Download as PDF, PPTX
PPT - SIGMA-GIZ Academies - Topic 2 - eID_Kask
This document outlines a joint initiative by the OECD and EU focused on electronic identification (eID) and trust services, emphasizing the importance of a strong legal and technical framework for eIDs in facilitating secure digital transactions across borders. It addresses challenges faced in implementing eID systems, particularly in maintaining security and interoperability among EU member states. Additionally, it discusses the proposed 'eIDAS 2.0' regulation aimed at enhancing mutual recognition of electronic identities and trust services to ensure smoother access to public services within the EU.
More Related Content
Similar to PPT - SIGMA-GIZ Academies - Topic 2 - eID_Kask
More from Support for Improvement in Governance and Management SIGMA
PPT - SIGMA-GIZ Academies - Topic 2 - eID_Kask
- 1. A joint initiative of the OECD and the EU, principally financed by the EU. 1 Laura Kask, CEOProud Engineers, Estonia SERVICE DESIGN AND DELIVERY IN A DIGITAL AGE Academies for EaP countries Digital transformation
- 2. A joint initiative of the OECD and the EU, principally financed by the EU. 2 Laura Kask, CEOProud Engineers, Estonia SERVICE DESIGN AND DELIVERY IN A DIGITAL AGE Academies for EaP countries Implementing eID on national level: legislation, tech, governance
- 3. A joint initiative of the OECD and the EU, principally financed by the EU. Table ofcontents 1 Introduction 2 Key Principles of Trusted eID 3 Building Blocks of Trusted eID 4 eID Transformation Process 5 eID organizational structure 6 European legal framework for eID and trust services 7 Estonian national framework for eID and trust services What have been the challenges? 8 Cross-border implications of eID and trust services
- 4. A joint initiative of the OECD and the EU, principally financed by the EU. Laura Kask • FormerChief Legal Officer for Government CIO, Republic of Estonia • CEO of Proud Engineers • Visiting lecturer at Tartu University IT Law Programme • Obtaining PhD at Tartu University “eID and trust services in national and cross-border transactions” Proud Engineers: architects for a digital society
- 5. A joint initiative of the OECD and the EU, principally financed by the EU. 5 Do we actuallyknow who is behind the computer? Peter Steiner published by The New Yorker on July 5, 1993
- 6.
- 7. X-Road® digital signature id-card e-school 2000 2001 20022003 2004 e-Estonia timeline id bus ticket eesti.ee e-tax board m-parking e-cabinet
- 8. 2005 2006 20072008 2010 e-Estonia timeline i-voting e-police system e-notary e-justice mobile-id company registration portal e-health system keyless signature infrastructure e-prescriptions
- 9. 2011 2012 20132014 2015 e-Estonia timeline smart grid visualised business register ev quick charging network public services green paper e-residency e-service of the Estonian Road Administration e-receipt
- 10. 2017 2018 20192020 e-Estonia timeline reporting 3.0 AI strategy kick-off: proactive government crossborder e-prescription NIIS X-Road® consortium data embassy 2021 7 invisible services proactive family benefits e-notary for remote verification bürokratt
- 11. Key principles of trustedeID Without these, success is unlikely
- 12. Strong eID isbased on strong physical identity eIDs must only be issued using a carefully secured process involving capture of biometrics
- 13. Unique and ubiquitous identifier of citizens Mostbusiness processes in the country must use the identifier, assumes a robust population registry.
- 14. Breaking the stalemate The citizenswill not take the ID or remember the PIN codes, when there are no services. There will be no services built for no customers.
- 15. The eiD must havea legal meaning Without a legal framework, the eID is simply people doing complex math
- 16. Building blocks of trustedeID These need to be built
- 17. Legal framework • Populationregistry and its legal significance • Regulation of trust services • Electronic signature and its significance • Dealing with legacy • Education of legal practitioners • Revamping regulations requiring paper-based processes
- 18. Capabilities • Cybersecurity to •drive requirements for eID and validate deliverables • monitor the ecosystem • execute incident response • Cryptography to keep the ecosystem developing • Legal to drive legal changes • Architecture to define, manage and develop the technical ecosystem
- 19. Trust services • Trustservices create and operate services underpinning the trust in eID • Certification Authority and Registration Authority • Time Stamping Authority • Signature creation and validation • Trust must stem from audited, regulated and supervised adherence to standards
- 20. The ecosystem • Itis not possible for a • single government authority to build eID due to the range of capabilities and changes necessary • single private sector organization to build eID due to the lack of critical mass in terms of customers and services • Create and manage an ecosystem of service providers, integrators, technology providers, researchers, cybersecurity practitioners, trust service providers etc. • Alternatively make sure to participate in one
- 21.
- 22.
