EID Interoperability actions in the context of the eGovernment Action Plan

1. 1 eID Interoperability actions in the context of the eGovernment Action Plan Karel De Vriendt European Commission Enterprise and Industry Directorate General Porvoo meeting Porvoo, 2 November 2006

2. 2 Outline eID in the eGovernment policy context IDABC contributions Current work on eID roadmap Conclusions

3. 3 eGovernment context National ands regional action plans and strategies Online availability is increasing 50% of citizens and business accessed government websites in 2004; eGovernment is real: e.g. benefits in time and cost savings New policy defined: Manchester Ministerial Declaration (24 Nov 2005) eGovernment Action Plan (25 April 2006)

4. 4 Manchester Ministerial Declaration 24 Nov 2005 No citizen left behind � inclusion by design By 2010 all citizens become major beneficiaries By 2010 innovative ICT, trust, awareness, skills for inclusion ICT for efficient and effective government By 2010 high user satisfaction By 2010 adm. burden reduction, efficiency, transparency, accountability Delivering high impact services By 2010 100% e-procurement available, 50% take-up By 2010 deliver other high impact services for growth and jobs Trusted access by means of eIDM across the EU By 2010 interoperable eIDM for public services across the EU By 2010 electronic document recognition framework

5. 5 i2010 eGovernment Action Plan adopted on 25 April 2006 Roadmap developments with eGovernment subgroup and with industry defining the way forward (work in progress): eIDM / eDocs Public eProcurement Efficiency Measurement Inclusive eGovernment Follow-up : Ministerial Conference 2007 under Portuguese Presidency

6. 6 i2010 eGovernment Action Plan :eIDM actions The Commission, together with Member States, the private sector and civil society, will take the following action: 2006 : Agree with Member States on a roadmap setting measurable objectives and milestones on the way to a European eIDM framework by 2010 based on interoperability and mutual recognition of national eIDM. 2007 : Agree common specifications for interoperable eIDM in the EU. 2008 : Monitor large scale pilots of interoperable eIDMs in cross-border services and implementing commonly agreed specifications. 2009 : eSignatures in eGovernment: Undertake review of take-up in public services. 2010 : Review the uptake by the Member States of the European eIDM framework for interoperable eIDMs.

7. 7 eID in eGovernment : background research and good practise activities Research : eEpoch (eEurope Smart Card Charter proof of concept and holistic solution � 5th FP GUIDE (Government User Identity for Europe � http://www.guide-project.org) eMayor (Electronic and Secure Municipal Administration for European Citizens - http://www.emayor.org) FIDIS (http://www.fidis.net) PRIME (Privacy and Identity Management for Europe - http://www.prime-project.eu.org/) : on-going OBJECTIVESof eEpoch The aim of eEpoch is to demonstrate interoperable and secure smart card based digital identification systems, which provide the levels of trust and confidence necessary for citizens to interact digitally with their national and municipal administrations and other European institutions. It will enable cross-border electronic signature for legal purposes, offer reliable identification based on data in government databases, and ensure secure authentication of cardholder and device on the basis of PIN, biometrics, and PKI mutual authentication. eEpoch objectives combine to provides a holistic approach from the following perspectives: User experience, Pragmatic, Coherent pan-European e-government PRIME Information technologies are becoming pervasive and powerful to the point that privacy of citizens is now at risk. In the Information Society, individuals want to keep their autonomy and retain control over personal information, irrespective of their activities. The widening gap on this issue between laws and practices on the networks undermines trust and threatens critical domains like mobility, health care and the exercise of democracy. PRIME addresses this issue via an integrative approach of the legal, social, economic and technical areas of concern to build synergies about the research, development and evaluation of solutions on privacy-enhancing identity management (IDM) that focus on end-users. The work plan supports this integration over the project lifetime through multiple iterations of increasing ambition. PRIME elaborates a framework to integrate all technical and non-technical aspects of privacy-enhancing IDM. During and after the project, the framework will act as a lingua franca between all actors and reinforce their roles and responsibilities for full effectiveness. PRIME advances the state of the art far beyond the objectives of existing initiatives to address foundational technologies (human-computer interface, ontologies, authorization, cryptology), assurance and trust, and architectures. It validates its results with prototypes and experiments with end-users, taking into account legacy applications and interoperability with existing and emerging IDM standards. PRIME creates awareness and timely disseminates its results, in particular through computer-based education. PRIME involves leading experts from application and service providers, data protection authorities, academic and industrial research, and invites all major stakeholders to join its Reference Group. PRIME participation prepares the transfer of its results to industry and standardisation to strongly support European privacy regulations and reinforce European leadership. Project Acronym: PRIME Project Reference: 507591 Start Date: 2004-03-01 Duration: 48 months Project Cost: 13.14 million euro Contract Type: Integrated Project End Date: 2008-02-29 Project Status: Execution Project Funding: 10.05 million euro OBJECTIVESof eEpoch The aim of eEpoch is to demonstrate interoperable and secure smart card based digital identification systems, which provide the levels of trust and confidence necessary for citizens to interact digitally with their national and municipal administrations and other European institutions. It will enable cross-border electronic signature for legal purposes, offer reliable identification based on data in government databases, and ensure secure authentication of cardholder and device on the basis of PIN, biometrics, and PKI mutual authentication. eEpoch objectives combine to provides a holistic approach from the following perspectives: User experience, Pragmatic, Coherent pan-European e-government PRIME Information technologies are becoming pervasive and powerful to the point that privacy of citizens is now at risk. In the Information Society, individuals want to keep their autonomy and retain control over personal information, irrespective of their activities. The widening gap on this issue between laws and practices on the networks undermines trust and threatens critical domains like mobility, health care and the exercise of democracy. PRIME addresses this issue via an integrative approach of the legal, social, economic and technical areas of concern to build synergies about the research, development and evaluation of solutions on privacy-enhancing identity management (IDM) that focus on end-users. The work plan supports this integration over the project lifetime through multiple iterations of increasing ambition. PRIME elaborates a framework to integrate all technical and non-technical aspects of privacy-enhancing IDM. During and after the project, the framework will act as a lingua franca between all actors and reinforce their roles and responsibilities for full effectiveness.

