1. European Electronic Identity Practices Country Update of Norway Speaker: Sverre Bauck Date: 2005-05-26

2. Historical facts After WWII there has been resistance against compulsary public identification systems in Norway. After 1970 the use of cheques became more and more widespread. The banks felt the need for identification systems to bad cheques. The government refused in 1975 to take action, and the banks established joint systems for bank identification cards; these became, and are, the de facto visual identification standard in Norway today.

3. Historical facts Net-banking has become very popular, and the banks are now bringing their visual identification systems into the electronic periode and a common inter-bank electronic eID system is coming up now.

4. Status of National legislation on eID Are eID specific regulations enacted and in place? Yes and No Name and date of the regulation(s): Electronic signature act Main elements of the regulatory system regarding: –liability

5. Status of National deployment of eID Name of the project: Sikkerhetsportal Plans, piloting or implementation? Yes Is the card obligatory? No Starting date of issuance: 2005-09-30

6. Status of National deployment of eID Envisioned total number of cardholders: Number of cards/certificates issued by 31-10- 2004: Number of inhabitants: Yearly growth rate (percentage): Expected number of cards/eID certs by end of 2007:

7. Status of national deployment of eID Basic functionalities of the eID card: - official ID document: Yes - European travel document: No - support of on-line access to e-Services: Yes Validity period of the card/certificates:

8. Status of national deployment of eID Price in Euros of the cards: - for the citizen: - for the card issuer: - price for the card reader and software:€ 10 - any additonal costs for the user/relying party: From whom and how may the citizen obtain the end/user packages National Lottery

9. Basic ID function What cardholder data is electronically stored in the card: - national identifier Yes - family name, given name Yes - sex Yes - date of birth Yes - nationality No - others........

10. Basic Authentication function What Cardholder Verification mechanism is used: - PIN? Yes - Biometrics? No - If Yes, what biometrics? - If No, is introduction of biometrics envisioned? Maybe Is there a PKI supported cardholder authentication mechanism? Yes

11. Basic Signing function Is a PKI supported signing mechanism (certificate and keypair) present for e- transaction services (non –repudiation)? Yes

12. eID based services What kind of services (include examples) are accessible to cardholders based on acceptance of the cards / eID Certificates:Many Total number of eID based services accessible by cardholders by 31.10.2004: Goal (in numbers/ percentage) of eID based services to be accessible to cardholders by the end of 2007:

13. eAuthentication Business models; financial What are the Charging/Revenue mechanisms? What charges are levied for use of the card? Is there a charge for checking certificates and if so who pays for this? Has a cost benefit analysis been compiled for the eID scheme? If yes what are the main conclusions? No Is there a study report available?

14. eAuthentication Business models; public/private partnership Are non government bodies allowed to use the IAS or other card functions in support of their services? Is the card a multi-application smart card? Yes –If No, are there any plans for this and in what timeframe? –If Yes, what percentage of the deployed card base is multi-application smart card enabled? –If Yes, are additional services (other than core IAS) loaded pre-issue or post issue or both?

15. Lessons learned so far Benefits have to be visible and exceed costs

16. Porvoo Group cooperation issues How to render useful and cost-efficient services to the citizen. Proposed Action(s): Information and education.

17. Current situation Banks are rolling out their eIDs and setting up PKI. Lacking formal standardisation is creating uncertainty about the use of these in communication between citizen and public services.

18. Current situation Need for personal and role certificate has been acknowledged in some sectors, and the market is maturing. There are several eID-systems with PKI- technology in use: Lottery, Health Insurance,and others. Mainly smartcards.

19. Constraints Public authourities voice need for legal regulations and control. Issuing and maintenance of cyber identities is expensive, and a general public service that could render such a service has not been established.

20. Constraints It seems likely that banks will provide the services, either de facto or under regulations. Need for cross-border PKI-services is growing rapidly; voiced by the National Bank, Tax authorities, E111-services

21. Challenges General need taken care of by banks. General public PKI-programmes tend to be driven technological ideologists and not by economic needs felt by citizens or public services.

22. More information email: Sverre.bauck@brreg.no Thank You!