Hacker News new | ask | show | jobs
by baazaa 186 days ago
On a related note, they built their digital ID so that third parties could verify attributes (it's NOT just a single-service login across government + a linking ID across government services, which is how it was sold by the BBC).

They're pretty close to completely de-anonymising the internet for UK citizens. Say they introduce an Australian-style social media ban for under 16s, then requires all social media to link their accounts to digital IDs for this verification.

Naturally the only remaining loophole is if a UK citizen manages to avoid being flagged as British ever by using a VPN, so I expect they will focus on that going forwards. Keep in mind the UK already arrests and imprisons vast numbers of people for speech offences, there's no slippery-slope argument here because the UK is already at the bottom of the slope as an ultra-authoratitarian anti-speech nation.

7 comments

> On a related note, they built their digital ID so that third parties could verify attributes

Isn’t that the entire point of government ID of any variety? The only reason anyone ever asks to see ID is so they can use it verify attributes of your identity, such as name and age. Otherwise what’s the point of an Identity Document, if it’s not to document something?

Digital ID has always been sold as something approximating your passport/Driver License (there is no official government ID in the UK), but digital, on your phone, and actually a government identity document. Rather than a government document that has a specific purpose (such as crossing the border or driving a car), which people pretend is government ID. Something that can cause a serious problem for people because passports and driver’s licenses aren’t free to obtain, replace or keep valid. Plus the government departments that issue them refuse to take any responsibility or liability for the accuracy or validity of the documents for any use case outside their very specific role in narrow government functions, like crossing the border, or figuring out if you’re allowed to drive a car.

The UK already has citizen SSO that stretches across all digital government services, and has had that for a decade plus now. Although it’s not really attached your identity, it’s just a unified auth system so government departments don’t end up creating their own broken auth systems instead.

> Isn’t that the entire point of government ID of any variety?

Ideally this could be done without deanonymizing accounts to service providers unless the user wants to for a 'verified' account linked to their identity publically but I don't think any digital ID system has been built that way. Imagine it acting like OAuth but instead of passing back an identity token it's just verification of age, platforms would store that which would show they had performed the age verification and could be used for other age gates if there are any.

That's how EU's digital wallet is supposed to work:

> The selective disclosure of attributes will allow you to only share the specific information requested by a service provider, without revealing extra information.

> For example, with the selective disclosure of attributes you could choose to share your date of birth, but without revealing any other identifying details that could be used for profiling.

https://ec.europa.eu/digital-building-blocks/sites/spaces/EU...

You're totally right that it would be easy from a tech perspective to do that. it's a shame that:

(A) most people cannot grasp how it could be that "GovSSO" can attest "This person you just sent our way just logged into GovSSO [with biometric 2FA], and they are at least 16 years old" without the receiving system having any way of knowing who that citizen is or even whether they're 16 or 99.

(B) very real terrible government policies the UK has (like jailing people for speech, and like demanding encryption backdoors that compromise the security, at minimum, of the whole of every British citizen's devices, and at worst every device in the world) incline anyone who's paying attention to assume that the government will somehow use anything related to "ID" and "internet" to do idiotic things like figuring out who owns a Twitter account that committed some wrongspeak so the bobbies can come round them up.

> (A) most people cannot grasp how it could be that "GovSSO" can attest "This person you just sent our way just logged into GovSSO [with biometric 2FA], and they are at least 16 years old" without the receiving system having any way of knowing who that citizen is or even whether they're 16 or 99.

The loophole that every kid everywhere would instantly figure out is that they just need to borrow their mom’s ID, their older brother’s ID, or a pay some Internet service $1 to use their ID.

This is why the services aren’t designed to totally separate the ID from the account. If nothing actually links the ID to the account then there is no disincentive for people to share their IDs or sell their use for a small fee. Stolen IDs would get farmed for logins.

So the systems invariably get some form of connection to the ID itself. The people making these laws aren’t concerned about privacy aspects. They want maximum enforcement of their goals.

> The loophole that every kid everywhere would instantly figure out is that they just need to borrow their mom’s ID, their older brother’s ID, or a pay some Internet service $1 to use their ID.

