International Porvoo Group Seminar in Reykjavik, 26–27 May 2005: DEVELOPING ELECTRONIC IDENTITY IS A PAN-EUROPEAN CHALLENGE

Around 80 representatives from 18 European countries, Japan and USA as well as representatives from the European Commission and the United Nations met in Reykjavik, Iceland on 26–27 May 2005 to discuss the situation with regard to interoperable European electronic identity and electronic services and the development projects in participating countries, as well as to exchange information about ongoing projects. This was the 7th seminar of the international Porvoo Group, which was established in conjunction with the EU eEurope 2002 project, and which consists of governmental representatives from European countries. The seminar was organised by the Ministry of Finance of Iceland and the Finnish Population Register Centre. The Minister of Finance, Mr. Geir H. Haarde delivered a welcome speech to the seminar. He outlined the three major electronic identity policy objectives in Iceland: general wide spread usage of PKI (Public Key Infrastructure) certificates, an open and standardised market providing certificates and related services, and full benefits of EU- and international standards, thus aiming for interoperability with administrations of other countries as need arises. The Minister told the seminar that although Iceland is preparing for the issuing of biometric passports, there are not at the present time any plans of electronic national identity cards. On the other hand, his ministry has initiated talks with the local banks about the possibility of combining the PKI needs of the government with a new generation of smart payment cards being introduced later this year. The Icelandic PKI pilot project created a basis for the certificate policy Mr. Jóhann Gunnarsson, Head of Division in the Ministry of Finance presented the Icelandic PKI pilot project. The Government of Iceland prepared a strategy for the Information Society in 1996. A new strategy was made in 2004. The law on electronic signature was enacted in 2001. Besides that there are other laws in place pertaining electronic services, for instance a 2003 amendment to the Public Administration Act, giving electronic signatures an equivalence with the traditional method. The usage of the Internet as well as the amount of the electronic services have increased in Iceland quickly. Around 80% of Icelanders use the Internet and around 82% of individuals submitted tax declarations on-line in 2003. The digital certificate project was started in 2003. The aim was at first to launch the digital certificates at the Directorate of Customs and the Directorate of Fisheries. The pilot project was led by the Ministry of Finance and various institutions and directorates participated in the project. In addition the aims of the pilot project were to expand the customs solution to include: opportunity for other agencies and more stringent rules for identification. Further aims were e.g. to develop a certificate policy and practice, to test interoperation of certificates from various vendors and to introduce the concept to business and public. As a solution there were two types of certificates: public certificate for signing and encrypting e-mail etc. and private certificate for accessing government systems. The first certificate was issued in May 2003. The certificate policy of the Government of Iceland is based on the European standard ETSI TS 102 042, and the Danish OCES certificate policy. It is intended as a specification of requirements for certification service providers in an open market. In a small society like Iceland it is hard to see that there could be room for many PKI’s. Therefore it is hoped that this initiative on behalf of the government will lead to an universal system that could be adapted to the various needs of both the administration, the business community and the public. The standardisation work continues in different forums The seminar presented a progress report on an open source framework and organizational approach for achieving interoperability on both client and server with potentially all electronic ID cards that are currently in circulation. Current work focuses on a demonstrator for authentication with the Belgian, Estonian, Finnish and possibly Italian and Spanish electronic ID cards that should be ready for presentation to the eID community shortly. The Porvoo Group will closely monitor the progress. The seminar also discussed the report on the European Cross-Border Legislative eID Environment written by Mr. Thomas Myhr, a Norwegian member of the Porvoo Group. The report has determined authentication legislation and the need for having EU regulate the European electronic identity. It recommends using the Directive governing electronic signatures as a common legislative solution. It was resolved that the report should be sent for comments to certain EU projects. The report is available on the Internet at http://porvoo7.fjarmalaraduneyti.is/media/Porvoo7/Thomas_Myhr.doc. Biometrics was extensively discussed Biometrics was widely discussed in the seminar. As a legislative and interoperable challenge on a global scale was presented the seafarers’ biometric identity document, which has been developed in cooperation with ILO, the International Labour Organisation of the United Nations. As well as the seminar heard the latest status of biometric standardization issues in