- 23.
- 24. Supporting the visionexecution
- 25.
- 27. European legal frameworkfor eID and trust services
- 28. European legal frameworkfor eID and trust services: eIDAS Regulation
- 30. Mandatory recognition ofelectronic identification for Member States 1. May ‘notify’ the ‘national’ electronic identification scheme(s) used at for access to its public services 2. Must recognise ‘notified’ eIDs of other Member States for cross-border access to its online services when its national laws mandate e-identification 3. Must provide a free online authentication facility for its 'notified' eID(s). 4. May allow the private sector to use ‘notified’ eID NB! No obligation to recognize eIDs outside EU NB! Only EU level agreement between a third country is a possibility (there is now an option to overcome the legal gap)
- 31. Trust Services eIDAS createsan European internal market for electronic trust services by ensuring that they will work across borders and have the same legal status as traditional paper based processes.
- 32. Trust Services When thepublic sector accepts a document being signed electronically, they must accept documents signed electronically in the same format from the other member states or with the service offered by the other service providers.
- 33. Trusted List • Memberstates maintain and publish trusted lists where they have all the necessary information about the qualified service providers acting inside the EU. • Trust services provided by trust service providers established in third country shall be recognised legally once there is an agreement between the EU and the third country. • Trust services provided services provided by trust service providers established in third country shall be recognized when they are in the trusted list and audited in the EU, provided by EU located service provider.
- 34. Principles of trustservices • Technological neutrality. • Mutual recognition of «qualified» electronic trust services. • Ensuring validity and legal certainty of cross-border electronic transactions through the impossibility to reject a document on the grounds that it is in electronic form.
- 35. Levels of e-signature(electronic signature) • The simple e-signature has a low level of security and assurance. It cannot guarantee that the person signing the document is who he pretends to be. • It does not provide details on the signing event (such as time, date etc.) either. For example, when ticking the “Accept terms & conditions” box of an online transaction, using stylus etc.
- 36. Levels of e-signature(advanced e-signature) • Advanced electronic signature – an electronic signature is considered advanced if it meets certain requirements: a. it is uniquely linked to the signatory; b. it is capable of identifying the signatory; c. it is created using electronic signature creation data that the signatory can, with a high level of confidence, use under his sole control; and d. it is linked to the data signed therewith in such a way that any subsequent change in the data is detectable. • Certificate for electronic signature – electronic proof that confirms the identity of the signatory and links the electronic signature validation data to that person.
- 37. Levels of e-signature(qualified e-signature) • Meets the requirements of advanced electronic signature and in addition, it is created based on the use of a qualified signature creation device (QSCD) and relies on a qualified certificate for electronic signatures. • These two extra features ensure that the qualified e-signature is unique, confidential and secure. • Only electronic signature that is equal to handwritten signature (wet signature) and there cannot be exceptions in national law
- 38. Legal consequences • Qualifiedelectronic signatures are equal to handwritten signatures (eIDAS article 25) • Usage in private sector? • Usage in public sector?
- 39. How to becomea qualified trust service provider? • Apply to a conformity assessment body assessing compliance against the requirements for qualified trust service providers and qualified trust services. • The conformity assessment body will produce a conformity assessment report, demonstrating how the requirements have been met. • Submitting the report to national supervisory authority who will grant you qualified status if appropriate – service will be added to the national trusted list and will be able to use the eIDAS EU trust mark. • There is a requirement to undergo the conformity assessment process every two years, at your own expense.
- 40. Conclusion • The eIDASRegulation: • ensures that people and businesses can use their own national electronic identification schemes (eIDs) to access public services in other EU eID are available; • creates an European internal market for eTS - namely electronic signatures, electronic seals, time stamp, electronic delivery service and website authentication - by ensuring that they will work across borders and have the same legal status as traditional paper based processes; • consists of regulation, implementing acts, standards (ETSI), national laws and implementing acts; • sets rules for mutual recognition of eIDs and cooperation between the member states; • regulates trust service providers and trust services to be recognized across EU.