8. 8 Good practice framework :www.egov-goodpractice.org

9. 9 IDABC Programme http://ec.europa.eu/idabc/

10. 10

11. 11 Relevant measures from IDABC Preliminary study on mutual recognition of eSignatures eID interoperability for PEGS Operational Bridge/Gateway Certification Authority

12. 12 Preliminary study on mutual recognition of eSignatures Work carried out under guidance and support of eSignature Expert Group WP1 : Information Gathering This activity shall be focused on the following specific tasks : identification of eGovernment applications or services (whether national, regional or local, such as e.g. eProcurement) in the Member States, involving the use of electronic signatures; determination per country, and per identified eGovernment application, the legal basis (legal requirement) on the usage of electronic signature for that application or service; determination per country, and per identified eGovernment application, the technical implementation of the usage of the eSignature in the eGov process e.g. : how is the eSig implemented in the application?; have some interoperability issues been addressed in the implementation of the eSig; identification of technical means (if any) to enhance/achieve cross-border interoperability of eGovernment applications making use of electronic signatures (e.g. promotion of technical standard)

13. 13 Preliminary study on mutual recognition of eSignatures (2) WP2 : Analysis and assessment On the basis of the results of the WP1, the contractor will : identify and analyse the similarities and differences in the use of electronic signatures in eGovernment applications in each MS both in the legal context, and on the technical implementation aspects; assess the impact of the identified similarities and differences on the interoperability of eSignatures and hence of the eGovernment applications WP3 : Proposal for mutual information mechanism on electronic signatures legal requirements On the basis of the results WP1 and WP2, and taking into account the inputs and comments of the IDABC eSignature Expert Group, the contractor will : prepare conclusions and recommendations on interoperability issues propose, as a minimum, a mutual information mechanism on electronic signature requirements. The proposal will elaborate in detail the legal and technical requirement which is necessary for a mutual recognition of eSignatures within the MS

14. 14 eSIG-Current status WP1 : Information Gathering Questionnaire for national correspondents has been prepared by contractor with review of expert group General introduction on status of eSignature Regulatory framework on eSignature and eGovernment, e.g. : on credential issuing process; on legal qualifications of eSignatures; on rules regarding long-term validity of eSignatures eGovernment applications, e.g. : Does the system rely on a simple/advanced/qualified/other (please explain) signature? What are the hardware requirements on the client side (e.g. smartcard reader/USB tokens) for the use of eSignature? What measures, if any, have been taken to ensure interoperability with signatures created and/or certificates issued in other countries? General assessment, e.g. : Main legal, technical and practical enablers and barriers to the use of secure electronic signatures in eGovernment Annexes : application questionnaire Preparation of country profiles based on results of questionnaire Expected results : December 2006

15. 15 eID Interoperability for PEGS : technical functionalities and approach An expert group will be called upon for this work. Based on existing actions at the EU level (e.g. Modinis Study on ID Management in eGovernment (DG INFSO), IST projects GUIDE, FIDIS nad PRIME (DG INFSO), work by the Porvoo Group, etc�), a strategy for eID Interoperability needs to be elaborated and shall include as a minimum : a survey and comparison of the national eID (electronic identification schemes whether national ID card or other means) legal instruments for the 25 MS + 4 CC; a survey and description of the national technical solutions implemented in each of the 25 + 4 Countries for the national eID. The survey shall also list and describe which are the important technical components of the eID which should be taken into a account (smart card, digital certificate, biometric means, etc�) a market assessment of the ID Management technical solutions; in particular a high-level description of the concept of federated identities and its applicability for interoperability of eID�s shall be produced; a proposal for an effective eID interoperability solution to be used by the PEGS Common specifications for interoperable eID solutions shall be drafted based on the results of the elaborated strategy for eID interoperability Current status : co-ordination with work of DG INFSO to link to Roadmap

16. 16 Bridge/Gateway Certification Authority: results from Pilot (2005)

