Om e-Valg

Den 9. juni afholdt Teknologirådet en Workshop om mulige scenarier for e-valg som en del af den opgave, man var blevet stillet af Videnskabsministeriet om at undersøge muligheder for at indføre e-valg i Danmark. Projektbeskrivelsens titel er 'e-Valg – en udfordring for demokratiet?'

Baggrunden for projektet er tidl. Videnskabsminister Helge Sanders begejstring over at overvære det Estiske valg i marts 2007, hvor borgerne for første gang kunne deltage i fjernafstemninger ved anvendelse af den fælles offentlige/private digitale signatur (læs: smart card).

(Se Europæiske eksempler)

Ved dette valg stemte 5.4% af vælgerne på denne måde, men også andre lande har forsøgt sig med forskellige former for e-valg: Holland gjorde forsøg med stemmemaskiner, og i 2006 var stemmedeltagelsen ved hjælp af disse apparater oppe på 90%, men siden har det vist sig, at maskinerne (NEDAP) kunne hackes, og man er gået væk herfra foreløbig;

Irland brændte parallelt hermed mere end 51 mio € af på at etablere stemmeaskiner, som så blev droppet, medens det i Norge ser ud til at gå bedre: 11 kommuner vil være med til e-afstemning i 2011, og i Schweiz fik vælgerne i 11 kantoner muligheden for at e-stemme – og andelen var høj – mellem 21 og 68% af de afgivne stemmer var elektronisk afgivet.

Herhjemme har vi set forsøg på lokalt plan: Menighedsrådsvalget i 2008, forsøg med e-afstemninger i Frederiksberg Kommune og et prøvevalg for unge i 31 kommuner i 2009 i forbindelse med kommunalvalget, der også blev understøttet af e-valg.

Hvorfor e-valg?

Begrundelserne for at tilbyde e-valg må være at få en højere vælgerdeltagelse, men sekundært måske også at sænke omkostningerne ved afholdelse af valg. En højere valgdeltagelse kan være svært at eftervise i de eksempler, vi indtil nu har, men omvendt betyder en e-valgsmulighed, at der bliver færre undskyldninger for IKKE at stemme, især hvis tilbuddet ligner den Estiske model.

Ser man snævert på selve afstemningsproceduren vil besparelsespotentialet ligge i mindre personaleforbrug, herunder mindre diæter til folkevalgte kontrollanter, og mindre behov for omtællinger og administration. Dette potentiale må så opvejes af, om man ønsker at tilbyde løsninger, der indbærer særlige investeringer, sikre afstemningsmaskiner, særlige valgkort, procedurer omkring distribution af stemmesedler (elektronisk) og opbevaring af kvitteringer for afgivne stemmer.

Scenarier

Arbejdsudvalget for e-Valg under Teknologirådet fremlagde 3 scenarier, som workshoppen derefter behandlede ud fra 2 kriterier: Opfyldte de kravene til et sikkert og påpliudeligt e-valg, og hvilke trusler skulle scenarierne i givet fald være forberedte på.

Medens scenarie 1 gik på anvendelsen af stand-alone stemmebokse med et (forhåbentligt) brugervenligt interface, gik scenarie 2 på ideen om en valgbus, der (formodentligt som et supplement til 1) opsamlede beboere på plejehjem, hospitaler, fjerne arbejdspladser, og hvor tilforordnede kunne hjælpe med afstemningen. Scenarie 3 gik på en helt on-line løsning – enten ren internet baseret eller ved hjælp af smartphones, og opridsede perspektiver i retning af gruppepres, familiepres på hvordan den individuelle stemme skulle afgives.

Den teknologiske synsvinkel

Set ud fra en ren teknologisk synsvinkel er scenarie 1 og 2 utænkeligt i praksis; Stand alone stemmemaskiner skal initieres, distribueres, opdateres, opstilles, serviceres – og frem for alt vedligeholdes. Omkostningerne ved at tilvejebringe sådan en løsning (der i øvrigt ligner den, der blev kasseret i Holland og Irland) er eksorbitante, og i løbet af ganske få år vil maskinen sikkert minde om de stemmemaskiner, der blev brugt i Florida ved forrige amerikanske præsidentvalg, hvis nogen kan huske dem.

