Would you care to comment on why gov.uk is using 3rd party analytics scripts run by a company based in a foreign country on the online tax assessment form for UK citizens?

Getting rid of that massive privacy and security hole would be a much better use of your time and resources than farting around with the blockchain.

Ouch. That is a pretty serious security hole on a tax website, they're using Google Analytics - google or someone who breached their security could entirely take over the tax website and record all the data.

Wouldn't it be a lot safer to handle their own analytics with a self-hosted solution rather than paying google for it? At the very least they could self-host the js so that they control what is being run on their own domain.

I don’t know about HMRC’s solutions and I haven’t looked at the tax self assessment form so I wouldn’t like to comment on that.

On the main GOV.UK we use Google Analytics Premium; Google certify that information in a premium account will not be inspected by themselves. They also self-certify as a Safe Harbour supplier[1], although obviously with the framework having been dissolved late last year that’s up in the air. I’m also informed that we truncate the IP before sending it to try and mitigate potential geolocation.

Obviously I’m just an employee of GDS: none of this is an official statement.

[1] https://www.google.com/policies/privacy/frameworks/

Looks like interesting work.

But is this actually a blockchain at all? Isn't it a signed database which could be central or distributed (with distributed not giving you any significant advantages but lots of downsides)?

I realise the word blockchain is trendy (which is probably why this 'chief scientist' has latched on to it), but it doesn't seem applicable to me to most of the problems faced in government, which are better solved by cryptography and a certain degree of centralisation of data. Why would we want a distributed NHS register of patients for example?

The security issues and complications with untrusted nodes and distributed consensus are legion, and the blockchain as used in bitcoin is a particularly inefficient way to address them (proof of work etc).

It’s not a blockchain, it’s a Merkle tree (at least as far as I understand it, I’m only involved with Registers at the presentation layer).