Do most kids have their parents' ATM card and PIN? Their Gmail credentials and 2FA device? Tons of stuff today relies on a secret the parents aren't supposed to share with their kids. When logging in on a device that wasn't marked "remember this next time" it should be requiring 2FA. Yes, your 19 year old bro can get you porn, but that's been true for like 60 years buying Penthouse at the liquor store.

Of course all this is academic, since the fact is that because things like oAuth are not intuitively grokkable by non-computer people, so no one would accept "having to sign into <porn site> with GovSSO" even if everything was verifiably privacy-respecting.

You just described OpenID
A digital ID can be better than a passport / driver license, because it can verify only specific attributes of the bearer to a third party. E.g. only the fact that you're older than 21 in a liquor store or a car rental, but not other details readily visible in a passport.
Any ID has to reveal enough info to reasonably convince the other party that the ID belongs to that person.

These threads always bring up a hypothetical digital ID that simply says “over 21”, but it’s missing the key point that the ID needs to also give enough information to reasonably tie the identity to the user. Otherwise everyone underage would run around with borrowed or stolen IDs because there was no way to prove it did or did not belong to them.

In theory a digital passport could reveal age 21 or older with a photo and name, but it’s only marginally less info for a lot more complexity.

There are solutions to this. Look at how state ID on iOS is handled.

There’s an enrolment process where your identity is bound to your phone, and secured using biometrics.

When you need to prove age, the device can produce a signed token attesting to fact that your older than 21 etc. and your device is trusted to validate your identity using a biometric scan performed by your phone.

All of this is dependent on everyone trusting your phone to both validate your physical identity before signing something, and also not sharing anything it shouldn’t. But given you can already enroll US state ID on iOS, those problems are clearly solvable.

You mentioned "on your phone". Is it only for phone OSes? A depressing "download from the Google Play Store or the Apple App Store only" app? Are UK citizens required to have it?
It's not a "citizen SSO", even non-residents use it when paying taxes, for self-assessment purposes.

It's Government services SSO.

And no, Digital ID wasn't sold as something like this, it has been sold as a way to prevent (?) "illegals" from working, by introducing system entirely similar to the current eVisa.

Unless you slept through all these televised discussions where Keir Starmer with a stern face explained how a wholly-digital system replacing wholly-digital system will stop these pesky immigrants from getting work (it's almost like in the current systems employers didn't have to do these checks already).

There's been SO, SO MANY lies, like that this system wi be similar to the Polish/Estonian, only these two are primarily physical documents, additionally bearing certificates that can be used to authenticate against the participating systems.

Sure, some countries ALSO have a digital form of the ID, but never advertised as a hate-whip against the others.

The primary problem with the only-electronic Certificate you call ID, is that it's supposed to be always online (never cached, like, say...... Um.....actual Digital ids or cards in the normal phones), so it can be cancelled at any point, also due to the errors of the government employees or systems.

The problem is that MANY people had a very serious problems with eVisa already, leading to being bounced off the Border Patrol or failing to prove right to rent.

Even if the idea of the ID was in general good (and I use one I really love, works wonderfully well), this government lied too many times and is forcing us to eat the frog that we've seen many times prior, is half baked and will burst in someone's face.

This idea is tainted because we're lied to and it's half-baked, and hostile in principle, not helpful.

You’re making the assumption that inherently support the creation of Digital ID. I’ve not expressed support for it, I’m just highlighting that if someone is going to criticise it, they should at least understand it well enough to make useful, accurate, criticism.

Criticising ID for making it possible for 3rd parties to verify attributes is a ridiculous thing to do, because that’s the entire point of ID.

If someone wants to criticise the exact mechanism used to allow 3rd parties to verify attributes of someone’s ID, then they should be clear about what that mechanism is, and why it’s problematic. Otherwise it’s impossible to have a sensible discussion, and discuss the various pros and cons of different implementations.

At the end of the day it’s beyond clear we’re moving towards a world where governments and people expect the internet to work closer to how the real world works, with equivalent limitation such as age gating. Putting forward inaccurate, and hyperbolic arguments about arbitrary, indistinct risks associated forms of Digital ID ultimately does us all a huge disservice, because it creates the opportunity to dismiss all criticism as little more than hysterical whining by people uninterested in learning about the societal problems Digital ID is meant to deal with. Which ultimately means we’re removed from the entire discussion about alternative approaches to Digital ID, or implementations of Digital ID that are privacy preserving.

