MEMORANDUM TO FILE

FROM: Richard A. Guida

SUBJ: REPORT OF INTERNATIONAL PKI MEETING

DATES: 25-26 May 2000

This memorandum documents my participation in an international
(government-only) conference held in Oslo, Norway and hosted by the
Government of Norway. Participants in the conference are listed in the
enclosure and in addition to the U.S., represented the national
governments of Japan, the Netherlands, Canada, Norway, Sweden, Finland,
Ireland, and the U.K.

The conference focused on several topics, among which were: (a) PKI
product and institutional interoperability; (b) how PKI fits into
national government efforts to deliver services to citizens over the
internet; and (c) what experience governments have had in the use of
this technology which would help inform others.

Each country made a presentation on the use of PKI -- actual and planned
-- within its government and country. Copies of each presentation will
be made available on the web at a URL to be determined (we will post the
URL on our Federal PKI Steering Committee web page as soon as we get
it). This memorandum therefore does not recite everything included in
those presentations. Rather, it focuses on some highlights of particular
interest to the US Government. Each national government is covered
separately below; the material is a mix of what was presented and what
was discussed in response to questions, and reflects the technical
detail which the country provided.

1\. Canada: Owing to our very close relationship with the Government of
Canada and frequent cooperative activities, their presentation did not
cover anything that differed from our previous interactions. Some
interesting updated facts: (a) about half of the Canadian provinces (6)
are currently implementing solutions based on PKI, with Ontario having
the largest effort; although the national government has standardized on
Entrust, provincial governments may use other products (although Ontario
has also selected Entrust) so they too -- like us -- face interproduct
interoperability issues; (b) use of PKI to support the delivery of
medical care is considered to be one of the most important applications,
since such services must be delivered consistently across all provinces;
(c) Canada has enacted Bill C-6 (Electronic Documents Act) in April
2000, which legitimizes digital signatures, provides for their
acceptance in litigation, and requires agencies to employ electronic
records in their internal and external activities to the maximum extent
practical; (d) Canada's goal is to have 100% of forms and materials
on-line by Dec 2000, and they intend to use digital signatures on the
forms/materials to ensure integrity; and (e) Canada has made substantial
progress with their "root" or "bridge" CA (Canadian Central Facility),
with two departments' PKIs cross-certified with CCF and applications for
six additional cross-certifications being processed; however, there is
also some consideration being given to agencies aggregating their demand
for certificates and having that satisfied by a single CA being run by
the Government Technology and Informatics Services (roughly equivalent
to GSA/FTS), thus making it unnecessary for agencies to stand up their
own individual CAs.

2\. Japan: The Japanese government has decided to "build the foundations
of a paperless government by 2003" (Prime Minister determination) which
includes making "all applications, registrations and other procedures
between the people and the government available on-line using the
Internet." To accomplish this they intend to: (a) build a "bridge CA"
for interagency interconnectivity by the end of fiscal year 2000 (which
in Japan covers April 2000 to March 2001) and have it begin operation in
fiscal year 2001 (Management and Coordination Agency under the Prime
Minister's Office has the lead responsibility); (b) have each agency
stand up their own CA by fiscal 2003 (MITI will be first -- by fiscal
year 2001; agencies may select whatever CA product they desire -- they
will not be constrained to a single product); (c) enact legislation and
regulations covering e-signature use during fiscal year 2000 (lead
responsibility under the Ministry of Justice; note that under their
parliamentary system, the executive and legislative branches are
naturally designed to work together more closely than is usually
accomplished in the US, and as such, this schedule is not viewed to be
unrealistically optimistic); and (d) establish a mechanism for payment
over the internet of fees government agencies charge for services or
products (direct bank to government funds transfers). These goals are
set forth and amplified in several government documents. It is expected
that the private sector will develop commercial PKIs (to service
business to citizen and business to business uses) following the
government's lead. The government has a Government PKI Forum which
includes private vendors (Entrust, VeriSign, and Baltimore were
mentioned) to provide advice and exchange of views on the technology and
applications.

The government intends to use their bridge CA model not only to effect
interoperability among agency CAs, but also with external commercial and
international CAs including those of other governments. Details on how
the policy and technical interoperability will be accomplished are now
being worked out, but it is clear that cross-certification is the
intended mechanism.

