E-ID concepts were neither a matter of course nor did they fall from the sky. They are the result of years of discussion, research, piloting and thinking. Knowing these helps when deciding on the BGEID. The concept of the E-ID had many forebears – especially projects that threatened to fail and pulled themselves out of the swamp through conceptual advances in thinking. A pattern emerged: problems were addressed in an interdisciplinary way, engineers played key roles in the solution development, the solution was achieved through strategic simplification, they were developed at least partly iteratively and the projects had fortune in a double sense: they started from a problematic thinking approach and were set up in a favourable context, which then actually made substantial progress in the thinking concepts possible. A presentation of all the projects would require a research-historical study of its own and would go far beyond a Societybyte blog post. Therefore, two projects are presented here as examples.

FASME – Facilitating Administrative Services for Mobile Europeans

Electronic identities, or E-IDs for short, are used for authentication, i.e. for trustworthy proof of one’s own identity. A good 20 years ago, it was recognised in various contexts, more or less at the same time, that it is important to enable authentication independent of applications. It was understood that it is important, especially in e-government, to separate authorisation control for access to online services from identity verification. This separation makes it possible for each and every one of us to use an E-ID to access a wide variety of services for which we have access rights. We no longer have to get a separate EID for each service. The usefulness of separating authentication and authorisation – with universally applicable E-IDs and service-specific authorisation controls – was one of the results of the FASME research project (2000 – 2001), which focused on move services for mobile Europeans. The project was originally intended to enable the transport of digital official documents on smartcards (specifically Javacards), but it quickly became apparent that something quite different was needed, namely digital document services that could be commissioned by means of a smartcard to either load documents into a personal virtual document repository or send them directly to another office. This (from today’s perspective) quasi-e-ID on the smartcards was accordingly equipped with signature options, or an actual digital signature (like the mobile phone signature in real-world e-government in Austria later on) with additional functions. It could also be used to send documents from one’s own virtual document repository to the office to which one had to deliver the documents in the context of a move.

Administration receives trustworthy documents

Since FASME was about moves between countries, it was also necessary to develop a semantic architecture concept for the transfer of information that corresponded to the logic of distributed systems as well as to the logic of document transfer practice in everyday administration. The solution was simple: no consistent data states, n-to-1 translations of documents to an intermediate standard (instead of n-to translations) and explicit context definitions when generating documents. The administration in the destination country of a move thus does not receive “correct” data, but trustworthy documents, and interprets them according to its local rules. Here, too, an analogous principle can be seen as with service access: universal practices of proving properties and, separately, local rules for dealing with them at the recipient. The step to the conceptual development of property certificates that refer to an E-ID was only a small one after that. The original architecture of the SuisseID ecosystem, which was later forgotten, also provided for such certificates ten years later. Even in FASME, there were many instructive aberrations in the course of the project, which seem bizarre in retrospect, but initially seemed completely natural in the project. Some scientists involved in the project even never understood the explosive nature of the results achieved, while the seven city administrations in the project very much did. For example, some inferred from the proof of the non-feasibility of globally synchronised citizen data that the project had failed, although on the contrary it had shown a much better and more citizen-friendly alternative. Some also failed to understand that the lack of residence certificates in the UK is not a problem at all when administrative organisation, technology and law are brought together with the universal architecture conceived in the project. One lesson learned was particularly surprising in the light of the misunderstandings: Those who understand “distributed systems” understand the administration – and vice versa. But almost no one wants to understand either.” Time has confirmed and perhaps even reinforced this double disinterest. The institutional economic relevance of technology is still grasped by only a few.

STORK – Secure Identity Across Borders Linked

In the EU Commission, e-IDs were originally thought to be an issue that had already been solved – around 2003 or 2004 – only to develop the concept of a single identity space step by step from 2006 onwards. With brains AND fortune, the instrument of Large Scale Pilots was conceived, and one such pilot was tendered for cross-border secure identity proofs. This led to the STORK project, in which our current understanding of a federated system of national E-IDs emerged (building on the technical concept of federated identities). The development of the STORK trust architecture is above all a great simplification and reduction achievement. From the beginning, the project was tendered in such a way that it was not about a European E-ID. The project itself did not attempt to unify the very different e-ID ecosystems (which would have been obvious), but limited itself to the development of an interoperability architecture for cross-border authentication. However, following the basic concept of a large-scale pilot, this was not understood in purely technical terms, but also included all other aspects for practical implementation in the pilot (except for explicit regulation). This included, for example, age verification to keep adults out of chats for young people.

Bilateral treaty with EU off the table in 2014

Switzerland participated in the follow-up project STORK 2.0 and even took on two key roles there. It coordinated the banking pilot and led the service pricing work package. In this way, some Swiss representatives were able to become part of the very small network of international experts and gain access to a large reservoir of knowledge on the topic of e-ID. The topic of e-ID was therefore also a key theme during the visit to Switzerland by Prof. Dr. Roberto Viola (DG Connect) in the context of the EU Commission’s Going Local Intiative (2013). At that time, there was the political option of securing recognition of the EU member states for a state-recognised Swiss E-ID (at that time the SuisseID) through a bilateral treaty. For obvious reasons, this was no longer an issue as of February 2014.

STORK projects without technical standards

The two STORK projects (with the extension of the first project there were even three) and other large scale pilots led to the eIDAS regulation, which includes other trust services besides authentication. Its basic concept is the mutual recognition of government e-IDs. It does not include technical standards and was adopted without knowledge of them. Its special quality is that it formulates obligations to accept foreign e-IDs only in relation to e-government and thus deliberately does not overload the cart. Furthermore, it is a special quality of the technical-organisational infrastructure, which results from the implementation standards, that it can be used universally. It can also be used for non-official e-IDs, for example also Swiss e-IDs, provided that Switzerland for its part sets up a corresponding infrastructure and various EU member states decide to accept Swiss e-IDs as a means of authentication for access to their eGovernment services. To facilitate the development of the infrastructure, standard modules for so-called eIDAS nodes have been developed and made available to all. In addition, the development of the infrastructure was and is being promoted by the CEF programme, including private-sector use. The EU is also staying on top of the topic in terms of content and, for example, held a public consultation on eIDAS regulation last autumn. Because everyone knows that the topic will not be finished and eaten for a long time.

Outlook

It is up to each and everyone to draw their own lessons from this short history of the international development of today’s e-ID concepts, for example for the upcoming vote on the BGEID. In the course of the development of the e-ID concepts, many things that originally seemed logical had to be revised. Numerous studies have led to further unexpected, but in retrospect seemingly self-evident findings, for example that trust needs utility as a motivation, but is happy to forego security for it. This shows one thing above all: it comes down to knowledge, and this knowledge can only be gained through practical trial and error, observation and reconsideration of preconceived ideas.