International Porvoo Group Seminar in Reykjavik, May 2005: DEVELOPING ELECTRONIC IDENTITY IS A PAN-EUROPEAN CHALLENGE

Transcription

1 PRESS RELEASE 21 June 2005 International Porvoo Group Seminar in Reykjavik, May 2005: DEVELOPING ELECTRONIC IDENTITY IS A PAN-EUROPEAN CHALLENGE Around 80 representatives from 18 European countries, Japan and USA as well as representatives from the European Commission and the United Nations met in Reykjavik, Iceland on May 2005 to discuss the situation with regard to interoperable European electronic identity and electronic services and the development projects in participating countries, as well as to exchange information about ongoing projects. This was the 7th seminar of the international Porvoo Group, which was established in conjunction with the EU eeurope 2002 project, and which consists of governmental representatives from European countries. The seminar was organised by the Ministry of Finance of Iceland and the Finnish Population Register Centre. The Minister of Finance, Mr. Geir H. Haarde delivered a welcome speech to the seminar. He outlined the three major electronic identity policy objectives in Iceland: general wide spread usage of PKI (Public Key Infrastructure) certificates, an open and standardised market providing certificates and related services, and full benefits of EU- and international standards, thus aiming for interoperability with administrations of other countries as need arises. The Minister told the seminar that although Iceland is preparing for the issuing of biometric passports, there are not at the present time any plans of electronic national identity cards. On the other hand, his ministry has initiated talks with the local banks about the possibility of combining the PKI needs of the government with a new generation of smart payment cards being introduced later this year. The Icelandic PKI pilot project created a basis for the certificate policy Mr. Jóhann Gunnarsson, Head of Division in the Ministry of Finance presented the Icelandic PKI pilot project. The Government of Iceland prepared a strategy for the Information Society in A new strategy was made in The law on electronic signature was enacted in Besides that there are other laws in place pertaining electronic services, for instance a 2003 amendment to the Public Administration Act, giving electronic signatures an equivalence with the traditional method. The usage of the Internet as well as the amount of the electronic services have increased in Iceland quickly. Around 80% of Icelanders use the Internet and around 82% of individuals submitted tax declarations on-line in The digital certificate project was started in The aim was at first to launch the digital certificates at the Directorate of Customs and the Directorate of Fisheries. The pilot project was led by the Ministry of Finance and various institutions and directorates participated in the project. In addition the aims of the pilot project were to expand the customs solution to include: opportunity for other agencies and more stringent rules for identification. Further aims were e.g. to develop a certificate policy and practice, to test interoperation of certificates from various vendors and to introduce the concept to business and public. As a solution there were two types of certificates: public certificate for signing and encrypting etc. and private certificate for accessing government systems. The first certificate was issued in May The certificate policy of the Government of Iceland is based on the European standard ETSI TS , and the Danish OCES certificate policy. It is intended as a specification of requirements for certification service providers in an open market. In a small society like Iceland it is hard to see that there could be room for many PKI s. Therefore it is hoped that this initiative on behalf of the government will lead to an universal system that could be adapted to the various needs of both the administration, the business community and the public.

