UK Driver and Vehicle Licensing Agency Supports Secure, Data-Driven Innovation Using AWS

UK Driver and Vehicle Licensing Agency (DVLA) holds more than 47 million driver records and collects about £6 billion each year in Vehicle Excise Duty. DVLA is an executive agency, sponsored by the UK Department for Transport. The information it collects helps improve road safety, reduce vehicle-related crime, support environmental initiatives, and limit vehicle tax evasion.

The Public Cloud for the Public Good

With more than 50 million vehicle-licensing transactions per year and records on every vehicle in the United Kingdom, DVLA is the definitive source of truth for a vast amount of valuable public information. The organization has been gradually digitizing its services for more than 10 years using an API-based approach, and is continually looking for ways to modernize access to the valuable public data it maintains.

“Our data sets are classified as National Information Infrastructure, meaning they have the most potential to do good if opened up,” says Matt Lewis, chief architect at DVLA. “We want to enable the right people and organizations to build innovative, secure solutions that benefit the economy, increase road safety, and provide value to the public.”

This mission is helped by a government-wide initiative in the UK to move IT services to the public cloud. “Historically, we’ve run two government-owned data centers, but we’ve had to feed and water them ourselves,” says Lewis. “As we try to scale up to digitize services and make them more available, managing infrastructure becomes an expensive task for something that doesn’t really add value.” Amazon Web Services (AWS) has become the organization’s destination of choice for many of these services.

An API-First Approach

DVLA was experiencing massively increased demand for the information, rising from 600,000 to more than 70 million requests per month. This was partly due to the discontinuation of the paper “tax disc” once displayed on UK windscreens to communicate that the owner had paid vehicle-excise duty, requiring the public to rely on DVLA online services to identify the tax status of a vehicle.

The organization was also being contacted by companies wanting to build applications that would consume vehicle-related data. Making the data open and available to appropriate uses had significant potential to simplify processes, reduce cost and risk, and contribute to economic growth—but DVLA would need to handle transaction volumes anticipated to measure in billions per month. “We needed to move to an elastic platform that would allow us to scale up and down based on demand,” says Lewis.

DVLA already had services running on AWS and, based on positive experiences, decided to evaluate Amazon API Gateway as a way to provide controlled data access. “We stood up a working prototype in just a few days using Amazon API Gateway,” says Lewis. “The speed with which we were able to deliver it was unprecedented.” Because Amazon API Gateway provides a complete service architecture, the team didn’t have to deploy servers or install, manage, or maintain software.

“When we deployed on premises, we had fixed capacity and had to procure more servers if we went beyond a certain limit,” says Lewis. “That model changed with the cloud, but even then, we had to provision capacity, manage images, create hardened builds, and so on. Now, using Amazon API Gateway, we’ve moved into a serverless world where the only thing we have to worry about is the code—the thing that creates the greatest value—and everything else is taken care of.” DVLA is now able to provide scalable, secure, programmatic data access to police, local authorities, and third parties building value-added solutions.

DVLA is also experimenting with the AWS Lambda serverless compute service. “We started by identifying some use cases that would make sense, such as generating reports from API Gateway data that get delivered to our management and operational teams,” says Lewis. “We’re very interested in the serverless model because it is only triggered when an event happens and you only pay for it when it runs.”

Managing Capacity and Security in a Hybrid World

Amazon API Gateway provides fully elastic scaling, but DVLA needed to control transaction throughput to avoid overtaxing on-premises systems to which the solution connects. “Some of the data and services we’re exposing have fixed resource capacities, so we use throttling to avoid affecting our operational services,” says Lewis. “API Gateway supports rate limits that enable us to control the number of requests in a graceful manner.” Other solutions would have required DVLA to build its own rate-limiting application.

Security was another top priority, because DVLA handles personally identifiable information (PII) and has responsibilities under the UK Data Protection Act to protect that data. “As we expand our APIs, some will be accessible by the public, and others will be controlled,” says Lewis. “By relying on AWS, we can implement levels of authentication and security that are appropriate to the data.”

As part of the move to distributed, “as-a-service” systems with rapid innovation cycles, DVLA is changing how it develops applications. “We are decomposing our applications into smaller, discrete components so we can choose the most appropriate technology,” says Lewis. “AWS introduced more than 1,000 new features in 2016 alone. We want to be running on right-sized, fine-grained components so we can bring in new capabilities as soon as they become available.” With this approach, DVLA can consume rather than manage commodity services, freeing developers to spend time on differentiated activities that create value for the citizens of the UK.