Sovereignty will be giving considerable attention to the Digital ID proposals being pushed by this repressive Labour Government, not only because it represents a shocking permanent and structural infringement of our civil liberties, but also because it presents another means to micromanage Scottish culture and society.
Whether it becomes real or is just a distraction from something more important not covered by the media, it is still important to understand the threat that the app poses to civil society.
It’s almost impossible to design an app like this without it being intrusive or insecure. Those who work in the tech industry see a lot of clumsy work, whether it’s from BT or other telecom operators in Europe and the US. Personal information is often taken and used without the user’s permission. Unless you are a lawyer who can read the terms and conditions, it is hard to understand them. By the time you do, a new version is already out and the goalposts have been shifted.
Here are some of the reasons why this app is intrusive by design:
- Network Access Is Unavoidable: To verify identity and sync with servers, the app must access your phone’s Wi-Fi or mobile data. Once granted, this creates a channel for data to leave your device.
- Dangerous Permissions: The app would need access to sensitive features:
- Camera (for face/passport scans), without thinking about it, deeper biometric raw data can be captured.
- Biometric Data: fingerprint and face scan data.
- Location (to prove where you are)
- Local storage (to hold cryptographic keys and personal info, which other apps may partially access)
- As a government app, it will have an elevated access to your phone (Private / Restricted APIs) where an API can access eSIM details, phone numbers and many other private metadata
- Bundle new permission requests into an update without clearly explaining why.
- Access to the mic and camera can allow apps to monitor conversations or record without clear notice.
- But over time, with each update, these sort of apps quietly add new permission requirements
- Access to Everything Else: With these permissions, the app isn’t isolated. It sits on a phone full of private data, meaning it could potentially monitor movements, track activities, or even interact with other apps like banking or social media.
However, not only is this app intrusive, in the worst of all worlds, it’s also insecure:
- Most of the apps specially the government apps request permissions they don’t actually need, showing a history of overreach and weak privacy-by-design practices.
- Installing a privileged app effectively gives the government deep access to your phone, turning it into a high-value target for hackers.
- Governments already use or purchase hacking tools (like GrayKey, DropoutJeep, and Pegasus), proving phones are vulnerable. A mandated app could become a new official backdoor for malicious actors, including security services, state agencies and officials.
- Supply Chain Risks: The development and maintenance of the app would almost certainly be outsourced to private contractors, adding uncertainty about the code’s security and transparency.
So the next question that presents itself is, can’t it be made secure?
The functions a digital ID requires – networking, biometrics, location data, and so on – inevitably demand intrusive permissions, and once an app can communicate externally, there’s no reliable way to restrict what information it sends or in whose hands ultimately it ends up.
The bottom line is this: A digital ID app isn’t just a “digital card.” Technically, it’s a form of highly privileged software that behaves a lot like spyware.
Our guess is that a firm like Palantir will be brought in to oversee this technology. Why is the UK government giving £1.5 billion in contracts to a US surveillance firm to build predictive-policing tools and oversee the NHS’s federated data service. What we know is horrifying enough, but many any of those deals are undisclosed to the public.
Principiis obsta! Resist the beginning of a thing! Do not hand over your liberties for the sake of convenience or whatever other threat is used to sell it to you. If you allow yourself to be virtually ghettoised, there is no telling where it will lead.
Sovereignty NEC
Picture via Freepik.