WRITTEN QUESTION E-1724/02

by Bart Staes (Verts/ALE) to the Commission

(13 June 2002)

Subject: Electronic identity cards and the protection of personal data

As part of the e-government programme in autumn 2000 the Belgian authorities decided that by 2005 every Belgian would be required to carry an electronic identity card. In order to make the exchange of data between individual authorities and between the authorities and their customers as secure as possible, the Fedict (Federal Agency for Information and Communication Technology) launched the Public Key Infrastructure (PKI), also referred to as the certification services rule. The card containing the private key should preferably be kept on a chip secured by means of a pin code.

An article which appeared in the 12 May 2002 issue of the New York Times claims that this chip technology can be copied. Two computer security researchers, Sergei Skorobogatov and Ross Anderson, of the University of Cambridge have demonstrated that information can be extracted from the chips with the aid of a simple camera flash-bulb and a microscope. In this way, criminals would have no problem whatsoever in obtaining personal information. In addition to electronic identity cards, this technology is also used in a number of other applications, e.g. in credit and charge cards and the GSM SIM cards in widespread use today. An IBM paper entitled Partitioning attacks: or how to rapidly clone some GSM cards has confirmed the vulnerability of this technology. The researchers demonstrated that they could extract information from the SIM cards much more quickly.

Can the Commission confirm that these worrying reports are correct?

If yes: is this state of affairs not at odds with European legislation on the protection of personal data? Are the Member States not required to take technical and organisational measures to protect personal data, particularly when the processing of data involves its transfer via a network? What measures does the Commission plan to take to deal with this breach of privacy?

If no: on what counterarguments will the Commission deploy in order to repudiate the research into the scope for copying chip technologies?

Joint answerto Written Questions E-1723/02 and E-1724/02given by Mr Bolkestein on behalf of the Commission

(26 September 2002)

The Commission was apprised of the proposals for Belgian regulations introducing a digital identity card through a notification pursuant to Directive 98/34/EC(1) (directive imposing notification of proposals for national regulations relating in particular to information society services). Belgium notified the proposed legislation (Ref. No 2001/474/B) and asked for the texts to be treated in confidence pursuant to Article 8(4) of the aforementioned Directive. Subsequent to an analysis of the proposed legislation, the Commission issued a reasoned opinion and observations. The reasoned opinion related essentially to the technical annexes with a view to ensuring that they complied with Council Directive 73/23/EEC of 19 February 1973 on the harmonisation of the laws of Member States relating to electrical equipment designed for use within certain voltage limits(2) and Council Directive 89/336/EEC of 3 May 1989 on the approximation of the laws of the Member States relating to electromagnetic compatibility(3). The observations, for their part, concerned the data protection aspects.

The Commission would point out that, as things currently stand, although there are plans to simplify certain existing procedures governing access or the communication of personal data, the proposed legislation does not specifically provide for the interconnection of medical or tax databanks.

The Commission nevertheless recognises the importance of the concerns raised by the honourable Member and will bear them in mind when assessing the implementation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(4). That assessment should be completed by the end of 2002.

At all events, the processing of personal data, including interconnections, to be implemented in connection with the electronic identity card must comply with Directive 95/46/EC. That Directive, whose scope is limited to Community law, sets out the principles and conditions governing the processing of personal data. In particular, it imposes the obligation to process the data fairly and lawfully and not to process them subsequently in a way incompatible with the purposes for which they were compiled. Directive 95/46/EC also contains a principle forbidding the processing of data relating to health, while providing for various exceptions. Moreover, it lays down that the conditions for the use of unique identifiers must be determined.

In addition, Directive 95/46/EC lays down the obligation to ensure that data are protected against accidental or unlawful destruction, accidental loss, modification, dissemination or unauthorised access, as well as against any other form of unlawful processing. Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector, which will be replaced as from 31 October 2003 by Directive 2002/58/EC(5), also contains specific security obligations concerning public telecommunications networks and telecommunications services accessible to the public.

The Commission is following with particular attention technological developments relating to the security of data exchanges. It would point out in this context that the level of security provided by using a public key infrastructure depends not only on the level of security offered by

the technical components of the infrastructure, but also on the quality of the security procedures, and above all on how strictly they are implemented (smart card, key generation, authority issuing the certificates, validity of the certificates, etc.).

The Commission is devoting particular attention to the security technologies used for transferring personal data. It would stress, however, that there is no such thing as an absolute level of security and that, pursuant to Directive 95/46/EC, the appropriate level of security having regard to the risks posed by the processing of personal data and the nature of the personal data to be protected must be assessed in the light of the state of the art and the costs involved in implementing the security measures.

As regards the composition of the supervisory authorities entrusted with monitoring the application of the provisions adopted by the Member States, Directive 95/46/EC lays down that those authorities shall perform their tasks in complete independence. However, the Directive does not provide any further indication on the manner in which that independence must be ensured. The Commission would point out in this context that, pursuant to the Belgian Law of 8 December 1992 on the protection of privacy with regard to the processing of personal data, the Belgian authority responsible for data protection issues is a collegiate body whose members are appointed by Parliament. That Law also lays down that the members must offer every guarantee that they can perform their tasks independently. Various measures are provided for to that end, including the ban on members being present when matters are discussed in which they have a personal interest.

The Commission would also reiterate that it is supporting research projects in the field of smart card security. Researchers Ross Anderson and Sergei Skorobogatov are involved in the G3CARD project (IST-1999-26328). This project has two objectives. In the first place, it is aimed at identifying all the attacks that can be made against a card (the flash attack is one example of the kind of attack addressed by this project). The second objective of the project is to develop a new generation of smart cards capable of resisting such new attacks.

The smart card has the advantage of greatly increasing the level of security of systems by making attacks both technically complex and cumbersome, and hence inaccessible to criminals for a certain length of time. It is, however, clear that new attacks will be discovered which will require the development of new generations of chips.

The level of GSM security was suited to the applications planned by the devisers of the standard some fifteen years ago, those applications relating essentially to telephony. The new standards for third-generation wireless telephones call for increased security with a view to allowing sensitive applications. Moreover, the security of wireless transactions will be one of the priority topics in the Community's 6th framework programme for research and technological development. At present, one of the objectives of the Embedded Finread research project (IST-2000-30091) is to transpose payment terminal security to wireless telephony, including the current GSM.

Other projects such as PKI Challenge (IST-2000-25012) and Digisec (IST-1999-20981) are working on developing the electronic signature and its corollary PKI infrastructure. The Nessie project (IST-1999-12324) is defining new cryptographic algorithms, while Verificard (IST-2000-26328) is concentrating on verifying the security of the software loaded on the card. Projects such as UFACE (IST-1999-11587) or BANCA (IST-1999-11159), for their part, are concentrating on the technical aspects of biometrics.

The Smartcities project (IST-1999-12252) is devoted to a city card. However, it has the advantage of inventing mechanisms to ensure data security. Smartcities considers that data protection will become a commercial argument, and its mechanisms could then be used by other projects.

(1) Directive 98/34/EC of the European Parliament and of the Council of 22 June 1998 laying down a procedure for the provision of information in the field of technical standards and regulations, OJ L 204, 21.7.1998.

(2) OJ L 77, 26.3.1973.

(3) OJ L 139, 23.5.1989.

(4) OJ L 281, 23.11.1995.

(5) OJ L 24, 30.1.1998 and OJ L 201, 31.7.2002.