Public procurement notice: Prior Information Notice Without Call For Competition
Published: 2021-10-20
Buyer: Rigspolitiet
Country: DK
Contract type: Services
CPV classification: 48000000 | 72000000 | 72200000 | 72230000: Custom software development services | 72250000: System and support services

Technical requirements: Request for information (RFI) - Public Key Infrastructure (PKI) services for Danish national identification documents
The Danish National Police is currently in the preparation phase for a tender regarding the eMRTD Public Key Infrastructure (PKI) and Country Verifying Certificate Authority (CVCA).
Reference is made to Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of Union citizens' passports, ID cards and residence cards issued to Union citizens and their family members exercising their right to free movement
The Danish National Police is currently in the preparation phase for a tender regarding the eMRTD Public Key Infrastructure (PKI) and Country Verifying Certificate Authority (CVCA).
Reference is made to Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of Union citizens' passports, ID cards and residence cards issued to Union citizens and their family members exercising their right to free movement.
Today, no fingerprints are read from the chip in Danish or other Schengen citizens' passports, residence cards and ID cards when entering or leaving Denmark and the external border. Denmark is actively working towards being able to exchange the necessary certificates that precisely enable the reading of fingerprints in chips, with a view to preventing fraud and terrorism.
It is therefore crucial that Denmark establishes a PKI, both organizationally and in terms of infrastructure, which makes it possible to exchange CSCA and CVCA certificates with other EU countries.
The Danish National Police would therefore like to conduct a market dialogue with potential partners who specialize in this particular service, and thus partly qualify the Danish needs in order to increase the quality of a future tender and partly examine what the market can offer today in relation to possible solutions.
- Protection of information in the chip in Danish passports and resident cards via CSCA and CVCA certificates
- Administration of certificates to read data from Danish and foreign passports, residence cards and ID cards
- Administration and tests of the exchange of certificates with other Schengen member countries (SPOC)
Today, certificates are already exchanged between Denmark and other EU countries, which partly ensures that there is trust in the issuer and partly enables the reading of an image from a chip in e.g. pass and comparison of data from MRZ line from data in the chip. Going forward, a technical solution must also be implemented, which enables Denmark to exchange CVCA certificates with the EU countries and thus be able to read fingerprints from the chip, including by border control, BMS (Biometric Match System) and foreign control.
To exchange certificates with another EU country, 6 test levels must be completed. 3 levels in test environment and 3 levels in production environment. This must be done bilaterally with each country - There are a total of 31 Schengen countries - of which 26 countries have started testing. In the same way, it is also a requirement on the part of the EU that the national SPOC must have undergone a security audit before being able to test in production environments with other countries.
This is expected to take place in collaboration with the Danish National Police and the future supplier, which is why part of the market dialogue will have to shed light on both testing and audit as well as the operation of these tasks. It should also be emphasized that Denmark is obliged to be part of the common certificate policy, which is a foundation for a joint reading of chips in Schengen, which is why it is also expected of the supplier to have knowledge of the common certificate policy and ICAO Doc 9303.
The purchaser is using Mercell for this RFI. To get access to the documents, you must copy and paste the following link https://permalink.mercell.com/165461770.aspx