Det er sympatisk med en valgbus, der kører rundt til plejehjem og folk, der har besvær med at transportere sig, måske også til folk, der har problemer med at affinde sig med at stemme via en skærm og som har behov for hjælp, men ideen herom kræver en on line løsning – folk på hospitaler hører til på forskellige afstemningssteder, de kender måske ikke kandidatlisten, stemmesedlen skal distribueres ud til bussen, og afstemningen skal foregå kontrolleret og anonymt.

Det sidste scenarie er det eneste, der set fra en teknologisk, herunder også security/privacy mæssig synsvinkel har en chance for en gang på jorden. Men kun under nogle ganske bestemte forudsætninger:

I dag kan en ægtefælle 'låne' den andens NEM-ID eller digitale signatur – det er praktisk til bankopgaver – men er i sådanne tilfælde brugernes eget ansvar. Afpresning/gruppepres kan undgås, såfremt borgeren ikke får en kvittering på HVAD han har stemt, men kun AT han har stemt.

Men scenariet kan forbedres!

Idealløsningen

Man kan IKKE forestille sig, at man begynder med e-valg via en valgboks, der så gradvist forpupper sig til en tynd klient og til sidst anvender NEM-ID. Omkostningerne ved at gå via en stemmeboks er for store, og NEM-ID'en kræver stærkere autenticering hvis den foregår fra et valglokale.

Man kan heller ikke forestille sig en løsning, der med et slag lukker alle valgsteder; det vil være en tilvænningssituation for borgerne, og der vil i mange år være en rest-gruppe, der skal nurses særligt.

Den eneste løsning er derfor at tænke på et fælles Borgerservicekort: Et smart card, bygget op som det tyske kort, der kan anvendes i mange sammenhænge, hvor borgeren selv bestemmer, hvor meget man vil afsløre af sin identitet, udstyret med biometri, så man kan gennemføre 'stærk' autenticering, f.eks. ved stemmeafgivelse, men først og fremmest et kort, man er fortrolig med, som man anvender i et væld af sammenhænge – som kørekort, som sygesikringskort, som EU-legitimationskort, som pas, som valgkort. Så kan man udstyre valgstederne med standard PC'ere/tynde klienter, der er udstyret med kortlæsere til chips og bio, og som i øvrigt er koblet til fuldstændigt samme system (en privat Cloud!), der anvendes af de, der hellere vil stemme hjemmefra. Men hvis vi ikke råber vagt i gevær ender det med, at Danmark og Kroatien i 2018 er de eneste lande i EU UDEN smart cards!

Perspektiver

Teknologirådet vil i efteråret gennemføre endnu en workshop, denne gang med fokus på hvordan e-valg vil påvirke den demokratiske proces – og det bliver spændende: Det vigtige er nemlig stadig væk at gøre deltagelsen i debatten, interessen for at øge kendskabet til de politiske emner til noget, der er muligt for alle at deltage i. Det participative demokrati er en forudsætning for at nå det, som Helge Sander så i perspektivet fra Estland: At styrke demokratiet kræver mere end at afgive sin stemme og være tryg ved at den ikke er manipuleret eller bliver manipuleret. Og så er det måske spørgsmålet, om vores repræsentative demokrati på ALLE områder behøver at være '2. hånds' – om ikke der er områder, hvor den nye teknologi muliggør et mere direkte demokrati?

Men det tager vi fat på i november!

BIOMETRICS - The Danish Perspective

To day I had the pleasure to participate in the network for Biometrics in Denmark. The network was originally established by Frederik Kortbæk, DeLoitte and others, and todays' meeting had 3 major elements, at status report from the Danish National Police on the biometric passports, a presentation on identity management by Omada, and a user report from the leading architect of the Capital Region, the organisation responsible for hospitals for 1.6 mio inhabitants in the Greater Copenhagen Area.

The representative from the Danish Police was Mrs. Lene Gisselø, a lawyer, presented the status of the bio passport. The passport is based on the EU Directive 2252/2004.