If we’re not involved in those discussions, and seen as creditable contributors to solving the underlying problem, then those pushing for more authoritarian approaches win the argument by default.

Nobody asked for it. Digital ID is being introduced to help the government, not the people.
> Keep in mind the UK already arrests and imprisons vast numbers of people for speech offences

I think you’ve been spending too much time on Twitter

> While figures show that the total number of arrests for online posts fell to 9,700 last year, down from a record 13,800 in 2023...

https://freespeechunion.org/daily-mail-investigation-exposes...

This is based on statistics for the Malicious Communications Act. That includes people sending, for example, threatening messages to an ex partner.

Not all of them are online posts, in fact probably a minority

That's what would be reasonably expected, but it's not backed up by the information.

> The total arrest figures are likely to be far higher because eight forces failed to respond to freedom of information requests or provided inadequate data, including Police Scotland, the second largest force in the UK. Some forces also included arrests for “threatening” messages, though these do not fall under the specified sections. [emphasis added]

https://www.thetimes.com/uk/crime/article/police-make-30-arr... (https://archive.is/kC5x2#selection-3325.0-3325.335)

Thanks. That wasn't clear from the Mail article above.

But the Times article also says:

> A spokeswoman for Leicestershire police said crimes under Section 127 and Section 1 include “any form of communication” such as phone calls, letters, emails and hoax calls to emergency services.

So I think the categorisation is a mess, and probably not even consistent across forces

I have to say, it is a bit astonishing how much you are in a kind of bargaining stage of trying to rationalize how what is happening, is not actually happening, all while the trap doors are closing all around you even though very slowly.

Why do you think that is?

It is not just a British thing, because this ruling class tyranny is descending all across the western world, regardless of whether it is particularly egregious in the UK. Or should we maybe just start calling it Airstrip One at this point, the AO?

Maybe I am reading these wrong, but it doesn’t appear to me these sources indicate that a significant number of people are being arrested for “speech offenses,” which I’m guessing you are using as shorthand for statements akin to those that would fall under “free speech” in the US. If I’m not seeing it or I am not correctly defining what you mean, feel free to correct me. I’m having to make some assumptions here
It can be hard to wrap your head around it from the US, but many of these are people that are in fact being arrested for writing posts on social media, e.g.,

https://www.bbc.co.uk/news/uk-england-york-north-yorkshire-6... (arrested for post wearing a Manchester Arena bomber costume)

https://www.bbc.co.uk/news/uk-scotland-glasgow-west-60930670 (arrested for posting "the only good British soldier is a dead British soldier" from Scotland)

that would be categorically protected speech in the US.

How many arrests does it take to chill free speech?
How many were for politcal speech as opposed to say threatening to murder someone?
I would say even one is too many.

The law was written in such a way intentionally to suppress speech. People who wrote it ain’t stupid.

Huge numbers are for political speech. It's not just prosecutions. Child protection is abused to force far left wing beliefs on the population.

A former Marine was charged with inciting racial hatred after describing some migrants as “scumbags” and “psychopaths” in a 12-minute video posted on Facebook following the murders of three children in Southport, which sparked riots around the country. He was then banned from coaching his own daughter's football club. A jury cleared him in 17 minutes, but Wales is run by the left so they kept the coaching ban in place because they believe right wing people are a threat to children.

In another case a teacher was banned from working with children after telling a Muslim child that "Britain is still a Christian state"

There are lots of cases like this. Especially if you expand to Europe. The German Chancellor has personally prosecuted thousands of speech cases against people who insulted him. Merkel established a general rule against insulting politicians so now people get police visits and their devices confiscated for saying things like such and such a politician is a dumbass.

> Not all of them

Do you understand the concept of a slippery slope? Anyone being arrested for online posts is too many from a free speech absolutist pov.

