UK Government faces claims of serious security and data protection problems in One Login digital ID
The Government Digital Service was warned about serious cyber security and data protection problems in its flagship digital identity system, with insider claims that the data of three million users may still be at risk
The Government Digital Service (GDS) was warned by the Cabinet Office and the National Cyber Security Centre (NCSC) that its One Login digital identity system had “serious data protection failings” and “significant shortcomings” in information security that could increase the risk of data breaches and identity theft.
Problems were subsequently confirmed by an internal investigation led by GDS’s chief information security officer (CISO). But when, soon after, an MP wrote to the Cabinet Office to enquire about potential issues around the information security of One Login, GDS did not mention any of the warnings in its response.
According to claims by a whistleblower, many of the security problems that were reported have yet to be resolved.
One Login is the government’s flagship system for securely accessing online public services, and underpins the Gov.uk digital wallet and the digital driving licence launched by technology secretary Peter Kyle in January this year as part of his new government digital strategy.
The whistleblower – who Computer Weekly has agreed not to name, but who has many years of cyber security experience and worked in a senior information security management role at GDS – first warned GDS leaders of serious cyber security problems with One Login in July 2022.
He says his warnings were not heeded, forcing him 18 months later to write to his MP to highlight the issues, citing the 1998 Public Interest Disclosure Act, which protects civil servants who whistleblow about situations they believe to be in the public interest. He was subsequently informed by GDS that he would face disciplinary action.
As a result of his initial warnings, then GDS chief executive Tom Read found out that development work on One Login had been offshored to Romania, without his knowledge or approval and without first seeking advice from the NCSC.
The whistleblower claims that some of the security failings he identified have still not been addressed, and as a result, the information security of the three million users of One Login remains at risk.
He cites over two-and-a-half years of reluctance from the GDS digital identity team to fully address his concerns.
https://www.computerweekly.com/news/366622533/Government-faces-claims-of-serious-cyber-security-and-data-protection-problems-in-One-Login-digital-ID