The directive is of course based on the increased focus on terrorism, and demanded the member countries to implement a 2-step strategy, first passports with photos of the card holders, which has always been the case in Denmark, and 2. step due in june 2008 to implement biometric fingerprints as part of the passport. (See the Technology Board report on Biometric Passports - where it is pointed out that also illegal immigration is supposed to be less after the bio passes are introduced. )Denmark is lagging behind the original target date, and in spite of a tender issued 2 years ago and supposed to be closed months ago, is still not signed. The tender called for multiple types of equipment to be used by the municipalities, by the foreign office's representations around the World and by the department for immigrants in Denmark. It was stated that one of the reasons for the delay is the lack of funding, as the preferred vendor was well above the allocated budget.

What wasn't mentioned was that in the meantime 20 municipalities out of the 99 already have established a local workplace to issue not only passports, but also driver's licenses, motor vehicle licenses etc. If the budget discussion drags out much longer, the wisest thing to do will probably be to drop the tender and open a new one based on the experiences with the municipalities.

Lene Gisselø presented all the security features around the Danish passport and pointed out, that even if the holders' picture and fingerprints were stored centrally during a 3-5 week period until the passport was duly delivered to the holder, there would be no centrally stored register on biometrics of the data – 'even if it would have benefitted the police'. The locally captured data is encrypted, the BAC method used to store the photo, and EAC to protect the fingerprint data. Also Lene G. discussed the enormous task of cross-certifying all passports within the European Community.

From the audience a question was raised why the Police didn't choose the 'Match on Card' method for authentication in stead of 'Match off card'. The issue here is that when the border police checks the passport, the passport officer takes a photo of the visitor, takes a digital print of the fingerprint and then let the SW on his workstation extract the data from the passport, convert to some sort of algorithm (which may vary between the countries), and then makes the comparison based on his local algorithm. This means that the data from the passport has to be extracted and at least for some time resides in another computer. The alternative method would be to have a chip residing in the passport with the capacity to perform the comparison without having to extract any data from the passport. Lene G's answer to this question was that is was what met the EU defined standard specifications. This of course raised the question if other countries in Europe were legally prevented from storing biometric data from Danish passports, and the answer to this is, that probably there is no legislation in place to prevent this. For instance UK and Netherlands have active plans to compare the extracted data with the criminal records. The representative from the Data Protection Agency, Janni Christoffersen, pointed out that although the Privacy Officers' forum, the WP29, was looking at these issues, no common agreement has been reached yet. See this excellent book on other outstanding issues regarding use of biometrics, commented buy the WP29.

The question after the presentation remains that one might wonder what will happen to the tender and the selected solution now 12 months after deadline while the World is changing and technology progressing.

The second presentation on Identity Management from OMADA corporation was an OK run down of the issues of ID management, but it clearly showed the lack of standard solutions in a Microsoft world based on Sharepoint, where Omada clearly filled a gap in providing multiple roles access management admin solutions, deploying even Kerberos in a federated security environment, but compared to the solutions offered by for instance the Tivoli portfolio and a Websphere environment, the presentation was not that ground breaking.

The 3^rd item of the day was presented by Claus Thorsen, who is the lead enterprise architect from the IT department of the Capital Region. (Region Hovedstaden). This is a merger of 3 former counties, the Island of Bornholm and the city of Copenhagen. They are responsible for the health care and the 12 public hospitals int he region, producing more than 800.000 in take patients pr. year.

Claus' topic was based on the defined need for a single sign on solution for use in the hospitals; One hospital department (Gentofte) claimed, that due to the security regulations, logging on/off, changing workstations, registration of patient data at centrally placed terminals etc. required one additional medical doctor.

Against this, the National Health Domain committee has come to the conclusion, that only 1.2 minute pr. day is waisted because of long log-in procedures.

Claus took us through all the tedious steps required to register patient data, and where he hoped that 'some day' a biometric solution would help. One example is the use of the so-called Medical Card, introduced to increase patient security, so that the doctor checks that the right patient is getting the prescribed medicine. In order to access this application, the doctor is required to use his digital signature issued by the hospital. When he has signed and logged in, he has to make an additional log in using the digital signature to access the Medical Card application. But what happens if the doctor is ill and a substitute has to do the checking? You can't have fast track issuance of official digital signatures, and the result is that the doctor's from time to time borrow each other's digital signature. And this is only one example.

