Position Paper Third-country nationals and digital identity management in the EU January 2010
Disclaimer Eurosmart has taken reasonable measures to ensure the quality of the information contained in this document. However, Eurosmart will not assume any legal liability or responsibility for the accuracy, reliability or completeness of any information contained herein or for any consequences of any use.
1. Purpose of the Position Paper Digital identity became a reality with electronic passports based on the international ICAO standard, electronic health cards, electronic national ID cards, electronic driving licences, and e-government services cards. Digital identity is also used for third-country nationals and for immigration requirements. This Position Paper addresses the considerable challenges of harmonisation, cost reductions for development, and the qualification and certification of the applications linked to thirdcountry nationals and immigration. The questions of a possible European Protection Profile and of reader interoperability tests are also raised. This EUROSMART document reflects EUROSMART members analysis of the situation and their position in favour of international standardisation and harmonisation of workflow and technologies in order to achieve the right level of interoperability for electronic identity controls, an equivalent level of security at all borders and a common user interface for citizenship identification and access to electronic services for third-country nationals & immigrants. The main objectives of the controls are: legal/illegal immigrants and legal/illegal workers; overstayers in the EU who have an economic impact; and persons on the wanted list with criminal potential. 2. e-id documents & Identity controls Several electronic documents exist for the identification of people. Each one is specific to a situation: electronic national ID card or e-passport for citizens, Visa for non-visa Waiver nationals, resident permits for third-country nationals who reside in the country, etc. Nowadays only passports meet an international specification (done by ICAO), and recently an EU Decision 1 has been adopted for European resident permits. All deployed electronic national IDs are based on proprietary solutions although a standardisation has been released and is ready to be deployed: the European Citizen Card (ECC, CEN, TC224 and WG15). e-passports and e-id cards were designed, on one hand, to increase security and make forgery more difficult and, on the other hand, to reduce transit time through the automation of border controls. Nevertheless, such electronic documents could be used for the identification of citizens of the controlling country, and also for third-country nationals, asylum seekers, and/or immigrants who need or don t need other additional documents (visa, resident permit, etc.) for the controls. Controls done in the country issuing such an e-id document are easy to perform thanks to the local national infrastructure designed for these e-id documents. Nevertheless, some difficulties could appear when the e-id documents must be checked in another country. Furthermore, controls could be limited to certain geographical areas. For example, the Schengen Area is a group of twenty-five EU countries which have abolished all border controls between them. Implementing the Schengen rules involves eliminating border controls with other Schengen members while simultaneously 1 Council Regulation (EC) No 380/2008 of 18 April 2008 amending Regulation (EC) No 1030/2002 laying down a uniform format for residence permits for third-country nationals
strengthening border controls with non-member states. Rules include provisions on common policy on the temporary entry of persons (including the Schengen visa), the harmonisation of external border controls, and cross-border police and judicial co-operation. Visa requirements for short-term stays in the Schengen area which do not involve employment or a self-employed activity are set out in an EU regulation. In this case, the e-id control is not necessarily done at borders as inland controls can be carried out by the police and authorised persons. This means that local controls must be able to read local and third-country nationals e-id documents with concrete challenges to be met. New kinds of mobile terminals for access to the digital data on cards are required. 3. Challenges on Legal Aspects The usage of e-passports and e-id cards for European Citizens are easy to understand but the documents and processes foreseen for non-european Citizens might need some explanations. The table below shows that some cases are not legally covered in the EU. It demonstrates also the multiplicity of approaches depending on the third-country national s situation. Type Duration < 90 days Duration > 90 days & < 5 years Third-country SIS*, VIS** Resident Permit national with visa Third-country / / national without visa Asylum EURODAC / SIS*, VIS** EURODAC Resident Permit - Document based on ID2 format + Fingerprint based on 10 fingers - Only optical security features in the document + Fingerprint based on 10 fingers - Only optical features in the document + Secure document based on ID1 format + May 2011: face biometry will be added (based on ICAO) + May 2012: fingerprint (regulation based on BIG*** standards) *SIS : Schengen Information System **VIS : Visa Information System ***BIG: Brussels Interoperability Group European Regulation Status for Third-country Nationals The last standards elaborated for e-passport (ICAO) and e-id (European Citizen Card E.C.C.) and the derived Resident Permit meet other requirements. The UK uses a Resident Permit card and standard for non-visa Waiver nationals. The UK has announced that it will expand this program to short-term visitors (e-visa). This is based
