Is digital ID worth the risk?

Is digital ID worth the risk?

In September 2025, UK prime minister Keir Starmer announced that a new digital ID system would be implemented by the government to tackle illegal migration. Much like confirming identity when using banking applications, the digital ID would confirm a person’s right to work in the UK.

The UK already has a variety of identification systems in place – an NHS Number is assigned to everyone registered for NHS care, and a National Insurance Number is assigned to each UK national at the age of sixteen, proving their right to work in the country. Although both of these are strings of numerical or alphanumerical characters unique to each person, they do not confirm identity, unlike the optional passport and driver’s license, which verify identity with a photo.

“National Insurance is just an alphanumeric sequence. If I were to lend my alphanumeric sequence to someone else, even if they looked it up, there’s not much that can be gleaned from it,” says Duncan McCann, head of tech and data at Good Law Project.

It is interesting to note that the UK’s current stance on security and surveillance runs contrary to most of Europe. Most countries in continental Europe have mandatory physical identity cards, but there are fewer surveillance cameras.

According the government’s announcement, the digital ID system is intended to make it easier for people across the UK to use vital government services, such as improving access to welfare and applying for free childcare, as well as right to work checks. Apparently, this is to “send a clear message that if you come here illegally, you will not be able to work, deterring people from making dangerous journeys”.

History repeats

This is not the first time the government have attempted to deliver a means of identification. In 2006, the UK government, under then prime minister Tony Blair, brought the Identity Cards Act 2006 into UK law. It also created a resident database, known as the National Identity Register. However, the scheme faced widespread opposition and was later scrapped in 2010 when the Conservative/Liberal Democrat coalition government came into power.

“The Tony Blair Institute has pursued a policy agenda of trying to promote the idea of digital ID for the UK,” says James Baker, platform, power and free expression programme manager for Open Rights Group. “They’ve pushed that through international organisations like the World Economic Forum, and they’ve worked with other governments to pursue digital ID with them.”

Previously, the National Registration Act 1939 was brought into force during the Second World War and required every citizen to carry an identity card with them, until the act formally expired in 1952.

In 2016, Gov.uk Verify was launched as an identity assurance system to provide a single trusted login across the government’s digital services. However, the success rate for verifying identity was only 47% and the service eventually closed in April 2023.

Although the digital ID scheme was not part of Labour’s campaign during the 2024 election, the policy has since become a key focus following Starmer’s announcement in September. It is worth noting that the Tony Bair Institute for Global Change is a supporter of digital ID, claiming digital IDs “radically speed up citizens’ interactions with government, cutting bureaucracy and reducing errors”.

As part of the Data (Use and Access) Act 2025, which recently came into force, the regulatory framework for data sharing in regard to digital verification systems was enacted into UK law. However, it is worth noting that digital ID and digital verification are two separate things. Digital verification involves a unique identifier being created for sharing data across multiple government departments.

Although the Tony Blair Institute’s paper claims support for digital ID is not party-political, every other political party either opposes or has concerns about it. The Liberal Democrats state: “Imagine if the government devoted this much money and focus on getting GP waiting times down, or fixing social care, instead of pursuing the Labour Party’s decades-long obsession with ID cards and more state control.”

Centralising vulnerability

Many of the concerns regarding the digital ID system relate to how digital IDs will be implemented. The current proposal is that identity will be confirmed through a centralised system.

Centralised systems are inherently vulnerable to attacks as they create a potential single point of failure. Furthermore, any system that contains details on the entire population of a country will become a target for hacker groups, including those sponsored by nation-states. We have already seen this with Estonia’s approach to a digital government.

“The Estonia system, which is touted as being excellent, had a security flaw in some chips they issued on their cards,” says Baker. “If you have a centralised system, you create a central vulnerability for something to go wrong.”

A far better system would be one that is decentralised, where multiple approved partners are able to confirm identity and share this confirmation when requested. This disseminates personal information across multiple trusted platforms, which mitigates the risks of downtimes and attacks.

“It is possible to create a privacy friendly and decentralised way of doing digital ID,” says Baker. “You could have a system where anyone could create a wallet using open-source credentials and different organisations could issue digital credentials to that wallet to prove that credential.”

Mission creep

A stated goal for the digital ID is to prevent illegal workers, but illegal migrants often work in the grey economy (work that is not taxed or monitored by the government). As such, there is little to no checking of a person’s right to work, which would limit digital ID’s effect on reducing illegal migration.

As the government would have to spend hundreds of millions of pounds on creating a national ID system, there would naturally be a desire to maximise benefits from this investment, potentially by deploying the system into other departments.

“When they have spent hundreds of millions on a system just for checking whether you can work, there’s going to be a huge temptation to see what else can they use it for,” says McCann. “Suddenly, you’ll have to present it at all these other places it was never planned for.”

This is not as far-fetched as some might think – the Tony Blair Institute have campaigned for transforming government services through AI and population data, which could be enabled through the digital ID population database.

There is also the question of how the project would be funded. The government is already cutting benefits and raising taxes to cover the current financial predicament it finds itself in, so funding a project as complex as this would be a challenging undertaking.

As with any digital system, there are concerns about what data will be used, especially if it is more than just a person’s name, such as gender, date of birth and address. This data would be valuable for hackers and organised crime groups, who could use it as part of nation-wide fraud scheme executed over the internet.

Some of these concerns could be mitigated through a transparent development process, where a national identification system is created openly using a decentralised verification model. However, this method seemingly runs contrary to the government’s plans for a centralised database to confirm identity.

A tool for discrimination

Far more insidious is the risk that a digital ID system could be used as a tool for discrimination. There have already been instances of US president Donald Trump’s policies influencing other governments, such as the rollback of LGBTQIA+ data protections. As such, any future authoritarian government could weaponise a digital ID system as a tool for oppressing minorities. For example, Romania’s digital ID system denies birth certificates to children of same-sex parents.

As with any digital project, there also needs to be consideration for the digital divide. There are many people, including some elderly and disabled people, who do not own a digital device. As such, there would need to be a method for people to non-digitally confirm their identity.

It could be argued that a digital ID system is unnecessary, as the UK already has various identification methods (including NHS Numbers and National Insurance Numbers). Even if NHS number and National Insurance number cannot adequately verify identity as they currently stand, updating the existing system could be a simpler and more cost-effective method than what is currently proposed.

Ultimately, the Digital ID will be a tool with pros and cons. Furthermore, identification cards are nothing new, but the fact that it is digital and requires the UK population’s data has raised many concerns (the petition against digital IDs currently has nearly three million signatures). A decentralised system that only uses the absolute minimum data for verifying identity would allay many of these concerns.

“There’s this idea that it is going to solve the problem of illegal migration and we have serious doubts about whether it does anything to solve the problem,” concludes McCann. “It represents a real danger for minority communities. There’s a real issue with the way it’s been brought out.

“These seismic changes to the relationship between state government and authorisations to do things should either be a manifesto commitment or at least brought through public debate. This seems like a knee-jerk response to counter a right-wing narrative.”



Source link