2 The standardisation work continues in different forums The seminar presented a progress report on an open source framework and organizational approach for achieving interoperability on both client and server with potentially all electronic ID cards that are currently in circulation. Current work focuses on a demonstrator for authentication with the Belgian, Estonian, Finnish and possibly Italian and Spanish electronic ID cards that should be ready for presentation to the eid community shortly. The Porvoo Group will closely monitor the progress. The seminar also discussed the report on the European Cross-Border Legislative eid Environment written by Mr. Thomas Myhr, a Norwegian member of the Porvoo Group. The report has determined authentication legislation and the need for having EU regulate the European electronic identity. It recommends using the Directive governing electronic signatures as a common legislative solution. It was resolved that the report should be sent for comments to certain EU projects. The report is available on the Internet at Biometrics was extensively discussed Biometrics was widely discussed in the seminar. As a legislative and interoperable challenge on a global scale was presented the seafarers biometric identity document, which has been developed in cooperation with ILO, the International Labour Organisation of the United Nations. As well as the seminar heard the latest status of biometric standardization issues in ICAO (the International Civil Aviation Organisation) and ISO (the International Standards Organisation) and the EU BioSec project, concentrating on biometric technologies and security aspects, was presented. Also the situation of the development of the Icelandic biometric passports was considered and it was noted that in Iceland the aim is to issue the first biometric passports in October Germany will start the issuing in November 2005 and Japan in March In Finland the Ministry of the Interior is in charge of the Biometrics project. The aim is to start the issuance of epassports in spring The Finnish Passport Act renewal is in the Parliament at the moment, and the new Passport Information System is being developed as well. During the1st phase in the epassport chip will be stored facial image, the fingerprints will be introduced during the 2nd phase. The introduction of the biometric ID cards is envisioned in Finland during Ms. Silvia Kolligs, European Commission, Directorate-General Justice, Freedom and Security, presented the current state of play on biometrics in EU documents. The facial recognition in epassports becomes mandatory by August Because of the collision issue generated by multi chips in the same booklet it was decided to anticipate the setting up of the VIS (Visa Information System) Central Database. As far as the electronic identity is concerned the so-called Hague Program has invited the European Council, and the Commission to elaborate minimum security standards for electronic ID cards including biometrics. In that respect the Commission organised a meeting for the EU Member States in April Following this meeting the Commission will publish a report in July 2005, not only describing the standards, but also the state of electronic ID card play and plans in the Member States. The Porvoo Group will follow the situation and discuss this document in its next seminar. A plenary discussion on the application of biometrics concluded that a number of countries are considering to set up national biometric databases in support of the epassport. It was also noted that the epassport and the ICAO recommendations have a major impact on the electronic ID card domain. The development work for electronic identity is progressing in different countries As in the previous seminars, country updates were presented on the current status regarding electronic identity in the participating countries. Representatives from a total of 11 countries presented their country update. The number of electronic ID cards as well as the range of electronic services is increasing steadily in all countries. Besides the European countries, updates were also heard from the USA and Japan. With regard to the progress of standardization in the USA, it was noted that in accordance with the main objectives of the Directive on Homeland

3 Security, signed in August 2004 by the President, 20 to 30 million Personal Identity Verification (PIV) cards will be issued to state administration personnel. Regarding the national ID card in Japan and the e-japan strategy, the seminar was told that 450,000 Resident Registration cards have already been issued by local administration. This is the primary card for accessing egovernment services. In addition, there was a presentation of the Asian Smart Card Forum and their vision of one Asia and one Silk Road Card. The international Porvoo Group seeks to support the deployment of electronic identity in Europe The Porvoo Group is an international cooperative network whose primary goal is to promote a trans-national, interoperable electronic identity, based on PKI technology and electronic ID cards, in order to help ensure secure public and private sector e-transactions in Europe. As its name suggests, the Porvoo Group was established in