Feeds

EU security agency draws 'privacy baseline' for ID cards

Waits for measures

Internet Security Threat Report 2014

Europe urgently needs to develop a strategy for protecting the privacy of data held through national ID card schemes, a European security agency warns.

ENISA (the European Network and Information Security Agency) argues that the "vast disparity between privacy features in electronic ID cards across Europe" is creating a recipe for future trouble. Typical current applications for identity cards include their use for tax declarations and other e-government services, but more ambitious commercial application are in the pipeline.

Meanwhile Europe lacks a coordinated strategy on how to go about protecting personal data held on the cards.

This is both an obstacle to interoperability and a potential problem in making ordinary punters comfortable with using the technology, ENISA warns. Disclosure of data held on ID cards creates a risk of fraud or other forms of misuse but individual countries have been left to their own devices, resulting in a hodge-podge of different approaches.

ENISA is seeking to establish a "privacy baseline" for European ID cards with a new position paper, published on Tuesday, that attempts to provide an overview of the roll-out of electronic ID cards across Europe as the first step in developing a trans-national strategy on the technology.

"Privacy is an area where the member states' approaches differ a lot and European eID will not take off unless we get this right," said Andrea Pirotti, executive director of ENISA. "Europe needs to reflect on eID privacy and its role in the interoperability puzzle. The fundamental human right to privacy must be guaranteed for all European eID card holders. Therefore, ENISA will continue to work in this field in 2009".

Ten national electronic ID card schemes are already in use in various EU countries while 13 more are in development. Privacy-enhancing technologies exist but these have been developed, implemented and tested only at a national level.

The paper goes on to pick apart 11 potential risks to personal privacy resulting from the use of national electronic identity card schemes, as well as comparing eight potential risk mitigation approaches. Risks include a range of potential problems ranging from simply losing a card to skimming, location tracking and cryptographic attacks. Countermeasures include encryption, access control and biometrics.

This analysis (made with reference to the technical specifications of national identity cards and the available privacy-enhancing features they offer), aims to provide a starting point for "identifying best practices and a source of reference for future choices to be made by European policy makers", ENISA explains.

The European Citizen Card, ICAO electronic passport specifications are included but the main focus of the analysis is a comparison of European electronic ID card specifications, focusing on privacy-enhancing features. ENISA defines privacy-enhancing as "any feature of an eID card which increases the control of the card owner over which data are disclosed about them and to whom".

The 24-page paper casts the runes over the roll-out of electronic identity card technology over Europe. It includes numerous tables for easy comparison but doesn't go into much discussion about the relative seriousness of threats or a cost and benefit analysis of countermeasures, an omission that results in a clear and more readable analysis. Best practice is not explicitly advocated but at least the paper provides a comprehensive overview and useful starting point for further debate.

ENISA's ID card paper (PDF) can be found here. The agency, established in 2004, works with EU-institutions, members states and the private firms to develop and promote best practices in cybersecurity. Other recent papers have looked at issues such as cybercrime and information security risks from printing. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Musicians sue UK.gov over 'zero pay' copyright fix
Everyone else in Europe compensates us - why can't you?
Megaupload overlord Kim Dotcom: The US HAS RADICALISED ME!
Now my lawyers have bailed 'cos I'm 'OFFICIALLY' BROKE
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
BT said to have pulled patent-infringing boxes from DSL network
Take your license demand and stick it in your ASSIA
Right to be forgotten should apply to Google.com too: EU
And hey - no need to tell the website you've de-listed. That'll make it easier ...
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Managing SSL certificates with ease
The lack of operational efficiencies and compliance pitfalls associated with poor SSL certificate management, and how the right SSL certificate management tool can help.