- 41. European legal frameworkfor eID and trust services: eIDAS 2.0
- 42. 42 Do we actuallyknow who is behind the computer? Peter Steiner published by The New Yorker on July 5, 1993 Justification for amendments: about 60% of the EU population in 14 Member States are able to use their national eID cross-border. Only 14% of key public service providers across all Member States allow cross-border authentication with an e-Identity system. Aim of eIDAS 2.0: by 2030 80% of the EU population are equipped with a digital wallet that will allow them to prove their identity and authenticate themselves on public services in all EU countries and the UK, regardless of their nationality *https://commission.europa.eu/strategy-and-policy/priorities-2019- 2024/europe-fit-digital-age/european-digital-identity_en
- 43. Mutual Recognition ofeIDs + currently notified eIDs + up to Member States to decide which schemes to notify + country should accept notified eIDs that are equal of higher level than the eID used in their country (public sector) + Mutual recognition of electronic identities is not considered in eIDAS (although, being an exclusive competence of the EU could be the object of international agreements under art. 218 TFEU) eIDAS 2.0: +The right of every person eligible for a national ID card to have a digital identity that is recognised anywhere in the EU +Operated via digital wallets available on mobile phone apps + MS are obliged to notify at least one “Wallet” under a national eID scheme to make them interoperable at EU level. © copyright
- 44. 44 Article 3 (42): isa product and service that allows the user to store identity data, credentials and attributes linked to her/his identity, to provide them to relying parties on request and to use them for authentication, online and offline; and to create qualified electronic signatures and seals What is an European Digital Wallet?
- 45. Main challenges 45 + Theproposal offers no rationale how the obligation to issue and recognise the wallet helps to overcome the shortcomings of the current eIDAS regulation. The obligation to accept the wallet also degrades the proven value of existing electronic identity schemes and results in unfair competition. + Proposed 24 months` timeframe for implementation is complicated, as there is no solution that meets the requirements of the wallet and wallet-like products have to be developed from the ground up, also there are no technical standards and/or comprehensive technical descriptions that would correspond to the proposal. + Concept of unique and persistent identifier has been left aside and have been replaced with record matching.
- 46. 46 + “The DigitalWallet will become a reliable, all-in-one identity gateway that puts citizens in full control of their own data and gives them the freedom to decide exactly what information to share, with whom, and when. From social, financial, medical, and professional data, to contacts and much more, it will make it possible to store personal credentials within a single digital ID.”* + Although technically feasible, it puts even harder responsibility on the human side for various fraud. + The concept of decentralized data collection is heavily influenced. * eIDAS 2.0 rapporteur Romana Jerković (S&D, HR)
- 47. Mutual Recognition oftrust services of third countries + currently services and service providers in the EU Trust List + country should accept qualified trust services if they are in use in national service provision (Article 14 of eIDAS) BUT © copyright
- 48. Mutual Recognition oftrust services from third countries* https://ec.europa.eu/digital-building- blocks/wikis/display/DIGITAL/2023/02/06/The+EC%27s+actions+on+international+compatibility+of+trust+services?preview=/640549582/661194677/Masterdeck_The%20Commission%27 s%20actions%20on%20international%20compatibility%20of%20trust%20services_Presentation.pdf 48
- 49.
- 50. What will changewith eIDAS 2.0? + Trade agreement or Implementing Act for recognition + Non- EU should meet requirements for qualified TS/TSP + Should follow trusted list MRA Cookbook 50
- 51. Estonian national framework foreID and trust services
- 52. electronic ID the strongestidentity since 2002 © copyright owning an ID card is compulsory three devices: eID, mID, SmartID 70% use ID-card regularly
- 53. eID in Estonia Highlevel government provided identity based on identity nr that is unique (eID, mID). • authentication • electronic signing • i-voting • business, banking • state and healthcare • public transport • loyalty card High level private sector provided identity based on identity nr that is unique (Smart ID). • authentication • electronic signing • business, banking
- 54. Two main legalprinciples in national law • Electronic identification is as good as face-to-face identification and • electronic signature of certain level is equal to handwritten one. NB! Although the framework exists there is no actual use of the concept of professional certificate (e.g electronic seal)!
- 55. The hierarchy ofnorms eIDAS Regulation eIDAS implementing acts National level laws on the implementation of eIDAS regulation National level implementing acts Standards
- 56. Same eIDAS-based legislativeframework, BUT how to prove your intent online?
- 57. What have beenthe challenges?
- 59. Nature of thesecurity risk The private key can be computed from the public key, which means that theoretically: • it was possible to digitally sign a document in the name of another person • it was possible to enter e-services in the name of another person • it was possible to steal a digital identity without having the physical card • decrypt documents encrypted with the ID card
- 61. Lessons learned • eIDis more important than we knew AND we cannot go back on paper • Map cross-dependencies of critical services • Certified does not mean secure • Have alternatives – eID card and mobile-ID, private sector solution • Pool of experts is limited – duplicate, if possible • How to handle a non-incident? • Nobody wants to go back to paper, even if they could • This will not be the last such event
- 62. →In the rapidtechnological change the product standards and audits based on standards might not give the guarantees for a liable product → 2 years for the audit period is too long period, BUT the audits are expensive and there are not many auditors for the specific topics →The notification system is too vague, but the only solution in those cases is tight cooperation →The next crisis can be different, the legal framework in place enabled finding solution, but from learnings we never know what the next crisis will look like
- 63. Identity thefts: suspensionvs declaring invalid • If the person who has stolen/found your card does not know your PIN and/or PUK codes, they can only obtain information that is visually printed on the card (name, personal identification code, validity period of the card), except your photo and signature. • If the person also has your PIN and/or PUK codes, they can use the card to access e-services and give digital signatures if the owner has not suspended the certificates.