Porvoo, Finland, in the spring of 2002 in conjunction with the eeurope 2002 programme. The Group consists of governmental representatives from European countries; representatives from the private sector and from the European Commission have also attended the two-day seminars, which are held every 6 months. The number of participating member countries has steadily increased; at present, about 30 countries have representatives in the Group. The next seminar will probably be held in Belgium in autumn 2005, and the Porvoo 9 seminar is likely to be organised in Slovenia in spring The 10th seminar will probably again be held in Finland in autumn 2006, during Finland s EU presidency. For more information, please contact: Supervisor Adviser, Ms. Päivi Pösö, Finnish Population Register Centre/ Certificate Authority Services, tel or , päivi.pösö@vrk.intermin.fi, Head of Division, Mr. Jóhann Gunnarsson, Ministry of Finance of Iceland, tel , johann.gunnarsson@fjr.stjr.is or Mr. Jan van Arkel, co-chairperson of the Porvoo Group and Ambassador CEN/ISSS WS eauthentication, tel , arkel@cardlife.nl Material from the seminar and a review of the national situation in certain countries and additional information can be found on the Internet: (Electronic Identity -> Porvoo Group), and With Best Regards, Information Officer, Ms. Irene Rissanen, Finnish Population Register Centre, tel , irene.rissanen@vrk.intermin.fi

4 A REVIEW OF THE NATIONAL SITUATION IN CERTAIN COUNTRIES (based on the seminar presentations) Austria In Austria, there is no obligation to carry an identity card, and as such, there is no plan to introduce an electronic ID card. However, the concept of the Citizen Card ( Bürgerkarte ) has been developed, which allows for electronic signatures and authentication through the creation of different on-line electronic identities by a citizen, and using different media: smart card and mobile phone are two current ones, with the concept also to be applied to credit and debit banking cards. In practice, each citizen decides whether or not to initiate a Citizen Card, and if so, using which media. (Some eservices might require stronger authentication than the mobile phone-based service, for example.) As the Citizen Card can be issued by different public and private agencies, the cost to the citizen varies, from no charge to EUR 15. It is valid for three years but is not an official ID card as traditionally understood (for example, for travel). So far, some 100,000 cards have been issued to approximately 70,000 individuals. As well, some eservices are available to citizens, for which a Citizen Card authentication may be required. Electronic signature is being used. There are several responsible CAs, both private and public organisations, backed by legislation (egovernment Act and esignature Order, both of 2004). Uniquely, the Austrian system does not transmit citizen-identifiable data to eservice applications. It instead uses the concept of sector specific identifier numbers that are generated for each service, and cannot be reverse-engineered to deduce a citizen s unique identifier. This provides a very secure way of protecting personal data from being circulated. There are no bilateral agreements with other national CAs for mutual recognition of cards, but there is a prototype integration of Italian and Finnish electronic identities. Belgium In Belgium, after a pilot project, electronic ID cards were introduced to the population as a whole beginning in September The intention is to replace the current paper cards with electronic ones by the end of 2009 carrying an ID card is obligatory. To date, some 585,000 cards have been issued. The card costs EUR 10 plus local tax, and is valid for 5 years. The card is an official ID document and also acts as a European travel document. The smart card can be used with taxon-web, MyData (Mypersonalfile), e-registered letter, e-banking etc. In place are an EU Digital Signing law and other electronic identity legislation. A Public Key Infrastructure, i.e., PKI-supported signing mechanism, is present for e-transaction services. The introduction of biometrics is envisioned. The responsible CA organisation is Certipost, a semi-private organisation. Estonia Estonia has used electronic ID cards since 2002, and carrying an ID card is obligatory. The national ID cards are issued by the Citizenship and Migration Board. To date, the number of valid electronic ID cards is some 770,000 (the country has a population of 1.4 million). The card is valid for 10 years, and it costs EUR 10; the software can be downloaded free of charge from the Internet. The card is both an official ID document and travel document in the EU and European Economic Area (EEA). Over 100 services can be used with this card. A second chip containing biometrics, facial image and fingerprint, complying with the ICAO (the International Civil Aviation Organisation) recommendations, will be added to the card. The Universal Electronic Signatures (UES) is an Estonian-developed model for reconciling the qualified certificate systems of different countries, facilitating electronic signatures that are interoperable across country borders. The Estonian UES initiative is currently being examined by Belgium and Finland.

