The UK government’s flagship digital ID program is facing a crisis of confidence just weeks before its first major mandatory implementation. On November 18, 2025, identity verification (IDV) will become a legal requirement for all new and existing company directors and Persons with Significant Control (PSCs). This process relies on the new GOV.UK One Login platform and the associated GOV.UK Wallet.
Despite government assurances that the system is \”simple, secure and robust,\” the platform is being publicly challenged by MPs and cybersecurity experts over \”serious cybersecurity concerns.\” Veteran civil liberties campaigner and Conservative MP David Davis has been a vocal critic, warning of \”flaws in the design and implementation of One Login that could expose millions of citizens to hackers.\”
Specific flaws alleged by critics and whistleblowers include failed red-team tests, with a government \”red team\” simulating a cyberattack reportedly gaining \”privileged access\” to One Login systems during a test in March 2025. Davis has also alleged, citing whistleblower reports, that development work on the platform was conducted on \”unsecured workstations in Romania\” by contractors who had not received security clearance. The system has allegedly missed a 2025 deadline for securing \”critical systems\” and, according to one whistleblower, will not pass all key security tests until March 2026.
The government is attempting to force adoption of its digital ID using a mandatory \”stick\” for employment and business registration. However, this public feud demonstrates that the government has prioritized its political deadline of November 18 over ensuring and demonstrating the system’s technical security. This \”rollout-at-all-costs\” approach is creating a significant trust deficit that could be catastrophic for public adoption and the security of citizens’ data.
The controversy comes as GOV.UK One Login crossed 10 million users earlier this year, with the government touting strong early adoption. The platform has been positioned as a cornerstone of the UK’s broader digital identity strategy, which has seen partnerships with industry players to provide certified identity verification services. The security allegations, however, threaten to undermine confidence in the entire ecosystem just as mandatory implementation begins.
The UK’s approach contrasts sharply with other jurisdictions that have taken more cautious paths to digital ID adoption. While the government maintains that the system meets security standards, the public nature of these allegations and the involvement of senior MPs suggest this controversy will continue to dominate headlines through the November 18 rollout date and beyond.
Sources: GOV.UK; Computing UK
—
By the ID Tech Editorial Team