on the same IT infrastructure covering enrolment, issuance and trust centres. UK is expected to move to the asylum application on a smart card next year. This British strategy could be easily duplicated everywhere in the EU. In addition to a possible harmonisation of the procedures across the Schengen area, there could be strong benefit through reuse of the technology and tools issuance and control of the ID documents, for nationals, third-country nationals and immigrants. 4. Challenge on Interoperability The security advantages arising of storage and usage of biometric data in electronic documents will only be realized if interoperability is achieved within the Schengen area. Interoperability is a fundamental requirement for e-id cards, the e-visa or electronic National ID Card for all categories of third-country nationals. Only if all electronic documents issued within Schengen or the EU could be read respectively overall in Schengen or in the EU, the following border control objectives could be met: Reduction of illegal immigration at border control entry and through identification of overstayers Facilitation of crossing EU borders for bona fide travellers Fight against terrorism and organised crime Better understanding and management of migration flows Identification of overstayers and wanted persons This interoperability between e-id documents must be complemented by interoperability between additional products in the global system, i.e. readers, tools for biometric data capture, middleware, etc. Challenge on ID Documents The e-resident permit will be deployed in Europe before the end of 2011. Targeting thirdcountry nationals working in Europe, it will allow the electronic identification of those persons and will allow better control of immigration. Challenge on non-compulsory ID countries In some countries (like France), national ID is not compulsory. In these cases, a driving license or passport can be used to travel in the Schengen area. This means that the driving license and passport must be interoperable with the national ID infrastructure. Challenge on Readers There are some standardised tests for readers at the national and ISO level and ICAO is defining some specific tests for e-passports. Nevertheless, complete testing is missing for readers. A new class of mobile readers and MRZ scanners is required. Challenge on Biometric data capture Data capture and data calculation are the same as used for biometric passports. 5. Eurosmart position for the EU 1. Extend the European decision for electronic resident permits based on the ICAO standard to all documents used as e-id documents (National e-id card, electronic Visa, electronic Driving License, electronic asylum card, etc.). 2. Generalise the e-resident Permit document to all categories of third-country nationals.
3. Have a strong European standard for electronic biometry (capture, interface, compression, format ) used in all e-id documents. 4. The EU-roadmap for Border Control and worker control with e-id documents (Passports, Visas, ID cards) and biometrics should be defined at the same time and processed as part of the harmonisation in the European area at the Schengen border. 5. Have completely harmonised and interoperable readers in the EU. Some complementary tools such as testing must be developed and used. 6. EUROSMART can support the European Commission along the way for international standardisation and pan-european interoperability, and the security of each component including smart cards, biometric devices and mobile readers. 7. EUROSMART can support field trial tests at all ports (air, land and sea), if this is requested. 8. A recommendation for a standardised e-gate process in Europe at airports should be helpful for various stakeholders, such as frequent travellers, airlines, ground handlers and border police. This implies interoperability in work flow and technical aspects. A similar technology should be used for land border processing. Such recommendations should be defined by the European Commission.
Eurosmart is an international non-profit association located in Brussels and representing the Smart Security Industry for multi-sector applications. Founded in 1995, the association is committed to expanding the world s Smart Secure Devices market, promoting Smart Security standards and continuously improving quality security applications and services. Eurosmart members are suppliers and manufacturers of smart cards, semiconductors, terminals, equipment and technology for Smart Secure Devices, system integrators, application developers, issuers, associations, laboratories and independent experts. They work in dedicated working groups (communication, marketing, security, electronic identity, new form factors, and prospect emerging markets). Eurosmart is acknowledged as representing the Voice of the Smart Security Industry and is largely involved in political and technical initiatives as well as research and development projects at the European and international levels. For more information, please visit www.eurosmart.com EUROSMART Rue du Luxembourg 19-21 B-1000 Brussels Tel. (+32) 2 506 88 38/ Fax. (+32) 2 506 88 25 Email: eurosmart@eurosmart.com