5 Finland The issuance of electronic ID cards was begun in The card contains a citizen certificate issued by the Population Register Centre, which is at the moment the only issuer of quality certificates in Finland. From 2003, all ID cards issued by the police have been electronic and are valid for 5 years. The ID card is not obligatory. To date, the number of issued electronic ID cards stands at some 78,000. The card costs EUR 40, and the card reader software can be downloaded free of charge from the web site of the Population Register Centre. From June 2004, holders of the card have been able to have their social security details imprinted on the card. The card is an official ID document and can be used as an European travel document. Electronic signature is already in use. There are over 50 services that use the card, including the Tax Administration, the services of several cities, insurance companies, the Social Insurance Institution, Electronic Forms Finland service and The Finnish Defence Forces. The list of services is available at Several laws are in place pertaining to electronic identity (e.g. the Identity Card Act, Act on Electronic Services and Communication in the Public Sector and Act on Electronic Signatures). The Population Register Centre may also issue citizen certificates for other cards or technical mediums; the certificate can be used on different platforms and is channel-independent. From October 2004 it has been available for the Visa Electron cards issued by the OP Bank Group. The Population Register Centre has also developed, in cooperation with three telecommunications operators, a mobile phone service based on the use of the mobile citizen certificate that allows for the electronic identification of users. The first mobile citizen certificates were used in November 2004 together with the operator TeliaSonera Finland Ltd. Nationwide, the service has been available for consumers since the spring of The use of biometrics is being evaluated, based on experience with the biometric passport. For mutual recognition of electronic ID cards, Finland entered into a cooperation agreement with Estonia in France Over the past year, the ADAE (Agence pour le Developpement de l Administration Electronique) has been working on the development of IAS specification (Identification, Authentication and Electronic Signature). IAS specification is intended to provide a common base for interoperability of the different cards to be issued by the French administration (ID card, Health Vitale Card, Agent Card, Daily Life card). In particular, the ADAE is working with the Ministry of the Interior within the framework of the INES project (Identité Nationale Electronique Sécurisée), which is to develop the National French ID card. The contactless interface will support the biometrics authentication of the holder, and the contact interface the electronic signature service, according to the terms of the European Directive. The objective of the French administration remains the convergence with the German specifications to enable a degree of interoperability for both platforms, which constitute the basis of the future standard for the European Citizen Card. The tenders for INES have been announced for However the roadmap for the deployment of the first ID cards can still move. A decision is to be made concerning whether or not the electronic ID cards will be mandatory in France or remain optional as they are today. Electronic signature is already in use in France for some applications, but is not yet implemented on a large scale or for electronic identity purposes. It is still restricted to specific fields (e.g. professional mail, using commercial certificates). Germany Of the various card projects that the Federal Government is responsible for, currently the main priority is the epassport. Roll-out of the ICAO-based epassport with facial recognition is intended to begin in November Related interoperability tests for different readers and related implementations (the Golden Reader Tool) have been carried out successfully in cooperation with several other European and international nations, such as the Netherlands, the United Kingdom and Japan. Altogether some 30 million epassports will be issued. Additionally, the German Federal Government launched an ecard initiative some months ago. The goal of this initiative is the definition and implementation of a common platform for all upcoming

6 smart cards in Germany, including those that Federal Government ministries will be responsible for (e.g. health patient card, civil servant cards, job card, upcoming electronic ID card) and private offerings in the field of banking cards, with respect to the signed e-signature alliance. The main goal is to establish a common platform for a secure and certified smart card, based upon harmonised standards, and prepared for the implementation of qualified signature functionality. The upcoming electronic ID card is intended to be introduced in The intended usage of the ecard will be both private and public, mostly for access to egovernment services. An electronic signature act has been passed and electronic signature is already in use. Italy In March 2005, Italy approved a national law according to which it will become mandatory to issue citizens an identity card only in the electronic version, when citizens apply, beginning on January 1st, This implies the start, on the same date, of the phase of full deployment of the Italian electronic ID card that will replace within five years all the existing 40 million paper-based ID cards. Electronic ID cards will therefore be issued in all Italian municipalities during In Italy, the municipalities are responsible for granting ID cards. Electronic ID cards are comparable to passports as travel documents. The usage of biometrics (one fingerprint, along with the bearer s photo) in the cards is envisioned. The full deployment phase comes after a successful consolidation and rationalisation phase in 2004 and 2005 (the second in the overall process of electronic ID card development, under the management of the Ministry of the Interior, devoted to the consolidation and rationalisation of processes and technologies), in which 56 municipalities are fully committed plus about 150 to a lesser degree. During this phase the electronic