Article Details
Digital ID will never be hacker-proof – here’s why
Published on September 27, 2025
ANALYSIS
Experts warn our data can never be safe as the Government plan to launch Digital IDs for all UK citizens
Share this story from The i Paper - and spark a conversation. Gift up to 10 articles a month to a friend, so they can read for free
Share this story from The i Paper - and spark a conversation. Gift up to 10 articles a month to a friend, so they can read for free
The Government’s plans to roll out mandatory digital ID cards are facing fresh scrutiny, after a series of recent data breaches exposed official government email accounts, passwords, staff addresses, and mobile numbers.
The introduction of ID cards, first revealed by The i Paper, would mean digital identifications become mandatory for right to work checks by the end of this Parliament.
Sir Keir Starmer who has been under pressure to stop the influx of illegal migrants entering the UK, often on small boat crossings, insists the ID scheme will make a significant dent in illegal working.
New Feature In Short Quick Stories. Same trusted journalism.
But as cyberattacks on public service providers, high street chains, and critical national infrastructure become a regular occurrence, experts and officials have raised concern over the plans, urging the government to ensure that security and transparency are at the centre of the ID card scheme.
David Omand, former UK security and intelligence coordinator and director of GCHQ, said the scheme could offer enormous benefits, but only if it is implemented securely.
“State hackers in particular will want to hack and disrupt,” he told The i Paper. “The system can and must be made secure. That will take GCHQ care, time and resources.”
“Security must not be skimped, but it will be worth it,” he added.
The digital IDs would be stored on smartphones on an app in the GOV.UK’s wallet and checked against a central database of people entitled to live and work in the UK (Photo: Labour Together)
Exposed Government data
There have been a series of government data blunders raising concerns about how safe our data is. In 2022, the details of Afghan’s who worked for the British military were leaked accidentally by an Ministry of Defence staffer, and in April a data breach of millions of legal aid applicant’s exposed sensitive details. In 2023, the details of police staff in Northern Ireland were mistakenly leaked in response to a Freedom of Information request.
Stolen and leaked data often finds its way onto the dark web, a hidden, intentionally obscured part of the internet that cannot be found using regular search engines like Google. It requires special browsers for access and so its the perfect marketplace for hackers who sell and exchange stolen data that could be used for future cyber-attacks.
Cyjax is a private cyber security firm that goes undercover on the dark web to seek potential threats to the UK. In their latest investigation they discovered over 1,300 government email-password combinations, contact details, and addresses that have been obtained by hackers in the past 12 months.
The i Paper did not access any personal data on the dark web but has been shown chat room advertisements among hackers offering government data.
The UK has been subject to a flurry of leaks and cyber incidents in the past year (Photo: Reuters)
Chris Spinks, head of operations at Cyjax, warns that we cannot trust a government to protect us from cybercrime when its own staff fail to avoid fall victim to hacks and leaks.
“The Government is building the technical infrastructure; the data warehouses; the secure access,” he said. “The problem is that the people who are building it are already being compromised.”
A government spokesperson to The i Paper that they are confident in their security to protect not only its own staff from hackers but the public it serves, “and that commitment to cyber security remains at the centre of the introduction of national ID Cards”.
Spinks also warned that the greatest weakness in data security is people. “We’re becoming very exclusive to the people that are digital natives,” he said. “And we are excluding those who are immigrants into the digital world – and that can never be a good thing. The more we push towards digital, the more we actually become less secure for those who aren’t security focused.”
Keir Starmer said digital ID would be an enormous opportunity for the UK to prevent illegal working (Photo: Leon Neal/PA)
Announcing the ID card scheme on Friday, Keir Starmer labelled it as an “enormous opportunity” for the UK, which will “make it tougher to work illegally in this country” and make borders more secure.
“It will also offer ordinary citizens countless benefits, like being able to prove your identity to access key services swiftly,” he said. “Rather than hunting around for an old utility bill.”
The Government has stressed that digital ID has been designed with the “best-in-class security at its core”, adding that digital credentials will be stored directly on people’s own devices and protected by “state-of-the-art encryption and authentication technology”.
The digital ID cards will allow people to verify their identity online or in person using apps or web portals. It will allow users to control what data is shared and with whom and create audit logs of every access to data.
The Information Commissioner’s Office has confirmed it will oversee the development.
“People will want to know that their information is going to be handled carefully and securely,” a spokesperson said. “We will scrutinise the details of the plans as they become available and continue to work with government to ensure it has people’s trust and confidence.”
At the time of publication, a petition demanding the government halt its plans for digital ID had just topped over one million signatures.
Lessons from Estonia
To ease skepticism, the Government has pointed to Estonia’s successful digital ID card model, where citizens use unique digital numbers to access nearly all services from banking to GP appointments.
Karolina Ainge, the former head of Estonia’s cyber security policy, urged that digital ID can build a trust between the public and technology if it prioritises transparency.
“Britain’s democratic traditions and respect for civil liberties make it ideally placed to implement digital ID correctly – with proper safeguards, transparency, and citizen control,” she told The i Paper. “Instead, it clings to “the right to be insecure” while criminals plunder billions and citizens waste countless hours on bureaucracy that other nations automated decades ago.”
She added: “Estonia’s experience offers a clear lesson: properly implemented digital identity enhances freedom, prevents fraud, and strengthens democracy. The real threat to British liberty isn’t digital ID, it’s continuing without it while the world, and criminals, move on without you.”