- 64. Cases • On September22, a woman contacted a 64-year-old woman living by phone, informing them about the maintenance work at Swedbank and the problems with her woman's Smart-ID. • The woman was then called by a man who introduced himself as a maintenance technician, asked for the applicant's personal identification number and Smart-ID PIN codes to check that the Smart-ID application was working. • After a few moments, the call was made again and the petitioner was asked to authenticate himself in the Internet bank via Smart-ID, under the pretext of completing the maintenance work. • Misled in this way, the applicant initiated authentication in the internet bank and entered the PIN1 and PIN2 codes, during which an unknown person gained access to the woman's bank account and made payments to five people for a total of EUR 12,184.23, of which the bank recovered EUR 609.00. • What could be the solution in your country?
- 65. How this wouldbe solved in your own country?
- 66. Cross-border implications of eIDand trust services
- 67. Barriers based onthe example of NOBID countries • Although authenticating a citizen (i.e. allowing a person to prove they are in control of a particular national identifier) is technically possible, the semantic interoperability between the identities is said to be lacking. • On the EU level, there appears to be a stalemate where the services are not accepting foreign electronic identities because there is no demand and the lack of demand is in turn caused by the lack of services. • There is no concept of shared physical identity between the NOBID countries and therefore the sharing of electronic identity is hindered. • The lack of technical and legal standards around the identity codes appears to be a barrier.
- 68. Barriers based onthe example of NOBID countries • Authentication services are significantly linked to interoperability services. • Lack of cooperation in software and service development was seen to be a cross-border barrier. • The vast majority of citizens currently do not need cross-border services. • Difficulties in determining the level of trust in trust services and alternatives thereof is a barrier to their use between NOBID countries. • The extent of the cross-border demand, challenges or potential use is difficult to estimate since there is a lack of statistics. • Despite international standards being present, technical compatibility in terms of the ASiC-E signature container compatibility between NOBID countries remains a challenge as countries differ in the precise way standards are utilised • Electronic services are dependent on a personal identification codes both in terms of technological solution as well as service design. • All countries, quite naturally, prioritise their national services and compliance over cross-border compliance and services.
- 69. Potential use ofcross-border trust services and alternatives thereof • There is strong preference among Nordic countries (clearly expressed by Finland, Sweden, Norway and Denmark) to focus on authentication in the cross-border dimension and only then on trust services. All people should be able to have strong authentication mean to access e-services. • Cross-border trust between eID schemes would be the most important element as more than 90% of the population have the means available. Many interviewees pointed out that the first step would be for each country to have their national eID notified - this would raise confidence in the ability to issue national eIDs in the reliable way. • A deliberate effort must be made to start trusting identification by other countries.
- 70. Other observations • TheCOVID-19 pandemic was seen as a major driver of eID adoption and trust services in general. • Personal identity tends to be under tight control of national governments while other trust services are commonly procured within an international context (e- delivery, timestamping, web certificates). • Different requirements for assurance level of eIDs create interoperability problems. • Banking is a significant driver of eID use (Bank-initiated schemes in Sweden, Norway, Finland; respective mentions in Latvia and Estonia, Bank-owned or operated TSPs in the Baltics, Iceland and elsewhere).
- 71. Other observations • Cooperationand cross-border use are to a very large extent driven by corporate strategy of a much wider group of organisations than just trust service providers • Large multinationals tend to utilise centrally developed solutions using a corporate trust network rather than adopting the local one (Latvia, Estonia) • Integrators, document management service providers and other parties operate internationally and bring their international cooperation networks into local context (Latvia) • Large Relying Parties often operate internationally and seek to unify solutions at least on a regional basis (Telia, Swedbank, SEB in the Baltics but also in other NOBID countries) • Trust service providers operate internationally and, seeking to minimise cost, will unify solutions creating interoperability in the process (SK ID Solutions in the Baltics, Nets, Signicat and others in the Nordics, Dokobit)
- 72. What are yourmain takeaways?
- 73. Further reading - Studyon NOBID Trust Services: https://www.digdir.no/samhandling/study-nordic- baltic-trust-services/2058 - ROCA vulnerability and lessons learned: https://www.ria.ee/sites/default/files/content-editors/kuberturve/roca- vulnerability-and-eid-lessons-learned.pdf - E-Estonia fact sheet: https://e-estonia.com/facts-and-figures/ 73
- 74.