Feeds

EU security agency draws 'privacy baseline' for ID cards

Waits for measures

Build a business case: developing custom apps

Europe urgently needs to develop a strategy for protecting the privacy of data held through national ID card schemes, a European security agency warns.

ENISA (the European Network and Information Security Agency) argues that the "vast disparity between privacy features in electronic ID cards across Europe" is creating a recipe for future trouble. Typical current applications for identity cards include their use for tax declarations and other e-government services, but more ambitious commercial application are in the pipeline.

Meanwhile Europe lacks a coordinated strategy on how to go about protecting personal data held on the cards.

This is both an obstacle to interoperability and a potential problem in making ordinary punters comfortable with using the technology, ENISA warns. Disclosure of data held on ID cards creates a risk of fraud or other forms of misuse but individual countries have been left to their own devices, resulting in a hodge-podge of different approaches.

ENISA is seeking to establish a "privacy baseline" for European ID cards with a new position paper, published on Tuesday, that attempts to provide an overview of the roll-out of electronic ID cards across Europe as the first step in developing a trans-national strategy on the technology.

"Privacy is an area where the member states' approaches differ a lot and European eID will not take off unless we get this right," said Andrea Pirotti, executive director of ENISA. "Europe needs to reflect on eID privacy and its role in the interoperability puzzle. The fundamental human right to privacy must be guaranteed for all European eID card holders. Therefore, ENISA will continue to work in this field in 2009".

Ten national electronic ID card schemes are already in use in various EU countries while 13 more are in development. Privacy-enhancing technologies exist but these have been developed, implemented and tested only at a national level.

The paper goes on to pick apart 11 potential risks to personal privacy resulting from the use of national electronic identity card schemes, as well as comparing eight potential risk mitigation approaches. Risks include a range of potential problems ranging from simply losing a card to skimming, location tracking and cryptographic attacks. Countermeasures include encryption, access control and biometrics.

This analysis (made with reference to the technical specifications of national identity cards and the available privacy-enhancing features they offer), aims to provide a starting point for "identifying best practices and a source of reference for future choices to be made by European policy makers", ENISA explains.

The European Citizen Card, ICAO electronic passport specifications are included but the main focus of the analysis is a comparison of European electronic ID card specifications, focusing on privacy-enhancing features. ENISA defines privacy-enhancing as "any feature of an eID card which increases the control of the card owner over which data are disclosed about them and to whom".

The 24-page paper casts the runes over the roll-out of electronic identity card technology over Europe. It includes numerous tables for easy comparison but doesn't go into much discussion about the relative seriousness of threats or a cost and benefit analysis of countermeasures, an omission that results in a clear and more readable analysis. Best practice is not explicitly advocated but at least the paper provides a comprehensive overview and useful starting point for further debate.

ENISA's ID card paper (PDF) can be found here. The agency, established in 2004, works with EU-institutions, members states and the private firms to develop and promote best practices in cybersecurity. Other recent papers have looked at issues such as cybercrime and information security risks from printing. ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Hello, police, El Reg here. Are we a bunch of terrorists now?
Do Brits risk arrest for watching beheading video nasty? We asked the fuzz
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
UK government accused of hiding TRUTH about Universal Credit fiasco
'Reset rating keeps secrets on one-dole-to-rule-them-all plan', say MPs
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Yes, but what are your plans if a DRAGON attacks?
Local UK gov outs most ridiculous FoI requests...
Felony charges? Harsh! Alleged Anon hackers plead guilty to misdemeanours
US judge questions harsh sentence sought by prosecutors
This'll end well: US govt says car-to-car jibber-jabber will SAVE lives
Department of Transportation starts cogs turning for another wireless comms standard
Munich considers dumping Linux for ... GULP ... Windows!
Give a penguinista a hug, the Outlook's not good for open source's poster child
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?