UK Digital Driving License
The UK has announced plans to bring in a digital driving license as part of a new Government App. They envisage that this could also be used as proof of identity and age in fields such as buying alcohol or checking in for an internal airplane flight. A previous plan to introduce digital identity systems in the UK was proposed in 2002 but eventually scrapped in 2010 after a claimed spend of £5bn.
In possibly related moves OFCOM published a statement on age assurance for web content providers on 16th January 2025. This specifically relates to the Online Safety Act and is designed to protect minors from potentially harmful content. A statement by Sir Keir Starmer on 22nd January proposed tougher age restrictions on the online purchase of knives, including kitchen knives within the UK. Either scheme might benefit from some kind of digital ID to prove age but might discriminate anyone without a digital driving license.
The current driving license has not changed since 1997. It includes personal details together with a photograph (which could be now be 20 or more years old) but does not need to be carried at all times and is not required for someone who does not drive a car. In short it is far from a national ID card. The new digital format could be seen as a move in the direction of an ID card. As with any App some device will be required to access it and hence govern security of access to the bearer’s personal information.
The driving license data will be secured by a ‘wallet’ within the new digital App so unauthorised access will require the wallet to be open in addition to unlocking of any device hosting it. This is the same approach in use within many banking apps. It is a system that has already proved to be vulnerable. One avenue of attack is to snatch a phone while it is unlocked and an app is open. The owner would be vulnerable while using the device to verify their identity in a public place. Another approach is to observe a user and note any codes required to open an app. The device is then snatched while still unlocked. In either case the criminals will have full access to banking details because the phone has already verified that any transactions involving it are legitimate.
Software systems have been introduced to combat unauthorised access. On IOS for example there is ‘Stolen Device Protection’. This setting can be turned on or off but if enabled enforces a 1-hour delay before key security settings can be changed. This would include details such as changing the Apple account password. The logic behind the delay is that a thief cannot immediately change passwords and lock the genuine owner out of the system. This gives some time to contact any institutions where data might be compromised and to remotely lock the device.
Biometric settings such as face or fingerprint recognition also help to protect data on mobile devices but push users to adopt increasingly expensive and sophisticated devices to have the optimum security protection. There is also a need to frequently replace these devices as new features are often not supported by older hardware. Although some users do follow this route others make do with less sophisticated solutions or may not have or decide not to use any such device. There has been a recent trend to the use of non-smart phones for users who want to reduce their online contact time. Regardless of any reason for not having a suitable device some driving license holders will not be in a position to take up the digital version. A paper driving license option will still be available but non-adopters might find themselves at a disadvantage in some situations where businesses assume digital identity verification is open to all.
