Feeds

EU security agency draws 'privacy baseline' for ID cards

Waits for measures

5 things you didn’t know about cloud backup

Europe urgently needs to develop a strategy for protecting the privacy of data held through national ID card schemes, a European security agency warns.

ENISA (the European Network and Information Security Agency) argues that the "vast disparity between privacy features in electronic ID cards across Europe" is creating a recipe for future trouble. Typical current applications for identity cards include their use for tax declarations and other e-government services, but more ambitious commercial application are in the pipeline.

Meanwhile Europe lacks a coordinated strategy on how to go about protecting personal data held on the cards.

This is both an obstacle to interoperability and a potential problem in making ordinary punters comfortable with using the technology, ENISA warns. Disclosure of data held on ID cards creates a risk of fraud or other forms of misuse but individual countries have been left to their own devices, resulting in a hodge-podge of different approaches.

ENISA is seeking to establish a "privacy baseline" for European ID cards with a new position paper, published on Tuesday, that attempts to provide an overview of the roll-out of electronic ID cards across Europe as the first step in developing a trans-national strategy on the technology.

"Privacy is an area where the member states' approaches differ a lot and European eID will not take off unless we get this right," said Andrea Pirotti, executive director of ENISA. "Europe needs to reflect on eID privacy and its role in the interoperability puzzle. The fundamental human right to privacy must be guaranteed for all European eID card holders. Therefore, ENISA will continue to work in this field in 2009".

Ten national electronic ID card schemes are already in use in various EU countries while 13 more are in development. Privacy-enhancing technologies exist but these have been developed, implemented and tested only at a national level.

The paper goes on to pick apart 11 potential risks to personal privacy resulting from the use of national electronic identity card schemes, as well as comparing eight potential risk mitigation approaches. Risks include a range of potential problems ranging from simply losing a card to skimming, location tracking and cryptographic attacks. Countermeasures include encryption, access control and biometrics.

This analysis (made with reference to the technical specifications of national identity cards and the available privacy-enhancing features they offer), aims to provide a starting point for "identifying best practices and a source of reference for future choices to be made by European policy makers", ENISA explains.

The European Citizen Card, ICAO electronic passport specifications are included but the main focus of the analysis is a comparison of European electronic ID card specifications, focusing on privacy-enhancing features. ENISA defines privacy-enhancing as "any feature of an eID card which increases the control of the card owner over which data are disclosed about them and to whom".

The 24-page paper casts the runes over the roll-out of electronic identity card technology over Europe. It includes numerous tables for easy comparison but doesn't go into much discussion about the relative seriousness of threats or a cost and benefit analysis of countermeasures, an omission that results in a clear and more readable analysis. Best practice is not explicitly advocated but at least the paper provides a comprehensive overview and useful starting point for further debate.

ENISA's ID card paper (PDF) can be found here. The agency, established in 2004, works with EU-institutions, members states and the private firms to develop and promote best practices in cybersecurity. Other recent papers have looked at issues such as cybercrime and information security risks from printing. ®

The essential guide to IT transformation

More from The Register

next story
GCHQ protesters stick it to British spooks ... by drinking urine
Activists told NOT to snap pics of staff at the concrete doughnut
Britain's housing crisis: What are we going to do about it?
Rent control: Better than bombs at destroying housing
What do you mean, I have to POST a PHYSICAL CHEQUE to get my gun licence?
Stop bitching about firearms fees - we need computerisation
Top beak: UK privacy law may be reconsidered because of social media
Rise of Twitter etc creates 'enormous challenges'
Redmond resists order to hand over overseas email
Court wanted peek as related to US investigation
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
We need less U.S. in our WWW – Euro digital chief Steelie Neelie
EC moves to shift status quo at Internet Governance Forum
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.