URGENT MINISTERIAL BRIEF: GOV.UK One Login Security Crisis

Date: August 2025
Classification: OFFICIAL-SENSITIVE
For: Secretary of State / Minister

THE PROBLEM

GOV.UK One Login has critical security vulnerabilities that create unacceptable risks for your government.

• Red team testing revealed attackers can gain privileged access without detection
• System has failed to meet government cybersecurity standards for three years
• Lost its official certification under UK Digital Identity Trust Framework
• Creates single point of failure for 60+ million citizens' data

WHAT THIS MEANS FOR YOU

Political Risk

• Parliamentary crisis if breach occurs after proceeding despite known vulnerabilities
• Daily headlines about government ignoring security warnings
• Personal accountability for decision to continue rollout
• Opposition attacks on competence and citizen protection

Financial Exposure

• Potential breach costs: £10+ billion in compensation and system rebuild
• Prevention costs: £100 million maximum
• Treasury pressure inevitable after any major incident

National Security

• Prime target for hostile states seeking to compromise UK digital infrastructure
• Mass citizen data exposure in single successful attack
• Undermines UK's digital leadership internationally

YOUR OPTIONS

Option 1: Continue Rollout (HIGH RISK)

• Outcome: You own any security incident personally
• Timeline: Breach likely within 12-24 months of full rollout
• Political cost: Career-ending if major incident occurs

Option 2: Pause for Security Review (RECOMMENDED)

• Public message: "Security-first approach ensures world's most secure digital identity system"
• Timeline: 3-6 months for full remediation
• Political benefit: Seen as responsible leadership prioritising citizen protection
• Cover: NCSC and security experts support this approach

IMMEDIATE ACTION REQUIRED

This week:

1. Announce security review - frame as strengthening, not admitting failure
2. Pause rollout pending independent certification
3. Brief PM/Chancellor on decision and rationale

Next month:

1. Commission independent security audit
2. Work with NCSC to achieve compliance
3. Prepare for parliamentary questions with security-focused narrative

KEY MESSAGES

For Media

"We are taking a security-first approach to ensure GOV.UK One Login meets the highest international standards for protecting citizens' data."

For Parliament

"Following the latest security assessments, we are conducting additional testing to ensure this system is absolutely secure before full rollout."

For Civil Service

"The Minister has prioritised citizen security and requested comprehensive validation of all security measures."

BOTTOM LINE

You have two choices:

1. Proceed and own the inevitable security crisis
2. Pause now and be seen as the minister who put security first

Recommendation: Announce immediate security review. The political upside of being cautious far outweighs the downside of a delayed rollout.

Next Steps: Private Office to arrange urgent meeting with Permanent Secretary and security officials within 48 hours.

Prepared by: [Your details]
Clearance level: [If applicable]