ICAO (the International Civil Aviation Organisation) and ISO (the International Standards Organisation) and the EU BioSec project, concentrating on biometric technologies and security aspects, was presented. Also the situation of the development of the Icelandic biometric passports was considered and it was noted that in Iceland the aim is to issue the first biometric passports in October 2005. Germany will start the issuing in November 2005 and Japan in March 2006. In Finland the Ministry of the Interior is in charge of the Biometrics project. The aim is to start the issuance of ePassports in spring 2006. The Finnish Passport Act renewal is in the Parliament at the moment, and the new Passport Information System is being developed as well. During the1st phase in the ePassport chip will be stored facial image, the fingerprints will be introduced during the 2nd phase. The introduction of the biometric ID cards is envisioned in Finland during 2007–2008. Ms. Silvia Kolligs, European Commission, Directorate-General Justice, Freedom and Security, presented the current state of play on biometrics in EU documents. The facial recognition in ePassports becomes mandatory by August 2006. Because of the collision issue generated by multi chips in the same booklet it was decided to anticipate the setting up of the VIS (Visa Information System) Central Database. As far as the electronic identity is concerned the so-called Hague Program has invited the European Council, and the Commission to elaborate minimum security standards for electronic ID cards including biometrics. In that respect the Commission organised a meeting for the EU Member States in April 2005. Following this meeting the Commission will publish a report in July 2005, not only describing the standards, but also the state of electronic ID card play and plans in the Member States. The Porvoo Group will follow the situation and discuss this document in its next seminar. A plenary discussion on the application of biometrics concluded that a number of countries are considering to set up national biometric databases in support of the ePassport. It was also noted that the ePassport and the ICAO recommendations have a major impact on the electronic ID card domain. The development work for electronic identity is progressing in different countries As in the previous seminars, country updates were presented on the current status regarding electronic identity in the participating countries. Representatives from a total of 11 countries presented their country update. The number of electronic ID cards as well as the range of electronic services is increasing steadily in all countries. Besides the European countries, updates were also heard from the USA and Japan. With regard to the progress of standardization in the USA, it was noted that in accordance with the main objectives of the Directive on Homeland Security, signed in August 2004 by the President, 20 to 30 million Personal Identity Verification (PIV) cards will be issued to state administration personnel. Regarding the national ID card in Japan and the e-Japan strategy, the seminar was told that 450,000 Resident Registration cards have already been issued by local administration. This is the primary card for accessing eGovernment services. In addition, there was a presentation of the Asian Smart Card Forum and their vision of one Asia and one “Silk Road” Card. The international Porvoo Group seeks to support the deployment of electronic identity in Europe The Porvoo Group is an international cooperative network whose primary goal is to promote a trans-national, interoperable electronic identity, based on PKI technology and electronic ID cards, in order to help ensure secure public and private sector e-transactions in Europe. As its name suggests, the Porvoo Group was established in Porvoo, Finland, in the spring of 2002 in conjunction with the eEurope 2002 programme. The Group consists of governmental representatives from European countries; representatives from the private sector and from the European Commission have also attended the two-day seminars, which are held every 6 months. The number of participating member countries has steadily increased; at present, about 30 countries have representatives in the Group. The next seminar will probably be held in Belgium in autumn 2005, and the Porvoo 9 seminar is likely to be organised in Slovenia in spring 2006. The 10th seminar will probably again be held in Finland in autumn 2006, during Finland’s EU presidency. For more information, please contact: Supervisor Adviser, Ms. Päivi Pösö, Finnish Population Register Centre/ Certificate Authority Services, tel. + 358 9 2291 6737 or + 358 50 591 7517, e-mail päivi.pösö@vrk.intermin.fi, Head of Division, Mr. Jóhann Gunnarsson, Ministry of Finance of Iceland, tel. +354 545 9200, e-mail johann.gunnarsson@fjr.stjr.is or Mr. Jan van Arkel, co-chairperson of the Porvoo Group and Ambassador CEN/ISSS WS eAuthentication, tel. + 31 70 387 5305, e-mail arkel@cardlife.nl Material from the seminar and a review of the national situation in certain countries and additional information can be found on the Internet: www.vaestorekisterikeskus.fi (Electronic Identity -> Porvoo Group), www.fineid.fi and http://porvoo7.fjarmalaraduneyti.is/ With Best Regards, Information Officer, Ms. Irene Rissanen, Finnish Population Register Centre, tel. +358 50 573 7210, e-mail irene.rissanen@vrk.intermin.fi