The government does not envision licensing or accreditation of
commercial CAs, but rather intends to let the marketplace determine the
utility of certificates. The government plans to employ DSA, RSA and
ECDSA for digital signatures; they want to accept what is generally done
by the rest of the world and not restrict themselves to one or two
algorithms. Their CP is under development; they have not decided either
the format or what levels of assurance they will express, but they
expect to employ PKIX for the CP, and at present, they are only planning
to have a single level of assurance.

3\. Ireland: The Government of Ireland is focused on electronic service
delivery in general, but has not yet focused on any single
authentication technology. PKI is being used in one pilot effort as a
test of the technology and its use. The country population is 3.5
million with a third living in the greater Dublin area, and their
government operates on a very centralized basis (e.g., a single
government intranet); thus, they are in a favorable position to employ
electronic service delivery on a uniform and universal basis. They plan
to have a single portal for access to government services, including a
process for user registration (enabled using PKI or other mechanisms for
authentication). Services are delivered around "life events" such as
birth, medical needs, getting or losing a job, establishing a company,
getting married, having children, and so on. Once the use of PKI is
adopted, it is expected that there will be a single CA serving all
government needs, with one identity certificate issued to each citizen
(i.e., no roles expressed in the certificate). Some consideration is
also being given to accepting privately-issued credentials (e.g., by the
phone company) meeting government standards. In order to ensure "quality
of service," the expectation is that users would employ dial-up services
to an ISP which would be connected to the government Intranet and thus
may not employ the Internet at all. The use of an intranet may
acceptably allow the use of authentication technologies that are weaker
than PKI provides, at least for some applications.

4\. Netherlands: The Netherlands Government (population: about 13M)
plans to have by 2002, 25% of public services available on line
("electronic government"), with a goal of having an infrastructure in
place to support that by Fall 2002. The task force working on this was
established in January 2000. PKI has been selected to provide
authentication and encryption capabilities for reasons of strength and
inter-application interoperability. However, at present there is far
more "supply" for certificates than there is "demand" for them. The
government is viewed as a "launching customer," playing a major role in
getting PKI usage stimulated. There is a need, still being evaluated, to
adjust the laws to provide full legal effect for digital signatures.

The Netherlands will operate under the European Union Directive on
electronic signatures (which actually focuses on digital signatures),
which does not allow licensure of Certificate Service Providers (CSPs)
before they begin operation, but which does provide for "supervision"
after they begin operation. However, current Netherlands Government
plans are viewed as being insufficient to meet the EU Directive; e.g.,
all digital signature uses/forms must be "supervised" under the EU
Directive, not just some uses/forms. Further, the EU Directive provides
for country by country "special requirements" which may adversely affect
interoperability with other country schemes (on a policy level). (Note:
the EU Directive does not regulate business to business uses of
certificates, but rather uses with governments. There was also
considerable discussion of the EU Directive, much of it focused on the
fact that while the Directive provides an overarching structure, there
are lots of details to be worked out on a country by country basis which
could wind up complicating achieving the goals of the Directive, which
were to facilitate interoperability and legal acceptance of digital
signatures. More on this below.)

With respect to PKI, the government is striving to implement a limited
PKI in 2000 (which includes completing a certificate policy), and a
fully operational PKI by 2002. Certificate assurance level (for
government employee use) is targeted at meeting 75% of the applications
that are internal to the government -- other than national defense
applications that entail classified information. Goal is to have as few
levels of assurance as possible, preferably just one. With respect to
citizen uses, plan is to have 25% of citizens use PKI for tax filing
within the next year, and private keys would be protected on a hardware
token (smartcard).

5\. U.K.: Her Majesty's Government has several PKI initiatives underway,
some covering internal agency uses and others covering uses with the
public.

HMG already recognizes digital signatures as legally binding implicitly,
but has proposed legislation (pending in Parliament) making that overt.
Regulation of CSPs is voluntary and driven by the private sector
industry with government involvement; there is no licensure scheme. This
approach is called "t-scheme" and is expected to affect the entire UK
economy; there was uncertainty expressed by some countries as to how
this scheme may conform with the with EU Directive.

In April 2000, HMG adopted the "Information Age Government Strategy"
which covers the implementation of e-government. Targets are by 2002
(25%) and 2005 (100%) -- percentages show "delivering dealings
electronically to the citizens." Examples which are easily expected to
meet the deadlines are personal tax filings, value-added-tax filings,
and some life event services such as birth of children and moving to a
new location (address update which propagates across multiple
agencies/uses). The tax filing initially will be done using PINs over
SSL but the plan is to employ PKI eventually.