The most promising solution at this stage is to use virtual desktops, so that the desktop of each doctor remains 'active' in a sort of private cloud, so that it is much faster to check in at another terminal later. The Virtual Desktop Infrastructure is one possibility, but the enormous variation in clients and PC-equipment makes is complicated and difficult to implement this at a large scale.

So the biometric solution to assist in an almost-automatic sign on, could be helpful. But so far the conclusion is that you cannot just have one biometric solution: In the operations theatre you need to wear a mask, hence you can't use face recognition. If you wear glasses, Iris recognition is a problem, and if you want to avoid congestion, fingerprint readers (and even keyboards) are doubtful. As Claus put it: The problem is, that we are users, we are many , and we are poor!

The long range solution is probably a combination of RFID active tags and biometrics, but it remains to be seen if this can be implemented in a practical way. Yet the Region intends to start a number of pilot projects, because the problem is real – the workload around log in/log out is simply too heavy – either it takes too long time, or the doctors and nurses are cheating to ensure quality of patient treatment.

To this statement Janne Christoffersen from the Data Security Agency pointed out, that the privacy legislation 'definitely has no intention to be a problem for daily operations, as it only required, that the doctors and nurses only has access to the data, that are necessary!'

'This is exactly the issue,' Claus Thorsen declared, 'For who knows what data are necessary? Take use of Antabuse! If this is an information that is not revealed to the Doctor, the patient might be seriously mistreated!' This seems to be a very central point in designing an up-to-date privacy legislation, that ensures a more holistic treatment of patients.

The next question, equally central for the discussion, is whether Claus' Region are coordination or cooperating with the other regions, and why this is not a centrally managed development program.

The representative from the Health Domain Steering Group - (Digital Health is an organisation supposed to coordinate anything within the health domain) – claimed that they weren't funded to do this, which again lead us back to the fundamental question on whether the Regions should continue inventing hot water all of them or if the Government should step in and define real areas for centralized solutions.

But a very interesting and down-to-earth real-life presentation with lots of areas where a combination of new technology and use of biometrics might be helpful.

Following this presentation, Ulrich Østergaard from CardLab presented the biometric card that they were trying to introduce in a number of countries. As can be seen from their homesite, this seems to be very promising – the card contains an active RFIOD chip, it has a fingerprint reader, which can be used by the proper owner to turn the card on, and can be equipped with various passwords, digital signatures etc. Looking forward to see some pilot projects based on this idea – and of course combined with proper ID/access management systems on the network.

Security& privacy in biometrics – how do we ensure proportionality ?

A basic principle in the current European Data Protection Act is to ensure proportionality between the level and amount of personal identifiable data, that you have to reveal to identify yourself has to be proportional to the risk and danger incurred if the identity is faked or stolen.

The recent years have seen a growth in tools for identification, mainly in the biometric area, that has led to the risk of 'overreacting' using easy biometrics where lesser level of authentication could have been used. One of the latest strange cases from Denmark is a night club, that has been allowed by the data protection agency to take customers fingerprints at the entrance as a means to secure against violent behavior. Horror examples of major collection of biometric data is of course U K's collection of DNA profiles for children, a practice that was started 5 or 6 years ago.

The risks involved are related to the kind of threat you are trying to prevent: Do we need the security tool to reveal the identity and all related information? This may be the case if we have a strong suspicion that a person is directly related in crime or an act of terror. Or do we only need to know if a person is 18 years old so it is legal to sell alcohol to him/her? Similarly, within the health area a nurse and a doctor do not need to have full access to a patients medical record if he has lost his consciousness and need a blood transfusion, only the key information of blood type and current medication.

So the use of biometrics in itself is one dimension of the game - and the other dimension is what the biometric identification gives access to reveal of PII – Personally Identifiable Information - at the same time or as a consequence of using the biometrics.

The first question of proportionality is then solely related to the 'strength' of the biometric method used. A weak solution is a quick, convenient solution which is non-intrusive, non-incriminating and non-discriminating in regard to civil rights and color of skin, sex, race and religion. For this purpose simple biometrics like a signature (Analog or digitized) may be better than a fingerprint ( traditional, optical electronic scanning using a template to generate a simple bit stream) - because fingerprints may be seen as incriminating, offensive, police-like. while a face recognition reveals race, color of skin and maybe sex, and thus does not meet the other criteria.

