Setting Processes for Electronic Signature 1 The ”W-SPES Project” and the “Leuven Report on the Electronic Signatures Directive” – Putting the Project in context. Dr Shaun Topham Sheffield City Council, UK

Setting Processes for Electronic Signature 2 Putting the project in context. To cover: “Why the Electronic Signatures Directive?” “What were the objectives of SPES and W-SPES?” “What was the Leuven Report?” “What is the SPES response to the Leuven Report?” “How does W-SPES fit in with “What Next?”

Setting Processes for Electronic Signature 3 Scope of the Electronic Signatures Directive 1999/93/EC The purpose of the Directive was to facilitate the use of electronic signatures and to contribute to their legal recognition To establish a legal framework for electronic signatures and certain certification services in order to ensure the proper functioning of the Internal market. It does not regulate the legal recognition entirely, but only seeks to “contribute” and “facilitate their use”. It is seeking to establish a common legal framework rather than a mixture of national laws in this domain. It is The Electronic Commerce Directive which deals with contracts etc

Setting Processes for Electronic Signature 4 It does not seek to interfere with government applications where specific forms are already prescribed etc It does not deal with whatever happens voluntarily within a closed system. Parties agree amongst themselves. E.g. banks, insurance companies etc But it shares the concerns covered in W-SPES- ………..“one of the primary aims is to guarantee the interoperability of electronic signatures products…... Essential requirements must be met in order to ensure free movement within the internal market and to build trust in Electronic Signatures.” The Directive

Setting Processes for Electronic Signature 5 To accelerate the introduction of the digital signature in public administrations. To develop Applications/Services through a cross- fertilisation process amongst the partners. To integrate the digital signature into these applications. To implement a model organisational structure for the registration authority issuing/managing the digital certificates. To ensure that a certificate released in one country by a Trusted Third Party can be accepted all over Europe SPES Objectives

Setting Processes for Electronic Signature 6 W-SPES Objectives to extend the scope of SPES and pursue for improved and broader results across European countries. to encourage mutual co-operation and replication of experiences. to consolidate the use of digital signature and strong authentication. to identify and classify the knowledge deriving from the SPES project. to set up a number of interactive and secure electronic services which require strong authentication and/or digital signature. to consolidate the SPES CA cross-recognition scheme.

Setting Processes for Electronic Signature 7 Digital Signature schemes (PKI) are becoming the key to secure advanced citizens services on the Internet & info- kiosks Interoperability between local solutions thus becomes more and more important The question is: ”How do we ensure that citizens from one EU country can access services from another EU country ?” The problem

Setting Processes for Electronic Signature 8 To propose a practical technical approach to facilitate the introduction of European on-line services which will: 1.Accept digital certificates issued by different European CA’s 2.To uniquely associate the provided digital certificate with the physical identity of the service user SPES objectives/1

Setting Processes for Electronic Signature 9 Identifying the major obstacles to interoperability between CA solutions: –Cooperation between CA’s is difficult due to many factors. The cooperation must be kept as simple as possible –ID information stored on cards differs from country to country. Alternative methods of identification must be found for on-line identification of the user Development of a set of tools to deal with the interoperability problem in a pragmatic manner SPES objectives/2

Setting Processes for Electronic Signature 10 Summary of SPES Interoperability approach Digital Signature & Strong Authentication 1. Digital signature verification tool 2. Centralised authentication server 3. Using of EUPKI CA/RA Open source tools (W-SPES) 4. Cross recognition among CAs 5. SPES recognised CAs Trusted list 6. CA / RA standard policies 7. Memorandum of Agreement among the involved CAs 8. Registration procedure before accessing the service

Setting Processes for Electronic Signature 11 What was the Leuven Report? Within the Electronic Signatures Directive itself was prescribed that a Report should be written evaluating the initial impact that the Directive has had. This was written by a team based at the “International Centre for Law and Information Technology” at the Catholic University of Leuven in Belgium, led by Professor Joe Dumortier. Entitled “The Legal and Market Aspects of Electronic Signatures”

Setting Processes for Electronic Signature 12 What was the “SPES view on the Leuven Report”? This was a document provided in response to a request made of the SPES project team at the Final Review of the SPES Project. The main task of this document was to consider the original Report, not to evaluate it or make a critique of it, but to see in which ways, the experience gained by the partners in the course of the SPES project could help re-enforce the results and conclusions of the Report and to attempt to incorporate some of the “lessons learned” to augment the findings of the Leuven team Both the Report and the SPES project had a similar starting position and purpose for their existence. This lies in the context of the lack of interoperability in this field across the EU which in turn is contributing to the failure for this technology to be exploited to the full and for its benefits to be realised for European citizens.

Setting Processes for Electronic Signature 13 What are the current forces at work and how does W-SPES fit in? Porvoo Group National eID interoperability Ad-hoc Group. Austria, Estonia etc CIP Programme eTEN PPP Project.Belgium. European Smartcard Charter and its circle. Liberty Alliance, Shibbeleth.

Setting Processes for Electronic Signature 14 summary Still vicious circle of no certificates and so no applications which would need certificatesc Still lack of applications cross border. W Spes approach contributing on many fronts. We should return to this theme at the Final Workshop and hopefully, there will be light at the end of the tunnel.h