For internal use of PKI, HMG has an initiative called "cloud cover" to
ensure agencies have access to "the widest possible range of secure,
interoperable and cost-effective PKI solutions." HMG has recently stood
up a root CA done by CESG (analogous to NSA); the product is Baltimore
Unicert. Agency CAs will be subordinate to the root. Thus, HMG is using
a hierarchical model rather than the US or Japanese bridge model, but
MOD is planning to use a bridge for their internal departmental uses.
Plan is also to migrate to OCSP for certificate status determination.
Interoperability between Unicert and other CA products (since agencies
can select any product they desire) is done first in a test environment
-- and so far has identified numerous interoperability problems among
different products. The UK plans to publish a report on their testing.

Ultimate plan is to have all civil servants issued smartcards. Common
Criteria will be used to assess product acceptability. Example early
uses include MOD (procurement), Inland Revenue (cited above), Department
of Social Security (benefits), Health and Patient Care (patient
records).

Authentication framework defines three non-hierarchical levels (or
types) of assurance (Levels 1 (general use for non-significant
transactions), 2 (personal info access/use) and 3 (financial
transactions)), and would allow citizens to employ privately-issued
certificates for government purposes. However, this may entail citizens
having to purchase such certificates. Additionally, it is expected that
the government-prescribed levels of assurance would be employed by (and
accepted by) private companies as well for commercial transactions --
that is, the marketplace would find those government levels as useful
without being compelled by regulation to do so. Citizen and business
authentication will take place at the internet portal or "gateway," not
at an agency by agency basis. However, agencies can still decide what
level of authentication is necessary for a particular transaction.

SSL is generally viewed as an acceptable security mechanism for data in
transit, recognizing that most attacks occur on stored data where SSL
provides no benefit. XML is being adopted as the standard for obtaining
and sharing data among agencies.

6\. Finland: The Government of Finland has several recently enacted and
implemented laws dealing with the issuance of national identity cards
("population registration") which are smartcards with digital
certificates. Issuance requires in-person identity proofing done by the
Finnish national police acting as the Registration Authority. The cards
contain two certificates, one for signature, the other for
encryption/authentication (this is discussed further below). Keys are
generated on the card by the government when the card is manufactured
(done after the citizen goes through the registration process). The
cards are physically delivered at the police station so the citizen must
return to pick up his card -- thus the citizen is identity proofed to
register for the card, and then identity proofed to receive the card.
The card also comes with two pre-determined PINs (one for the signature
certificate and one for the authentication/encryption certificate) for
unlocking the private keys; the PINs cannot be later changed. Three
failed sequential attempts lock the card requiring a visit to the police
station to unlock.

The certificates are X509V3, with IETF Certificate Profile for the
extension fields. The card is PKCS#15 compliant and is 16K ROM; 32K ROM
expected by end of the year. SETIC provides the cards; cost is about 200
Finnish Marks each (about US\$30). The CA product being used is "iD2"
which is a Finnish company. (That product does not cross-certify at
present but is expected to be enabled to do so in a future version.)
SHA-1 is used for hashing; the subject name is unique and includes the
Finnish Unique ID number with the common name; RSA with 1024 bit modulus
is used for the signature on the certificate. The certificate used for
signature has the non-repudiation bit set but NOT the signature bit;
this is viewed as being in conformance with the EU Directive, and it
differs from the US/Canadian model of setting both the non-repudiation
and digital signature bits for a "digital signature certificate."
Moreover, the encryption certificate has both the signature and the
encryption bits set, the former so the certificate can be used for
authentication, the latter for encryption. These practices and their
implications for interoperability with the US and Canada are discussed
further below.

The smartcards can be used as a "passport" in EU countries (either
electronically read, or physically read since the cards contain printed
information and a picture ID as well), and to obtain electronic services
from the government by citizens over the Internet. Directory services
are both X.500 and LDAP based; for X.500 Finland is using PeerLogic
i500. Directories of citizen certificates are publicly available. CRLs
are published hourly. A total of 5,000 cards have been issued, with a
deployment rate of about 1,000 per month (Finland has a population of 5M
citizens.). This rate is expected to increase as more electronic
services (both government and private sector) become available on-line;
current government services include library access, employment services,
and registration for receipt of information. The card is voluntary --
citizens are not required to have one -- but are encouraged to do so.

