Senior civil servants involved in the UK government’s GOV.UK One Login programme have raised concerns about the security of the system, according to reporting by ITV News. One Login underpins the government’s planned Digital Wallet digital identity initiative and is already used by an estimated 13 million people to access services including state pensions, passport-related services, and professional registrations.
ITV reports that whistleblowers with direct knowledge of the programme believe the system contains severe security weaknesses that could put large volumes of personal data at risk. The planned Digital Wallet is expected to store core identity attributes such as name, date of birth, nationality or residency status, and a biometric facial image. ITV further reports that the government has confirmed digital ID will become mandatory for all adults by 2029, although this characterization has not yet been fully detailed in formal programme documentation.
According to the whistleblowers, One Login is not meeting required UK government cyber standards, including Secure by Design principles and the Cyber Assessment Framework. ITV also reports claims that individuals without the expected level of security clearance were able to access sensitive system components, including development staff based in Romania. Additional concerns were raised about system administrators using unsecured devices, potentially creating a pathway from the public internet into protected system environments.
Leaked internal documentation cited by ITV indicates investigators assessed the programme as carrying a high level of risk. ITV reports that the National Cyber Security Centre identified potential consequences including large-scale theft of personal data, identity fraud against government services, economic harm, and the possible exposure of individuals such as witnesses under protection, intelligence personnel, or foreign dissidents.
One reported incident involved a red team exercise in which a remote attacker was allegedly able to introduce malware onto a system administrator device and access sensitive areas without triggering monitoring alerts. The government told ITV that this scenario involved a deliberately constructed test after weeks of unsuccessful red team attempts, intended to further evaluate security controls. Whistleblowers, however, expressed concern that the access itself went undetected.
In response, a UK government spokesperson said protecting user data is a top priority, that the programme works closely with the NCSC, that staff hold appropriate security clearances, and that vulnerabilities identified through testing are addressed.
Sources: ITV News, GOV.UK, UK Parliament Research Briefing
—
By Ali Nassar-Smith
