be needed for this.
We recommend that the programme adopt a more integrated approach to the assessment of risk, cost and timescale.
Not one was independent of government.