Finland has a law undergoing internal review in the Ministry of
Transport and Communications, and to be submitted to Parliament in
Autumn 2000, that will implement the EU Directive. Once that is done,
the certificate profile and/or policy may need to be adjusted, that will
not be done until the implementing law is finalized. (N.B.: All of the
European and Scandinavian countries at the meeting are members of the EU
except for Norway; the last, however, is also committed to implement the
EU Directive owing to separate agreements with the EU.)

The levels of certificates which are expected ultimately to be issued
under the EU Directive and in conformance with EESSI are "Specific
Qualified" certificates (the category described above for citizens or
companies doing business with the government), "Qualified Certificates"
(for B2B and C2B transactions), and "non-Qualified Levels" for other
uses. (There was considerable debate, discussed further below, about how
all of this affected policy interoperability within EU countries.)

Finland has a specific law ("Act on Electronic Signing in the
Administration") allowing "electronic lodging" of administrative
matters, which includes digital signatures on transactions with the
government. The government must notify the sender of the transaction of
receipt, and provide a time stamp therefor.

Certificates on the national card can be accepted by private parties for
non-governmental transactions (e.g., business to business or individual
to business), but certificates issued in the private sector currently
are not accepted for use with the government. This may change when the
EU Directive legislation is enacted.

The Finnish Government will "supervise" CAs that supply certificates
under the EU Directive, but the exact nature of the supervision has yet
to be determined. It will not entail licensure, however. Beyond that,
there is considerable debate as to how the Directive will actually be
implemented in a fashion which honors its intent.

Finland also intends to support "role-based" certificates (i.e.,
attribute certificates) but those efforts are in the early stages.

7\. Sweden: The Government of Sweden (population: about 9M) has
determined that PKI is the appropriate mechanism for
identification/authentication and confidentiality for use by citizens,
but in addition, it is expected that such use will grow substantially
first within government and with businesses before it sees widespread
use with citizens. (This was also a generally held view that suffused
the other discussions.) Nonetheless, there are plans for electronic
service delivery by government to businesses and the citizens covering
such areas as tax declarations and filings, medical benefits, employment
(helping those seeking jobs), student loans, and the legal aspects of
real estate transactions. The government is reviewing their authority
under laws in each area, and does not plan to have an overarching
"electronic signatures are acceptable everywhere" type of law, but
rather will adjust laws on a case by case basis where necessary.

In February 2000, the government issued a report on planned use of PKI
within the government and with citizens. The report proposes the
establishment of a government CA for certificates issued to the public,
but also the acceptance of certificates issued by private sector
companies as well under contract to the government (especially banks).
(Interoperability among CAs could be by cross-certification or other
means.) Sweden is considering three levels of certificates: Class 3
("Qualified" under EU Directive; hardware tokens for private key
protection); Class 2 (software tokens for private keys -- maybe used
only in Sweden since may or may not be "Qualified" under the EU
Directive); Class 1 (other). One issue Sweden is facing is whether to
place their equivalent of the US Social Security Number in the
certificate to ensure distinguished naming (as the Finns are doing) --
but if that is done, that means the certificate has "private
information" which cannot be publicly divulged. This is not yet
resolved.

8\. Norway: The Government of Norway (population: about 5M) has an
"action plan" which includes the use of PKI for internal and external
(delivery of e-services to businesses and citizens) purposes. An
organization focused on this effort was formed in January 2000
(Government PKI Task Force) and includes the national and local
governments (states and municipalities). An early part of this effort
involves enabling web-based government procurement of goods and
services; 26 companies are registered now for that purpose under eight
different "framework" contracts. Agencies post their procurement needs
on a web site, and the companies then compete to supply those needs;
traffic has been about \$110M (US) per year. Bids are received
electronically with out of band authentication. Digital signatures are
not yet widely used but the intention is to employ them in the future.
The expectation is that the government will be the catalyst for uptake
by businesses of e-commerce mechanisms using this approach (with PKI).