Free speech absolutism is a nonsensical position.
A car without gas is still a car, but you need to work to get it anywhere.
I thought Daily Mail was close to tabloid status (or a bit above). Aren’t they banned from being a citation on Wikipedia?
It is by no means a good publication, but at the same time being accepted as a citation on Wikipedia or not is not necessarily a particularly objective measure of quality. I recommend reading https://www.tracingwoodgrains.com/p/reliable-sources-how-wik... for the critical perspective on Wikipedia's integrity in this regard.
They are a trash paper so skepticism is warranted but care should be taken not to dismiss facts just because of who reports them. Thankfully, we don't have to depend on the word of the Daily Mail for evidence that the UK doesn't value the ideal of free speech and are far too comfortable punishing and silencing online speech. It's a problem, and it makes their efforts to tie people's online activity to an individual worrying.
Best reply of siblings, by far.
The Daily Mail is definitely tabloid, although some might describe it as a comic. There are reasons why Wikipedia doesn't allow it as a source.
> There are reasons why Wikipedia

Wikipedia by itself is not a reliable source [0].

[0] https://en.ejo.ch/public-relations/manipulation-wikipedia

It's a chipwrapper.
The Daily Mail is frequently referred to as either 'The Daily Fail' or 'The Daily Heil' (referring to the fact they supported Oswald Mosley and his fascist ideals, and remain very right wing). It is not a quality publication by any means.
The simple threat of arrest, even if they only happen by the hundreds, is enough to have a chilling effect on free speech.
https://www.thetimes.com/uk/crime/article/police-make-30-arr...

> Officers from 37 police forces made 12,183 arrests in 2023, the equivalent of about 33 per day. This marks an almost 58 per cent rise in arrests since before the pandemic. In 2019, forces logged 7,734 detentions.

This article really doesn't go into what the communication was about. They have some anecdata, but once you go into 10k+ of examples, you're almost guaranteed to get mistakes. Maybe the situation is bad overall, but that article really doesn't show it.
In England and Wales there are 85k people serving custodial sentences and 250k community sentences. 12k seems significant, if true.
Arrests are not the same thing as imprisonment or community sentences.
Here is House of Lords if Twitter is unreliable

https://hansard.parliament.uk/lords/2025-07-17/debates/F807C...

Online Communication Offence Arrests Volume 847: debated on Thursday 17 July 2025

I wouldn’t dismiss this so easily, the Palestine Action stuff is pretty appalling.
You mean folks choosing to protest under the guise of a proscribed organisation?

Protesting in favour of Palestine remains legal, doing so under the name of a proscribed organisation is not.

Admittedly, the reason for them being proscribed is rather idiotic.

That's exactly it. The proscription is ridiculous and delegitimises the whole concept of proscribed organization. It collapses into "mere support for Palestine is an arrestable offense". This didn't work against Sinn Fein and it will not work now.
> It collapses into "mere support for Palestine is an arrestable offense".

It explicitly doesn’t do that, folks are still very much free to protest in support of Palestine.

> The proscription is ridiculous

They broke into a military base. If that was sanctioned by the organisation, they should be shut down.

That's the organisation. The knock on effects are quite considerable. https://www.theguardian.com/books/2025/nov/27/sally-rooney-p...

Also the whole thing moved incredibly quickly; it went from new organization to banned almost immediately. I'm fairly sure that other groups previously like the Greenham Common camp didn't get this treatment.

It was reasonable to arrest people who actually broke into the base and those who organized it. Going after those speaking in support is what's excessive.

The same PM who proscribed PA defended in court a woman who did exactly what PA was doing, painting warplanes in protest.
Exposing the military for being an inept paper tiger is a truly heinous crime.
So you understand that the proscription is the core problem, but in the same breath, still focus the blame on protestors for fighting this proscription?

By the way, in case you somehow overlooked it, the whole point of people protesting under the banner of Palestine Action is to protest the illegitimate proscription.

then you haven't been paying attention. the UK is in fact arresting people for all sorts of speech online. the vast majority is not a call for violence at all.
How many people would you guess were arrested last year for online posts?
Or spending too much time in jail from speaking freely.
compared to most countries that's correct
Parallel realities. Over here it seems like the US is a dystopia, with how hostile their leadership is to democratic institutions and how greatly it empowers oligarchs.

They think that European countries (or commonly just "Europe") are about to arrest all citizens for criticizing politicians. "Europe" must be saved from their leftist fascist regimes. For now using propaganda. Soon militarily.