Signatures may be faked, fingerprints (simple fingerprints) can be stolen – in bizarre cases it has been seen that criminals have cut off fingers of owners of Mercedes 300S cars to break the fingerprint starting mechanism. (This risk is probably less in Northern Europe, though.) Or it may be difficult to read the results properly.

When stronger proof is needed, it is acceptable to rely on methods with higher reliability – like the thermal scanning of fingerprints, that measures the distance from the underlying blood, revealing riffs and valleys, again to be transformed by fast fourier transformation to a template consisting of 0's and 1's. This prevents the use of faked fingerprints copied on a strip of tape – and even the rough case of cutting off Mercedes' owner's finger –( presumably the blood has stopped circulating – so no heat difference). Also Iris recognition has been suggested, whereas 3D face recognition at this point still has a higher rate of errors. It has been suggested to use at least 2 types of biometry, like the US border control where you combine fingerprints with face recognition.
In any case the reliability of the identification methodology applied in every case has to discussed and explained before any solution is deployed. (See article about reliability)

It may be OK under well-defined circumstances to use higher level of trusted biometrics, even if they are not 100% proof. The second dimension of the question than is what other PII is stored with the template or the face geometry is stored and how these data are protected. This is a question of data stewardship and again should be in proportion to the use of the data. Taking the example from the Danish night club that has been granted permission to store peoples' fingerprints, these should definitely not be store with any other information than the purpose: Is this guy know to have a tendency to quarrel – NOT his name, address etc. Even if this is kept using cryptography, it is not in proportion to the use of the biometric data.

Other types of biometrics are recognition of moving patterns, voice recognition, pattern of the veins, retina scan – and of course DNA. Whereas the failure rate (both positive and negative) of the first 2 of these types are still relatively high, the 3 other may reveal unwarranted additional details of the health situation of the individual, hence these items should only be used for forensic purposes and not just collected arbitrarily or even – as in the UK DNA case – systematically.

An important aspect of using Biometrics is also how it will be possible to revoke or change the biometrics as the person changes. Whereas fingerprints remain stable for a longer period in life, face geometry changes a lot from childhood to old age, so does walking patterns, voice. And people do have cosmetic operations in their faces, accidents may change the looks and behavior so any system based on biometrics should have a way to allow for changes of this kind and it should be possible to revoke biometrics.

But as the technology improves and computing power is increasing, one solution which could use biometrics and at the same time prevent the data from occurring in the open space or being communicated could be to have an ID card with a number of different domains, each holding the relevant information linked to the person: one domain simply stating the age, another for the bank including bank account numbers, one for driving license use, one for medical/health care use, one for insurance use, one for credit cards, one for public identification purposes.
If this identity card can be activated by a fingerprint reader plus a pin code, the citizen could then select exactly how much PII he wants to reveal in the situation. This is in line with the PrimeLife recommendations from IBM Zürich Lab, that has just got the German award for forward think identity management solution. This type of solution has the advantage that the user is in full control and that no central database is required for the biometric data.

In a few days I will discuss the use of video surveillance, what we know about it as a crime prevention tool and what may be a more intelligent way of using it.

Privacy igen-igen

(Den kinesiske mur - kan mure beskytte mod angreb på Privacy?)





















I sidste uge afholdt IT- og telestyrelsen i samarbejde med DI ITEK, den franske og den tyske ambassade og forbrugerrådet en konference under overskriften 'The Net will not forget' om Privacy. Tilstrømningen var ganske pæn, større end den vi så ved maj måneds arrangement 'Pyt med Privatlivet', som Teknologisk Institut arrangerede, og hvor jeg havde fornøjelsen at være indlægsholder. 'The Net will Not Forget' gav ikke anledning til megen presseomtale, og interesseniveauet er som sådan nok ikke blevet højere end da Teknologirådet i 2006 lavede en rapport om 'ICT and Privacy in Europe' som en del af det europæiske EPTA-samarbejde.

Når interessen for privacy og beskyttelse af private data ikke er større i Danmark, hænger det formodentlig sammen med at vi i visse sammenhænge scorer højest som værende 'Verdens mest lykkelige befolkning'. I denne sammenhæng kan man spørge sig selv, om det også berettiger til at være tossegode.

