Rethinking Identity Management: Perspectives from Government and Industry
International Perspectives on Identity Management panel
Secure Management of E-identity Ruth Annus
Head of Migration and Border Policy Department
Ministry of the Interior of Estonia
Estonia has had e-government for ten years. A few days ago we just had an anniversary – 10 years of ID-card as a digital identity document.
Our e-government means e-services for the people – an electronical document signed digitally is as good as the one with a hand-written signature. It is very convenient in both public and private relationships for signing documents such as applications and contracts. Digital identification and digital signature are commonly used in Estonia because people know they can trust person’s digital identity and digital signature confirmed with the ID-card. The ID-card has made everyday life of people in Estonia much more convenient. For example currently we have census and already about half of 1.3 million people have participated in it electronically with their ID-cards.
Estonian e-government is based on digital identity documents and secure electronical identity management.
Our ID-card is a visual identity document that can be used for physical identification in Estonia and in the European Union and it is a digital identity document that can be used for electronical identity confirmation and for giving digital signature. All Estonian citizens and residents must have an ID-card for secure identification in electronical environment.
We have also introduced identity documents that are only digital identity documents and can be used in electronical environment only – digi-ID and mobile-ID. They are additional digital identity documents and can be use as the ID-card.
Digi-ID is a plastic card, but it is for electronical use only. No need to use expensive security elements on the card itself. Mobile-ID is a digital identity document that has digital identification certificate and digital signature certificate tied to the SIM-card of a mobile phone. We created the solution together with the mobile operators in public-private cooperation. Mobile-ID is very convenient because it does not need a cardreader to sign documents. Last year we had parliament elections where mobile-ID was also used as an identity document and we consider it a success.
The bases of our e-identity management success story is that we strictly separate state issued identity documents and private documents. The state has the monopoly to identify a person, confirm the identity and issue certificates that confirm the person’s identity – identity documents. The state takes responibility for the identity of the person and guarantees that the same person does not have any other identities.
Of course in private relationships people may use whatever they want to identify themselves to each other – passwords, loyal customer card numbers ect. But with the ID-card we provide the opportunity to verify in electronical environment that the person is really the one he or she claims to be.
Estonian digital identity document has two certificates attached to it – digital identification certificate and digital signature certificate which are centrally adminitrated. When a person uses the ID-card it is automatically checked in the database that the certificates are valid.
Estonian digital identity document system is an efficient tool to avoid one person having several identities, identity thefts and using false identity.
We think that a cornerstone for secure electronical identity management is the identity confirmed by the state. The other important issue is to create technological and organisational security measures to keep the identity management secure. But if we do not take as the bases of identity management that every person can have only one identity and it has to be the one known to the state then security measures won’t work anyway.
In the globalizing world we have common cyberspace and Internet. Economy and business are international. And organized crime and terrorism are international. These phenomina need secure identity management. Whatever the technological solutions will be to make data held in different operational systems comparable, the common identity management in international perspective needs common bases for identity confirmation and it should be the one and only state confirmed identity.