EU security watchdog draws privacy baseline for national ID cards

Europe needs to develop a strategy for protecting the privacy of data held through national ID card schemes, a European security agency warns. ENISA (the European Network and Information Security Agency) argues that the “vast disparity between privacy features in electronic ID cards across Europe” is creating a recipe for future trouble. Typical current applications for identity cards include their use for tax declarations and other e-government services, but more ambitious commercial application are in the pipeline.

John Leyden writes that, meanwhile, Europe lacks a coordinated strategy on how to go about protecting personal data held on the cards. This is both an obstacle to interoperability and a potential problem in making ordinary punters comfortable with using the technology, ENISA warns. Disclosure of data held on ID cards creates a risk of fraud or other forms of misuse but individual countries have been left to their own devices, resulting in a hodge-podge of different approaches.

ENISA is seeking to establish a “privacy baseline” for European ID cards with a new position paper, published on Tuesday, which attempts to provide an overview of the roll-out of electronic ID cards across Europe as the first step in developing a trans-national strategy on the technology. “Privacy is an area where the member states’ approaches differ a lot and European eID will not take off unless we get this right,” said Andrea Pirotti, executive director of ENISA. “Europe needs to reflect on eID privacy and its role in the interoperability puzzle. The fundamental human right to privacy must be guaranteed for all European eID card holders. Therefore, ENISA will continue to work in this field in 2009.”

Ten national electronic ID card schemes are already in use in various EU countries while thirteen more are in development. Privacy-enhancing technologies exist but these have been developed, implemented and tested only at a national level. The paper goes on to pick apart eleven potential risks to personal privacy resulting from the use of national electronic identity card schemes, as well as comparing eight potential risk mitigation approaches. Risks include a range of potential problems ranging from simply losing a card to skimming, location tracking and cryptographic attacks. Countermeasures include encryption, access control and biometrics.

This analysis (made with reference to the technical specifications of national identity cards and the available privacy-enhancing features they offer), aims to provide a starting point for “identifying best practices and a source of reference for future choices to be made by European policy makers”, ENISA explains.

The European Citizen Card, ICAO electronic passport specifications are included but the main focus of the analysis is a comparison of European electronic ID card specifications, focusing on privacy-enhancing features. ENISA defines privacy-enhancing as “any feature of an eID card which increases the control of the card owner over which data are disclosed about them and to whom.”

The 24-page paper casts the runes over the roll-out of electronic identity card technology over Europe. It includes numerous tables for easy comparison but does not go into much discussion about the relative seriousness of threats or a cost and benefit analysis of countermeasures, an omission that results in a clear and more readable analysis. Best practice is not explicitly advocated but at least the paper provides a comprehensive overview and useful starting point for further debate.

ENISA’s ID card paper (PDF) can be found here. The agency, established in 2004, works with EU-institutions, members states and the private firms to develop and promote best practices in cybersecurity. Other recent papers have looked at issues such as cybercrime and information security risks from printing.