Noget kunne tyde på det – for ikke nok med at vi har en solid tillid til vores offentlige myndigheder, vi kaster os også rask væk ud i offentliggørelse af personlige detaljer på Facebook, som mere end 2 mio af os er på, og der høres ingen protester i befolkningen, når politikerne på Københavns Rådhus og i Folketinget går ind for udvidet videoovervågning på Nørrebro, selvom ikke mindre end 44 internationale, seriøse studier ikke har været i stand til at påvise, at videoovervågning har anden præventiv effekt end en marginal reduktion af cykeltyverier og indbrud i biler.

Gus Hosein, en af de internationale talere på 'The Net will not Forget', fremviste en række eksempler på nye og raffinerede overvågningsteknikker, som dog nok vil kunne få selv sløve danskere til at reagere: Fra at være et tilbud til besøgende i Disneyland, kan man nu som forældre få udstyret sine børn med et 'no break' GPS-armbånd, så man kan sidde hjemme og se, hvor ens barn befinder sig, få en alarm når foruddefinerede grænser overskrides og kunne sikre sig, at barnet har en panikknap at trykke på, 'just in case'. Hvem sagde 'Curlinggeneration'?

Gus Hosein har tidligere gjort sig bemærket ved at fremhæve, at USA, UK, Kina og Sovjet er Verdens førende når det kommer til overvågning og kontrol af egne og andre landes borgere – og vel at mærke i den rækkefølge.

Men jeg vil påstå, at hvis ikke man forstår hvilken udvikling, der er i gang, og bliver bedre til både at styre og udnytte teknologien, så vil Danmark meget snart kunne være på linie med de 4 overvågningssamfund – og ikke nødvendigvis fordi en bevidst politisk linie fører denne vej, men fordi vi ganske simpelt ukritisk accepterer tilsyneladende fornuftige metoder til at passe på vores børn, vores biler, beskytte lokalsamfund mod kriminalitet, forhindre terrorhandlingerne på den ene side og skattesnyd på den anden – samtidigt med at vi jo 'ikke har noget at skjule', så alle billeder fra forskellige festlige sammenkomster og uheldige situationer lægges på nettet, fordi det er 'sjovt' – og fordi ingen rigtigt kan overskue konsekvensen.

Vi har – så vidt vi ved – her i landet kun oplevet få tilfælde af egentligt identitetstyveri, selvom forekomsten af forfalskede og stjålne danske pas hos illegale indvandrere efterhånden må være betragteligt.

Sidste gang man undersøgte de europæiske nationers holdninger til Privacy og Data Security, var Danmark i den laveste tredjedel og altså ikke særligt motiverede til at gøre noget ved det. Så derfor finder mange mennesker det helt naturligt, når private virksomheder beder om at få CPR-nummeret for at oprette een i deres kunderegister – ja nogle virksomheder giver endda prmæier og rabatter for at få det. Det er vi tilsyneladende ligeglade med, på trods af at sofistikerede Customer Relations Management systemer er i stand til at crawle nettet, finde sociale netværker som Facebook, Linkedin, Plaxo, Twitter, YouTube – og sammenligne den enkelte kundes profiler, netværker, ja sågar mønstre i søgning på nettet, så tilbud kan skræddersys og de derved i princippet gennemføre prisdifferentieringer og målrettede kampagner.

Der er ikke megen debat længere om registersamkøringer, og i stedet arbejder man nu målbevidst mod at etablere een indgang til alle offentlige borgerdata (Se borger.dk) – hvorved borgerens arbejde (= selvbetjening) lettes, men hvor fjernelsen af tidligere barrierer altså også nu gør det muligt at få et samlet overblik over alle borgerens forhold. Er det en trussel? Det beror på hvordan den enkelte oplever det. Og hvor godt det offentlige beskytter personlige data mod utilsigtede afsløringer – for ikke at tale om videresalg af data til private virksomheder.

De helt åbenlyse trusler kommer fra et antal kilder:

1. Botnets

   Vi kan ikke forvente at alle er lige gode til at beskytte deres PC'ere mod virus og hacker angreb. Det betyder, at vi må regne med at et antal PC'ere er inficerede med trojanske heste, der kan fjernstyres og benyttes til cyber-angreb. Som Estland oplevede forrige år, Georgien og Kazakstan sidste år – massive angreb, der lammede landenes kommunikation over internettet med borgere og banker i op til en uge.

