Feeds

EU security agency draws 'privacy baseline' for ID cards

Waits for measures

Top three mobile application threats

Europe urgently needs to develop a strategy for protecting the privacy of data held through national ID card schemes, a European security agency warns.

ENISA (the European Network and Information Security Agency) argues that the "vast disparity between privacy features in electronic ID cards across Europe" is creating a recipe for future trouble. Typical current applications for identity cards include their use for tax declarations and other e-government services, but more ambitious commercial application are in the pipeline.

Meanwhile Europe lacks a coordinated strategy on how to go about protecting personal data held on the cards.

This is both an obstacle to interoperability and a potential problem in making ordinary punters comfortable with using the technology, ENISA warns. Disclosure of data held on ID cards creates a risk of fraud or other forms of misuse but individual countries have been left to their own devices, resulting in a hodge-podge of different approaches.

ENISA is seeking to establish a "privacy baseline" for European ID cards with a new position paper, published on Tuesday, that attempts to provide an overview of the roll-out of electronic ID cards across Europe as the first step in developing a trans-national strategy on the technology.

"Privacy is an area where the member states' approaches differ a lot and European eID will not take off unless we get this right," said Andrea Pirotti, executive director of ENISA. "Europe needs to reflect on eID privacy and its role in the interoperability puzzle. The fundamental human right to privacy must be guaranteed for all European eID card holders. Therefore, ENISA will continue to work in this field in 2009".

Ten national electronic ID card schemes are already in use in various EU countries while 13 more are in development. Privacy-enhancing technologies exist but these have been developed, implemented and tested only at a national level.

The paper goes on to pick apart 11 potential risks to personal privacy resulting from the use of national electronic identity card schemes, as well as comparing eight potential risk mitigation approaches. Risks include a range of potential problems ranging from simply losing a card to skimming, location tracking and cryptographic attacks. Countermeasures include encryption, access control and biometrics.

This analysis (made with reference to the technical specifications of national identity cards and the available privacy-enhancing features they offer), aims to provide a starting point for "identifying best practices and a source of reference for future choices to be made by European policy makers", ENISA explains.

The European Citizen Card, ICAO electronic passport specifications are included but the main focus of the analysis is a comparison of European electronic ID card specifications, focusing on privacy-enhancing features. ENISA defines privacy-enhancing as "any feature of an eID card which increases the control of the card owner over which data are disclosed about them and to whom".

The 24-page paper casts the runes over the roll-out of electronic identity card technology over Europe. It includes numerous tables for easy comparison but doesn't go into much discussion about the relative seriousness of threats or a cost and benefit analysis of countermeasures, an omission that results in a clear and more readable analysis. Best practice is not explicitly advocated but at least the paper provides a comprehensive overview and useful starting point for further debate.

ENISA's ID card paper (PDF) can be found here. The agency, established in 2004, works with EU-institutions, members states and the private firms to develop and promote best practices in cybersecurity. Other recent papers have looked at issues such as cybercrime and information security risks from printing. ®

3 Big data security analytics techniques

More from The Register

next story
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Judge halts spread of zombie Nortel patents to Texas in Google trial
Epic Rockstar patent war to be waged in California
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.