ID cards will be issued to all citizens above 15 years of age. A total of 800,000 cards have already been issued. Access infrastructure for personal data and demographic services is available and working in all 8102 municipalities. The infrastructure for personal data validation services is also available and working through the Internet. The University of Rome Tor Vergata has strongly participated in the development work. The major challenges for Italian egovernment include transforming the traditional processes into electronic forms that can be safely accessed through the Internet, as well as starting the process of creating new electronic services for citizens. The ultimate objective of the Italian government in introducing electronic identity is to safeguard the rights of citizens; the privacy of citizens' data is a high priority in this respect. Italy considers the aspects that are related to the interoperability of electronic identity and electronic signatures between different countries to be important. The Netherlands From September 2004 until February 2005 a six-month epassport trial took place in six Dutch municipalities, where in total 14,700 epassports were issued. The trial focussed on the biometric characteristics of facial images and fingerprints. The testing took place in a multi-vendor environment. Issuance of the new passport will start in the autumn of 2006 and the passport will include facial biometrics. Fingerprint biometrics will be added in a second stage after the EU has laid down the technical specifications for fingerprints in passports. The existing national identity card, of which 10 million are in circulation, will be upgraded accordingly and will have the same characteristics as the epassport in the same time-frame. There is an ongoing discussion on additional features for the electronic ID card. From January 2006, every citizen in the Netherlands must be able to show identification upon official request from the police. Passport, ID card and driver s licence are the documents that will be accepted for this identity verification. Legislation in the domain of electronic signature is in place and two CAs have been accredited to issue qualified certificates. However, there is as yet no heavy use of the national PKI infrastructure. Norway From 1975 the banks in Norway have established joint systems for bank identification cards. Netbanking has become very popular, and the banks are developing a common inter-bank electronic identity system. There are also several other electronic identity systems with PKI technology in use, e.g. the Lottery and Health Insurance. All of these are based mainly on smart cards. Issuing

7 smart cards based on a PKI solution started in 2001, and so far approximately 300,000 cards have been issued. There are many services accessible to cardholders based on acceptance of the cards (e.g. lottery, social security, NetBank, postal services, and student loan agreements). A multiapplication smart card is in use, and the card can have an electronic wallet connected to it. Electronic signature is already being used: an electronic signature act is in force. The Ministry of Modernisation has launched a project that will promote the use of PKI for the authentication of private sector users and individuals when using public services. The project is led by The Brønnøysund Register Centre. Sweden The goal of the government is to give the citizens 24-hour-a-day, 7-day-a-week one-stop-eservices with the use of a standardised electronic identity. The infrastructure can also be used by private companies. At the moment, the responsible CA organisations are Swedish banks and the telecommunications operator TeliaSonera. The CAs will give their customers the electronic identity for free. A law on qualified electronic signatures has been enacted, but there are no CAs registered to issue qualified electronic signatures. The issuance of electronic identities (mostly soft, e.g. stored in a PC file) commenced in So far 800,000 electronic identities have been issued. Electronic identity is not obligatory in Sweden. In 2005, 430,000 persons used electronic identity for their tax declarations. Examples of electronic services which are presently accessible to holders based on acceptance of electronic identity include Swedish Tax Agency services, calculation of a person s retirement pension, registration of a new address, permission to start a lorry, taxi or other vehicle corporation, renewal of bank loans, and a large number of local government electronic services. The Swedish Farmers Supply and Crop Marketing Association will also use electronic identity for contracts between the farmers and the association. In October 2005 the police will begin issuing a national electronic ID card, which will be both an official ID document and a Schengen passport. The card will cost about EUR 45 and will be valid for 3 5 years. The national electronic ID card will use face recognition, and in 2006 will probably also support fingerprint recognition. Whether this ID card will be used to access government eservices is still not decided. The United Kingdom There are plenty of initiatives in the electronic identity field particularly around driver licensing. These include a project to upgrade card production equipment that will produce a highly secure photocard driving licence, and to issue smart cards, once the 3rd EU Driving Licence Directive is in force. In November 2005 there will be a completely new web-enabled driver system. The UK has been very active in discussions with the EU Commission to allow for the introduction of smart cards. The Porvoo Group has supported the Driver and Vehicle Licensing Agency (DVLA) s objective of providing electronic services and promoting interoperability for the benefit of its customers. Plans for national ID cards were delayed because of the recent general election, but a bill to introduce them is expected to become law at the end of 2005, with implementation during The ID cards will be based on passports, and biometrics will remain a key component. There is a need for interoperability across the various UK initiatives, including the smart card driving licence, epassports, local government services (which are being facilitated through the Office of the Deputy Prime Minister) and ID cards.