2. Hackere/Fishing

   bliver mere sofistikerede – næste trin er forsøg på at lænse bankkonti ved at franarre folk pinkoder og bankkoder. Det har vi set et kraftigt stigende antal eksempler på, og det bliver ikke bedre før den nye digitale signatur er rullet ud – nu med et års forsinkelse.

4. Regnekraft/lagerkapacitet

   Teknologien udvikler sig hastigt – beregningskapacitet og lagringskapacitet firdobles nu nærmest hvert andet år. Og det betyder at oversættelse fra et sprog til et andet, lagring af f.eks. Telefonsamtaler og skypesamtaler kan blive det næste mål for hackere, og en oversættelse til arabisk, russisk, amerikansk kan finde sted 'on the fly'.
   
   

5. WI FI – forbrugeradfærd

   Samtidigt er det påfaldende så mange private WI FI anlæg, der står pivåbne og hvor også ganske almindelig trafik kan aflyttes og kopieres. Ja, vi ER lalleglade. CPR-numre flyder på nettet. Og en logningsaftale med teleselskaberne, der undtager små kollektiver er jo en klar hjælp til potentielle lovovertrædere og dermed er resten af logningsbekendtgørelsen en pestilens for flere og til ringe nytte.
   

Dilemmaet er altså klart: Vi skal beskytte os mod terrorisme og acceptere at 'nogen' med fornuftige retsmidler kan foretage overvågning, vi skal beskytte os mod at blive franarret og bestjålet, men det er ikke en statsopgave at beskytte os og certificere vores private PC'ere, men derimod nok at undervise os i HVORDAN vi kan beskytte os. Da truslerne ændrer sig, er et regulært kompetencecenter nødvendigt, som kan rådgive borgerne på den ene side og politikere og erhvervsliv på den anden. Det er ikke 'bare' en opgave for efterretningsvæsener.

I Sundhedssektoren er privacy mere end andre steder beskyttet af lovgivning, der kræver samtykke fra patienten for videregivelse af oplysninger. Her er faktisk flere dilemmaer: For det første skal vi redde patientens liv, og derudover har vi brug for patientdata til at bedrive forskning, og har derfor brug for pseudonym-tilgang til data på en kontrolleret måde.

Vi har brug for en meget finkornet styring af adgang til patientdata – men samtidigt behov for en høj effektivitet på hospitalerne - og vi har endelig brug for at have en klar lovgivning, der følger den teknologiske udvikling: Vi må forhindre at individers DNA-profil udleveres til private forsikrings- selskaber. Hvor man bør overveje lovgivning for at forhindre, at svage patienter bliver tvungent til 'frivilligt' at aflevere sådanne data.

Igen støder vi på parakdokset at lovgivningen uvægerligt altid vil halte efter den teknologiske udvikling. Lovgiver har ikke en chance for at forudse, hvad videnskaben kan frembringe næste år: Hjernescanninger som grundlag for en analyse af børns udviklingspotentiale? Gen-analyser til at forudse, hvem der bør gifte sig med hvem? Vi har allerede set tilsyneladende raske, unge kvinder der får operet bryster bort, fordi DNA-profilen siger, at sandsynligheden for at udvikle kræft er over 80% i den familie. Så næste dilemma er hvordan man beskytter borgerne mod forsikringsselskaber, arbejdsgivere – og måske sig selv!

Så vi kan konstatere, at vi har behov for følgende:

• Klare retningslinier for etablering af offentlige såvel som private IT-systemer, der indeholder kortlægning af risiko for utilsigtede afsløringer af data, en analyse af hvad konsekvensen i så fald kan være, samt tiltag – både tekniske og organisatoriske, der på en balanceret måde reducerer risikoen for 'udslip'
  

• En strategi og en klar plan for information til borgerne om hvordan de selv kan beskytte sig, hvor de kan få hjælp og rådgivning og – måske – oprettelse af testcentre, hvor de kan få adgang til at kontrollere deres udstyr
  

• Tilskyndelse af udvikling af simple metoder til kryptering og til udvikling af granuleret databeskyttelse, som for eksempel påvist i PrimeLife, hvor ideen er, at den enkelte afslører præcis så stor en delmængde af vedkommendes identitiet som står i forhold til den transaktion, han/hun ønsker at udføre: Er man borger i Birkerød? er man myndig? Har man kørekort? Har man en patientjournal? Har man en bankkonto? Eller har man brug for at afsløre sion fulde (borger)identitet over for det offentlige – men derimod ikke ens indkøbsvaner og trafikmønstre?
  

