It is being reported in the news this morning that the government is planning to introduce mandatory Digital ID cards, initially for a "right to work" purpose.
Forgoing the many legal and civil arguments for and against this; I wondered if people in the IET had opinions on the technical aspects.
Personally I am against what I have heard so far. There are no details on implementation yet, however with schemes like this that will usually not come until implementation long after parliamentary debate is over, so social debate cannot wait for full detail.
My main worry is that they have framed it as based around the smartphone. Saying it will be "like a bank card" (Lisa Nandy on Today). This seems (from admittedly vague and unsure descriptions from not-very-tech-savvy MPs) to be locking us into the duopoly of smartphone OSes, Apple's iOS and Google/Alphabet's Android. Neither is open source, and both are utterly controlled by businesses in the US. Obiovusly there are social concerns around forcing mandatory ID onto smartphones (it makes smartphones mandatory for one thing, despite the other worries about their effects. The same government is looking to ban them in schools!). But techincally how long will they be supported? How secure will they be? I suspect they will be very secure, but support will be expensive and tail-chasing after a while (5-10 years). Making the system web-based would be less secure, more open to abuse like DDoS attacks; but would unlink the system from operating systems. I doubt there will be any other variants, like a Linux-based way of providing your ID.
I am ok with many functions on my smartphone as they are optional, things I chose to do for convienence sake like banking and email. I am do not think this is the same. The mandatory nature should come with other support, be that physical cards for those that want to move away from these devices or businesses, or some other way to ensure that we are not destroying technical freedoms and future innovation by tying our entire society into 2 smartphone makers who already have immense influence and control, and whom the state have no sway over.
What are other people's thoughts? Any other technical issues you have concerns about (forgery, data breaches, verification)?
