Cross-border e-Government Identification Issues

PKI-TC: The following is a view of mine, 
but I think that the question is of general interest as e-Governments represent 
a very large class of PKI-users.  It fits the "PKI hurdles 
department".

 

 

 

Dear e-Government architects,

 

The following highlights a rather controversial 
issue that definitely do not represent current e-government 
agendas.

 

However, some decisions taken today can in 
fact have a major impact on tomorrow.

 

Many e-governments have signed-up external 
ID-providers like banks to cater for things like digital certificates for 
citizens.  As banks' natural "habitat" is money, they have in most cases 
"converted" these ID-services into something which is is conceptually very 
similar to payment systems.  In Sweden to take an example, citizen 
certificates are free, and distributed from the on-line banks directly to the 
end-users' PCs.  The "receivers" (the e-government authorities) on the 
other hand, pay something like 0.25 EURO for each status-check.  This level 
is "inspired" by the cost of an ordinary postal stamp.  I believe this 
cost may thwart some more frequent e-government services, but that's another 
story.

 

The future problem I see with this is, that without a de-facto 
monopoly like VISA, it will be hard to process and accept signed messages 
crossing the borders of these usually only regional, national, 
or commercial "trust-networks".  Some of these trust networks even 
make it impossible to verify signatures, as only "valid" (paying) 
receivers are allowed to get the CA-root.  Only in Sweden, there are four 
competing trust-networks, each requiring a contract with the receiver 
as well as having their own transaction fees and proprietary technical 
solutions. 

 

Unless one see a value in creating 
an ID monopoly, I think that e-governments should rather pay ID-providers for 
issuing certificates using a fixed or subscriber-based "cost-model", to not 
de-facto create new payment networks, financed by tax-money.  A 
further advantage of that is that private enterprises could then without 
hesitation use the same infrastructure.  Due to the fact that no 
matter what you do, e-government ID-systems will be tax-financed, there 
is little reason for imposing usability limitations at this early 
stage.

 

Long-term, I see a possibility that citizens 
may actually directly pay something like 10-20 EURO yearly for owning 
a universal electronic identity, but that requires numerous of useful e-gov and 
other services, as well as a standardized mobile "container" to carry IDs 
in.   Such a switch may take another 5 years to become technically and 
commercially feasible.

 

Just my 2 顤es...

 

regards

Anders Rundgren

Independent consultant, PKI and secure 
e-business

+46 70 - 627 74 37