tommorris.org

Discussing software, the web, politics, sexuality and the unending supply of human stupidity.


Why primary identity documents matter (and why the DVLA is incompetent at it)

I’ve been grumbling on Twitter about the DVLA.

A long time ago, I applied for and received a provisional driving license with the intention to learn to drive. That provisional driving license expired (I had other things to do besides take driving lessons), so I renewed it recently.

The license I had included a number of errors. Firstly, it had the wrong date of birth and it also had the wrong address. The typist who was putting the details in the system back when I was a teenager obviously was having a bad day and made a keyboard whoopsie.

When I got around to renewing my license, I thought “oh well, they’ll fix that”.

They’ve fixed the address (because I’ve moved since then) but the date of birth is still wrong. What this means is that the DVLA did not actually check the date of birth that I wrote on my application form against any other data: they didn’t look at the existing license and go “wait, those two dates are different - that’s a bit curious, we should probably check that against, say, your passport and birth certificate”.

In addition, when I renewed my license, because of a medical condition I am legally obliged to disclose to the DVLA, they will have requested confidential health details from a hospital where I seek treatment to verify my fitness to drive. In the response sent back from the hospital, it will probably have had my actual date of birth, which will not match the one in their system. But obviously nobody checked that either.

The whole point of having credentials that expire is that when you renew them, you can ensure that all the details are still correct and to protect yourself against making mistakes the first time.

What possible harm could come from issuing documents with incorrect dates of birth? Well, obviously, people who are underage could use them to get served in bars or sneak into nightclubs or whatever. That’s a concern, but not a major one for me.

Here’s a much bigger concern.

When you put someone through a Disclosure and Barring Service (DBS) check—a criminal background check used to verify if someone might have committed offences that might make them unsuitable to work with children or vulnerable adults—you have to provide a variety of forms of ID. It is possible to go through a DBS check with the following documents:

  • a UK driving licence
  • a bank statement
  • a credit card statement

You can use a driving license to open the bank account and then get the credit card simply because of your good history of banking with the bank. The false information on the primary identity document transfers through the rest of the system.

This means that repeated failure by the DVLA to check primary identity documents on license renewals is a potential way that someone who wishes to evade a DBS check could construct a false identity.

It’s a minor inconvenience for me: I have to send my driving license back to them and fill out yet more bloody forms to tell them who I am. But a malicious actor could exploit it to evade scrutiny.

Here’s where it is even madder: the DVLA told me that it isn’t even a criminal offence to knowingly use a driving license with incorrect information on it to pass a test. I phoned them up and told them that the date on my driving license is wrong and they were just “meh, send it back sometime, no biggie”. Not “we’re going revoke that license right now and send you a new one with correct details”.

Government agencies not doing their job when it comes to the very basics of identity verification is a major concern when those primary identity documents are used as a primary marker of trust in an enormous number of interactions. The DVLA’s identity management processes are a bad joke. If they were running a nightclub using the same kind of ID management, they’d probably have been shut down by now.