The emergence of the internet is a comparatively recent phenomenon.
It has brought with it a wealth of apparent business opportunity, frequently presented in breathless terms which failed to take some key issues into account if the system were really to deliver on this promise. Principal among these issues was the whole area of authentication of individuals and transaction parties. The ironic sub-heading above is an obvious play on Peter Steiner's classic 1993 New Yorker cartoon (featuring a dog looking at a computer and commenting to a canine friend, 'On the internet nobody knows you're a dog.'). This amusing aside reflects the anonymity that may be good for certain types of internet behavior, but clearly has limitations when it comes to the delivery of web-based services.
Clearly in the delivery of e-government services to citizens and businesses it is clear that there is a significant requirement for a number of additional components to be present in order for the interactions to be meaningful, or in some cases even possible. These components can be characterized by the acronym PAIN: privacy, authentication, integrity, non-repudiation. In practice this means that users need a system where the privacy of their data is assured, with similar reassurances on the identity of the transacting parties.
Equally it is vital for users to be sure that data has not been modified in transit and that messages or transactions can't be repudiated. This latter attribute is usually implemented in conjunction with a source of trusted time and is important in that it gives those communicating over open systems a greater level of reassurance regarding the manner in which such communications can be made much harder to repudiate. The provision of this type of audit trail is important in the general move to create a sense of trust in the virtual world which equates with that which normally obtains in the 'real' world.
It is important to consider the components of an e-marketplace, offering either commercial or government services. Every marketplace can be characterized as having a number of such attributes, ranging from presentation through to payments clearance. Identity data may not even need to be presented for some of the simpler interactions. For example, if a user is generally making a query regarding opening hours of a government office, then simply going to that web site may suffice for the delivery of such information. Should the user wish to communicate with that office, then one would hope that a well implemented system would offer the user additional services online rather than simply diverting that user back to more traditional means of communication.
Recently, for example, this writer saw a web site with details of a competition. If a user was interested in entering, he or she was prompted to send a stamped self-addressed envelope for further details, begging the obvious question as to why that very information was not simply posted on the web site. Communication with, say the online Passport Office, may consist of asking a question in which identity is not important, i.e. is it possible to make a passport renewal online. Taking the last step into an actual transaction raises other issues, i.e. now I want to make an online application for a new passport. Such a request clearly requires evidence of identity. In the continuum of interactions with the web site, the user has moved from making general queries through to initiating a specific transaction that will not be available unless the user has some means of producing an identity in order to complete the request. In a sense this identity is equivalent to producing passport-type credentials in the virtual world.
Some issues immediately present themselves, namely, what kind of identity can the user present? Who issues it? How reliable is it, and is there some way of objectively determining its status? Is it regulated in any way?
Thankfully an answer is at hand. Strong authentication is a term which has a particular meaning in the standards world and the wherewithal for the issuance of identities in the virtual world which conform to this standard does exist. The answer lies in the issuance of digital certificates to end-users. A digital certificate is a means of binding identity data to a cryptographic key pair which allow users to not only encrypt data, thus ensuring privacy, but also to ensure authentication of that identity through the use of a digital signature.
Unlike a signatures in the 'real' world, which are essentially the same every time, digital signatures are in fact computed using a user's private cryptographic key and unique features derived from the message being sent. This is a different order of identity and credential management to that which is available through more traditional, and considerably weaker forms of identification such as issuing users with an ID and password.
A conjunction of digital certificates containing identity data and associated digital signatures is a powerful mechanism for addressing the PAIN related issues outlined above. Legislation has been enacted in Europe (on the basis of an eSignatures Directive issued by the European Commission) as well as in other major trading areas such as the U.S. and Japan, to give legal recognition to digital signatures.
The remaining, and indeed non-trivial issue, is how users get digital certificates and who issues them. Increasingly governments and other quasi-governmental bodies are looking to issue certificates to citizens. The loss of confidence in many business entities in recent times has cast governments in a new light as a trusted reference point, in particular with regard to citizen and business to government transactions.
In Italy, for example, any citizen who wishes, can obtain an identity card with a state issued digital certificate on a smartcard, essentially a credit card-like token with an onboard processor that allows users to benefit from strong authentication when engaging in online transactions with governments which require such forms of identity to be presented. Following from the classifications of markets and associated ways of interacting with them, it is clear that in the case of a user wishing to issue an online request for a new passport, that only these types of credential would be acceptable.
The Italian example finds particular relevance in the provision of healthcare services to citizens, initially in the Province of Lombardia. Citizen identity material, in the form of a digital certificate on a smartcard, is now actively being used for the authentication of patients interacting with GPs and pharmacists. This confers immediate benefits in something as simple as the status of the repeat order on a prescription, thus eliminating another, albeit very important, piece of paper from an already busy life.
Another example comes from the interaction between businesses, small and large, and central government. One of the main interactions between government and businesses is through taxation. In Ireland the Revenue Commissioners (Taxation Authorities) have long since maintained a tracking system for identifying those individuals who are entitled to act as agents on behalf of either individuals or organizations when it comes to filing tax returns. In the drive towards an increasingly paperless and joined-up electronic world this system provided a perfect starting point for issuing digital credentials for the purposes of facilitating online filings and remittances.
The Revenue Commissioners have completed the loop in the 'information-communication-transaction' loop and can provide complete case-handling for any given transaction. This system works both ways, where clients can file returns, or equally receive notification of entitlements based on overpayments, etc. This system leveraged an existing identity management infrastructure, and applied best practice in terms of security, authentication and digital signing technology in order to provide subjects and relying parties (either side of a contract) with the necessary reassurance and comfort factors to feel safe going online.
A critical component to the success of these projects is that while identity is something we take as a given, in either a personal or professional capacity, it is something which has to be captured and treated differently in the electronic world. Credentials and identity, and tokens relating to these, be they smartcards or files on hard disks, are simply means of logically representing who somebody is combined with associated roles, privileges and entitlements. Critical to the development and uptake of all such systems is an appropriate legal framework which exists through the implementation of a variety of legal instruments addressing issues such as distance selling, electronic signatures, copyright and data protection. Adding all of these components together clearly provides a mechanism for mitigating the risk issue associated with the perceived anonymity issue through use of the internet.
Jack Nagle is an e-government expert with Baltimore (www.baltimore.com).