The government has some PKI pilot efforts in place covering messaging
(e-mail) and some elements of procurement activities. An agreement was
signed in May 1999 with three CA service suppliers to support these
efforts: Norwegian Post (iD2) and Norwegian Telecom (Entrust) are the
principal CA sources with a third private source that actually also uses
Telecom for CA services. The certificates are only for government
employees. Registration is done by the CAs and also locally by the
agencies using VPNs over the internet. The agreement included provisions
for cross-certification among the suppliers so that certificates issued
by each can be universally accepted. Original goal was to have
cross-certification by Dec 1999; expected now by June 2000. The
government has a certificate policy with one level of assurance (private
key protection on hardware token so considered at a high assurance
level) covering encryption, digital signature and authentication
certificates. Hardware tokens are smartcards compliant with PKCS#15. The
smartcards are not necessarily considered to be ID cards; agencies may
place picture IDs on the cards but are not required to do so. MD5 and
SHA-1 are allowed but the latter is preferred. There are four types of
certificates distinguished using the subject alternate name field:
organizational certificate, personal certificate (civil servant), role
certificate (units, functions), and profession certificate (e.g.
barristers, health professionals). Organizations are uniquely identified
but not natural persons.

The cross-certification efforts (getting Post and Telecom CAs to
interoperate) are being done on a policy and technical level. Directory
interoperability was effected using X.500 chaining, but there were
complications owing to incompatible schemata that were subsequently
resolved. CA to CA cross-certification is not yet effected because iD2
does not yet accept PKCS10/7 or CMP, but that functionality is expected
to be implemented later this year in the product.

Pilot efforts (other than procurement) include electronic tax return
submissions from companies, medical records exchange among
government-supplied health care providers, electronic submission of
patent grant requests (National Patent Agency) (which may include patent
applicants and their agents -- which does include the public in a
limited way), and telecommuting by government workers using PKI
authentication confidentiality.

The government has a draft law under review to implement the EU
Directive; they hope to have it go to Parliament by later 2000 with
adoption and implementation by 2001. A survey of Norwegian laws is also
underway to find impediments to e-commerce; expected to be completed by
July 2000; the effort includes developing proposed remedies which may
include a general law that eliminates the impediments (e.g., general
statement that electronic signatures shall have the same force/effect as
written signatures unless otherwise specifically restricted).

For PKI use with citizens, there are many complications which remain to
be resolved before such use can be implemented. The government needs to
first review and change (where necessary) the laws (as discussed above),
then adopt regulations, and then proceed to implementation which will
have to address a variety of matters including how many levels of
assurance are needed, how should they be designed, should certificates
be accepted from non-governmental (private) CAs, how is naming to be
done, how is interoperability effected, and so on. (At present, the
Ministry of Defence sets cryptographic standards that apply even to
encryption of sensitive unclassified documents, but that is changing to
be done by the civil side of government.)

The Government PKI Task Force must publish a report by October 2000
containing the results of its efforts and recommendations on how PKI
shall be deployed across agencies and with the public and trading
partners, considering the issues discussed above and the results of the
pilot efforts.

9\. U.S.: My presentation was the standard "Evolving Federal PKI" one
and included the results of the EMA Challenge with the prototype Federal
Bridge CA. There was considerable discussion on ACES and
interoperability, and it is likely that further contacts will be made
covering those topics. I also noted that from an international
interoperability standpoint, we in the US Government do see several
potential applications which may benefit from government to government
PKI interoperability; I cited the US Patent and Trademark Office's
efforts with the Canadian Intellectual Property Office. I advised that
while inter-governmental interoperability of PKIs will take some time to
emerge, we intend to pursue such interoperability with the Canadians as
soon as circumstances permit (i.e., once our Federal PKI Policy
Authority is operational and the production Federal Bridge CA commences
operation, hopefully by the end of this year).

Final Comments:

A. The biggest surprise to me was the discordant ways in which the
non-repudiation and digital signature bits in certificates are set, and
how that really does affect client software interoperability. In the US
and Canada, we typically set the non-repudiation and digital signatures
bits for "digital signature certificates" and then allow those
certificates to be used for authentication and digital signatures. For
data encryption certificates, we only set the data encryption bit
(unless the certificates are for SSL, in which case we set the key
encipherment bit). In Europe, where three certificates are used, each
sets one bit: data encryption (for encryption), signature (for
authentication), or nonrepudiation (for signature); if two certificates
are used, the signature certificate sets the nonrepudiation bit, but the
encryption certificate sets the encryption and the signature bits. This
means that applications which are enabled to accept certificates with
both nonrepudiation and signature bits set for digital signatures will
fail to accept digital signature certificates issued in Europe which set
just the former bit. (Note: Her Majesty's Government noted that they too
use the US/Canadian approach.) Bottom line: we either need to try to get
consonance on how these bits are to be set or else certificates will not
be interoperable, or we need to have vendors who enable applications to
accept certificates, to allow users to decide which bits are acceptable
for which applications.