• En debat om hvordan lovgivning indrettes på en mere hensigtsmæssig måde end ved detailstyring – kort sagt, en grad af Anglisering af lovgivningen, der tillader udvikling af ny teknologi og en højere grad af fokus på formål og hensigten med lovgivningen.

I næste Blogindlæg vil jeg se på biometri og de hermed forbundne sikkerhedsfordele og risici.

Digital Signature - A Danish Perspective

,

Friday I had the pleasure to participate in one the first public presentations on the new Danish Digital Signature that will replace the current ‘soft’ certificate, that began it’s existence in 2003 and currently has been issued 10 1.2 mio Danes. The conference was organized by Dansk IT, the Danish IT user association, and was managed and coordinated by Palle Sorensen from the IT and Tele authority, Ministry of Science and Technology.

The official presentation of the new certificate was made by the head of department in the Ministry, Marie Munk. (Marie Munk’s presentation in Danish). The main benefits of the new certificate is that it is organized dy an organization Dan_ID that is an affiliate of the Payment Services organization owned by the Danish Banks. Dan-ID took over the CA from TDC, the Telecompany that won the first round of tender back in 2003. This means that we will now have a certificate that is recognized not only by the Public authorities in Denmark, but also by the banks. And as we already today have more than 3 mio net-bank users, the coverage of the new digital signature is bound to increase.

The financial sector was represented by the CIO of Danske Bank, who took a day off from the financial crisis and made an excellent presentation on the banks’ expectations. (Danske Bank presentation )

The detailed presentation on the benefits and the roll out plan was made by Johnny Bennedsen, manager of Dan-ID (presentation not yet available) and a very experienced person in the field of managing payments cards and identities from his long career in PBS, the Payment Service organization.

Dansk IT had invited also a speaker from the Frauenhofer institution, Frauenhofer: Alexander Nouak on biometrics – Security versus convenience, to speak about biometrics and pitfalls. A very interesting presentation and a clear demonstration that you can not ‘just’ rely on neither fingerprints, iris scans nor 3D facial recognition – because all of these can be faked.

Following this first we had an interesting presentation by Christian Lang, IT- and Tele authority on the topic of establishing secure trading using the digital signature, also mentioning the EU PEPPOL project, and then a presentation by Jens Baunbæk on real estate trade and financing networks.

Finally I was asked to give a presentation on status in Europe and future trends in e-Identity - From Digital Signature to e-Identity - and it may have been a bit provoking for the organizers and the speakers that the reality does not really put Denmark in any leading position when we are talking about digital identities. In fact, as you can learn from a number of articles and current status papers on e-ID in Europe, we have taken a bit of a different course than the rest of Europe as we haven’t even begun discussing how the digital certificate can be married with a trusted digital identity card with Biometrics. In fact, a part from Denmark, only Greece and Lichtenstein does not seem to have any plans at all for ID-cards in spite of the fact that we all have to have new passports with biometrics in just a year from now if we want to go to US. See for instance European eIdentifty Conference Haag June 2008 and a recent overview by Porvoo Group: January 2008 – Status and overview of eID.

My presentation showed some of the most interesting countries like the Austrian, Estonian and Belgian smart card schemes and discussed the new German plans for ID card (German plans for e-ID revealed June 2008 ). Even UK (As long as Gordon Brown is in charge) will have a national ID card.

Other aspects of the future is of course related to business use of e-Identities, which is still lagging behind in most countries and particularly the European Interoperability Framework and the stated need for a common identity scheme to promote cross-national transactions (See Launch of the STORK project June 2008 ), particularly when dealing with public authorities in other EU countries. (See IDABC e-IDM in Europe – February 2008 ).

It is a journey, we are on the route. But it seems that Denmark is trying to stay on the bicycle path and not on the main road. This may create problems for us if we are not starting to plan for upgrading our new digital signature..