17. 17 Proposed new IDABC action : Operational Bridge/Gateway Certification Authority Objectives : to establish the legal, operational and technical frameworks for an operational Bridge/Gateway CA Overview of actions : establishment of a recognised European BGCA together with the upgrade of communication applications and tools with relevant and automated BGCA-specific features and standards. Therefore, in line with the proposed approach, a number of concrete parallel actions at the level of IDABC have been derived from the BGCA Pilot recommendations: 1. Launch an operational pilot BGCA (with limited scope), serving a limited number of projects (PCIs and/or other projects) 2. Set-up of an expert group on legal matters, to be composed of Commission services (INFSO, SJ, ENTR), Article 9 committee members (to be confirmed), MS legal specialists a. to address legal points raised during the BGCA Pilot project (also addressing the question raised by Austria related to compliance with the European Directive on electronic signatures 199/93/EC); b. to study and assess the possible forms of a European BGCA Governing Body; 3. Communication, encouragement and lobbying by the Commission, the PEGSCO and the MS administrations on the results of the BGCA Pilot project results, specifically on the use of the ETSI standard and the requirements for applications to integrate it

18. 18 Definiton of eID roadmap Process : leadership of DG INFSO with support of Modinis programme and external contractors eID ad-Hoc group : member states inputs and feedback (last meeting held on 4 October 2006 in Brussels) Industry experts feedback (through Modinis workshops)

19. 19 eID Roadmap under discussion During the preparations for the Signpost Paper, a provisional schedule for an eID/eDoc Roadmap was created that identified a number of fundamental building blocks. However, at its conception it was already signalled that the schedule was not necessarily complete, and that the building blocks were not always equally well understood, even among eGovernment stakeholders. Therefore, there was a clear need for this schedule to be elaborated into a full Roadmap. The main purpose of the present paper describing a draft eIDM Roadmap is twofold: First of all, the identification, description and assessment of the necessary building blocks to the realisation of the eIDM Roadmap. As noted above, the exact scope of the building blocks identified in the basic diagram above is not generally well understood, nor are the listed elements considered to be exhaustive. This paper is a first attempt at remedying these shortcomings. Secondly, an assessment of the feasibility of the current planning, keeping into account all the status of all required building blocks, the need to identify any responsible parties for their realisation, and the risk of escalation when a block is not realised in a timely manner. During the preparations for the Signpost Paper, a provisional schedule for an eID/eDoc Roadmap was created that identified a number of fundamental building blocks. However, at its conception it was already signalled that the schedule was not necessarily complete, and that the building blocks were not always equally well understood, even among eGovernment stakeholders. Therefore, there was a clear need for this schedule to be elaborated into a full Roadmap. The main purpose of the present paper describing a draft eIDM Roadmap is twofold: First of all, the identification, description and assessment of the necessary building blocks to the realisation of the eIDM Roadmap. As noted above, the exact scope of the building blocks identified in the basic diagram above is not generally well understood, nor are the listed elements considered to be exhaustive. This paper is a first attempt at remedying these shortcomings. Secondly, an assessment of the feasibility of the current planning, keeping into account all the status of all required building blocks, the need to identify any responsible parties for their realisation, and the risk of escalation when a block is not realised in a timely manner.

20. 20 Action Timeline under discussion

21. 21 Cross-system eIDM solution models under discussion General sketch of solution models for linking IDM systems (not exclusively eGov, or European scale, just in general) => to provide the background Note: this is not a black/white distinction; it represents a gradual shift of focus Also: these descriptions relate only to the logical structure of the authentication mechanisms between partners. Choices such as public/private task divisions remain free (perhaps expand on the island metaphor; seems useful: how do you offer a service on an island? Centralised: by moving all services onto one island; partially decentralised: by moving x services (arbitrary choice) onto one island; federated: by building exhange routes between islands) General sketch of solution models for linking IDM systems (not exclusively eGov, or European scale, just in general) => to provide the background Note: this is not a black/white distinction; it represents a gradual shift of focus Also: these descriptions relate only to the logical structure of the authentication mechanisms between partners. Choices such as public/private task divisions remain free (perhaps expand on the island metaphor; seems useful: how do you offer a service on an island? Centralised: by moving all services onto one island; partially decentralised: by moving x services (arbitrary choice) onto one island; federated: by building exhange routes between islands)

22. 22 Future work Finalisation of eID roadmap Preparation of �common specifications� for eID interoperability Preparation of large scale pilots under the CIP programme : call for proposal to be launched early 2007 Implementation and follow-up of the eID roadmap

23. 23 Conclusions eID interoperability is key enabler in eGovernment i2010 eGovernment actions plan sets ambitious objectives by 2010 EC (under leadership of DG INFSO with support of IDABC) is working with MS and industry towards eID roadmap Call for proposal for large-scale pilots under the CIP programme in 2007

24. 24 THANK YOU ! Web: http://www.europa.eu.int/idabc E-mail: idabc@cec.eu.int Address: IDABC Secretariat DG Enterprise & Industry IDABC � BREY 11/248 European Commission B-1049 Brussels, Belgium