B. The other, less significant, surprise was the concern expressed again
and again about how the EU Directive will be implemented, what it really
means, and how there is much effort ahead trying to understand all of
that before interoperable certificates (across the EU) really emerge.
For example, with respect to the "qualified certificate" under the EU
Directive, it is expected that every certificate issued in Europe will
assert, in an extension field, whether it is "qualified" under the EU
Directive, or not. The assertion will be made by the CA. The
"supervisory" framework will provide for correcting any assertions that
are made which are judged to be incorrect. But this does mean that
certificates containing the assertion may not be legitimate at the time
of issuance and at the time the relying party seeks to use them; rather,
legitimacy may only be determined at a later date once the "supervisory"
structure performs its duty.

C. There was a brief discussion of the European Electronic Signature
Standardization Initiative (EESSI) and how it is intended to support
technical interoperability among certificates issued under the EU
Directive, and the use of those certificates. There was general
agreement among the European countries that the certificates issued to
the citizens will have to be "qualified" to be useful. Government
employee certificates will likely either be "qualified" or "specially
qualified" where the latter entails imposing additional case by case
requirements beyond "qualified" -- but as cited earlier, that could
create interoperability concerns since the special requirements can
differ by government and/or by agency within a government.

The Directive also allows governments to declare that certain uses
involved "closed user groups" which then allows a government to restrict
which certificates are suitable for applications within that "closed
user group." This is one way in which certificates from outside the
country may be excluded from use. Otherwise, any "qualified certificate"
whether issued within one country or some other country must be accepted
for applications where a "qualified certificate" is considered
acceptable. Per comment B above, note that the fact that a certificate
is "qualified" is self-asserted which means that it is important that CA
providers be audited to show compliance with the EU Directive if they
claim to be issuing "qualified certificates."

The UK noted that they intend to deal with this by having a UK
government CA issue certificates to those CAs whom it trusts to issue
certificates under the Directive, so if browsers are configured to check
that fact before relying upon a certificate, trust is preserved. Some of
the countries questioned, however, whether that approach complies with
what the EU Directive requires and allows.

There was further discussion on how this would be implemented
technically within browsers. The suggestion was that a user who, using
his or her browser, receives a certificate from a commercial CA located
in a different country where the CA claims to be issuing qualified
certificates, the user will get the pop-up window which says "This CA is
not in the Browser Trust List, do you wish to trust it?" At that point,
the user will have to refer to a list of CAs which European governments
have reviewed or otherwise determined to be acceptable issuers of
"qualified certificates" before deciding whether to accept the
certificate. This is, in effect, an administrative solution, and it
requires the maintenance of up to date lists of which commercial CAs
have been reviewed or audited to demonstrate compliance with the EU
Directive.

D. There was a discussion of how many certificate levels of assurance
are likely to be necessary for citizens. The consensus was to use the
80/20 rule -- that is, issue a single level of certificates that meet
80% of the needs, and then deal with the remainder separately. (I had
explained the ACES concept as a certificate that provides a fundamental
level of assurance upon which additional security can be built using
shared secrets.)

For the records, the views expressed in this memo are those of the
author, and do not necessarily reflect those of anyone else, so if there
are any errors or misinterpretations of the substance of the
discussions, they are the fault of the author.

Participants:

# Canada

Sue Bryant, Deputy Director, PKI Directorate, Treasury Board Secretariat

# Finland

Tapio Aaltonen, Deputy Director, Electronic Identification, Population
Registre Center

Vesa Vatka

# Netherlands

Lonneke Stempels, PKI Task Force "Overheid"

Jan Timmermans, Ministry of the Interior

# Japan

Hirokichi Yuzawa, Deputy Director, Information Economy Office, Ministry
of Trade

and Industry

Toshikazu Sawada, Assistant Director, Government Information Systems
Planning

Division, Prime Minister's Office

# Norway

Katarina De Brisis, Senior Advisor, Royal Ministry of Labour and
Government

Administration

Amund Eriksen

Anniken Seip

Jans Norve

Hilde Kristine Nysten Thorkildsen

# Ireland

Ray Kavanagh, Centre for Management and Organisational Development,
Department

of Finance

[U.K.]{.underline}

Andrew Smith, Assistant Director, Central IT Unit, Cabinet Office

# Sweden

Britta Johannsson, Information Technology Department

[U.S.]{.underline}

Rich Guida, Chair, Federal PKI Steering Committee