Didn't Germany just make it illegal to insult politicians?
It's illegal to insult anyone in Germany, and has been for a long time. Libel, slander, and insults are all criminal (not civil) offences. I know what you're thinking: "That sounds crazy" - Yeah, it kinda is. In practice this is rarely enforced, as the offended party must file a formal complaint and most people have better things to do.
> "That sounds crazy" - Yeah, it kinda is. In practice this is rarely enforced

Generally, selective enforcement is itself a huge problem. That might not actually be an issue in this instance though if the only thing preventing enforcement is the lack of a formal complaint and assuming that the complaint process is easily accessible to everyone (not requiring money to file, and without other barriers that might prevent certain people from filing but not others). It's still a terrible idea to make it illegal to insult others, but "rarely enforced" may not be the red flag it usually is.

Well, time is money, right? If someone files a complaint and goes through with whatever proceedings ensue you can bet that it's not a single mom working a full-time job. For police officers, on the other hand, enforcing this law on behalf of themselves is part of their job. So in practice this law is grossly unfair. It does lead to a greater level of decorum in public debate than in most other countries, which is nice, but it's not a fair law by any means.
German prosecutors actually did a bizarre and out-of-touch (for an American audience) interview with 60 Minutes recently where they proudly declare they're going to bring order to the Internet and how things like calling politicians "dicks"[1] is rightfully VERBOTEN.

> But it was a 2021 case involving a local politician named Andy Grote that captured the country's attention. Grote complained about a tweet, that called him a "pimmel," a German word for the male anatomy. That triggered a police raid and accusations of excessive censorship by the government. As prosecutors explained to us, in Germany, it's OK to debate politics online. But it can be a crime to call anyone a "pimmel," even a politician.

Naturally, it's necessary to arrest people for being mean and/or expressing VERBOTEN political beliefs on the Internet so that...uh...everyone will feel free to express their opinions.

> Josephine Ballon: This is not only a fear. It's already taking place, already half of the internet users in Germany are afraid to express their political opinion, and they rarely participate in public debates online anymore. Half of the internet users.

https://www.cbsnews.com/news/policing-speech-online-germany-...

Germany does not protect free speech the way the US does. You're free to voice any opinion, but the exact wordings in which you are allowed to do it are restricted. You are allowed to say "I hate Merz" but not "Merz is a piece of garbage".

I'm not saying this is good, but it's not recent and it does not prevent free communication of ideas.

No, that has been illegal for a long time.

It's being enforced more these days, perhaps because social media makes it more tempting and easier to insult politicians in a manner where it can be easily detected. In the old days, you'd have to hand out flyers or get your letter to the editor published in a newspaper, in order to insult politicians where they could notice, and even then there was no way to automatically detect it. But when people insult politicians on social media, it's an extremely low bar for the effort required, both to do it, and to detect it.

If someone were to insult me on social media, I'd never know about it, because I'm not constantly monitoring Twitter. But some politicians pay some agency to constantly monitor Twitter etc, and then they file complaints about everyone they catch in the act, and then the jackbooted police kick down the perpetrators' doors and confiscate their phones and computers.

Are these adults? This level of sensitivity is what I'd expect from a toddler. We tell them to ignore it and usually/hopefully they grow up into healthy adults that don't mind insults from strangers.
Don't forget that Digital ID really has been pushed by Labour after a meeting with Larry Fink and BlackRock. This is how democracy gets bypassed by the wealthy and in functioning country it should result in the entire government going to prison. Unfortunately MI5 that is in charge of that is asleep at the wheel - probably corrupt themselves.
The UK is the country with the biggest yearly outflow of millionaires in the world. And the numbers are huge: there are about the same number of millionaires in the UK and in France, about 3 million. And yet there are 20x more net millionaires outflow leaving the UK than leaving France (16 000 vs 800 net outflow).

Make of that what you will but to me the net outflow is the canary in the coalmine.

The UK is headed for a dark future.

Wait are you baazaa9, I love your writings and specially your analysis of bureaucracy
> Keep in mind the UK already arrests and imprisons vast numbers of people for speech offences

No it fucking doesn’t.

> Keep in mind the UK already arrests and imprisons vast numbers of people for speech offences.

Vast? No, they really don't.

How would you argue that more than one arrest is fair in a modern democracy? Can you even point to an arrest where it passes the pub test?
Is tens of thousands vast enough for you?