<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Negonation Blog &#187; Identity</title>
	<atom:link href="http://blog.negonation.com/en/category/identity/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.negonation.com/en</link>
	<description>Justice is ripe for disruption</description>
	<lastBuildDate>Wed, 04 May 2011 18:43:31 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1.3</generator>
		<item>
		<title>Smart cards in Europe: EMV Avalanche</title>
		<link>http://blog.negonation.com/en/smart-cards-in-europe-emv-avalanche/</link>
		<comments>http://blog.negonation.com/en/smart-cards-in-europe-emv-avalanche/#comments</comments>
		<pubDate>Tue, 01 Apr 2008 19:49:06 +0000</pubDate>
		<dc:creator>David Blanco</dc:creator>
				<category><![CDATA[e-Signatures]]></category>
		<category><![CDATA[Identity]]></category>
		<category><![CDATA[Internet]]></category>

		<guid isPermaLink="false">http://blog.negonation.com/en/smart-cards-in-europe-emv-avalanche/</guid>
		<description><![CDATA[This is the third post in the series entitled &#8220;Smart cards in Europe&#8221;. In the introductory post, we affirmed that Europe is about to receive 1 billion &#8220;smart cards with strong authentication and digital signature capabilities&#8221; which have the potential to change the way we do electronic commerce. The source of the card avalanche is [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://blog.negonation.com/es/wp-content/uploads/2008/04/eu-y-emv.png" alt="Ready or not, here I come too" align="right" />This is the third post in the series entitled &#8220;Smart cards in Europe&#8221;. In the <a href="http://blog.negonation.com/en/smart-cards-in-europe-eid-avalanche/">introductory post</a>, we affirmed that Europe is about to receive 1 billion &#8220;smart cards with strong authentication and digital signature capabilities&#8221; which have the potential to change the way we do electronic commerce. The source of the card avalanche is two-fold:</p>
<ol>
<li><a href="http://blog.negonation.com/en/smart-cards-in-europe-eid-avalanche/">Smart cards issued by governments to identify their citizens (Electrionic Identification Cards: e-IDs).</a></li>
<li>Smart cards issued by banks to substitute magnetic strip cards (EMVs).</li>
</ol>
<p>This third post describes the second type. We&#8217;ve analysed the situation in 31 european countries (<a href="http://en.wikipedia.org/wiki/European_Union_member_state" target="_blank">EU-27</a> plus Liechtenstein, Iceland, Norway and Switzerland). This is what we&#8217;ve found:</p>
<blockquote><p><strong>In 2010, all European bank cards, some 590 million of them, will be smart cards (EMVs) with strong authentication and digital signature capabilities.<br />
</strong></p></blockquote>
<p>If you don&#8217;t believe us, read on:</p>
<h3>European banks that plan to launch EMV smart cards</h3>
<p>Short answer: all of them.</p>
<p>In 2000 the European Commission decided that to foster innovation (Lisbon Agenda) the single market must make it easier to move money around the EU. Specifically, cross-border payments should not cost more than domestic payments. In other words, you can use your bank card in another EU country and they won&#8217;t charge you any more commission to withdraw money as they do in your home country. This initiative is known as the Single Euro Payment Area or <a href="http://en.wikipedia.org/wiki/Single_Euro_Payments_Area">SEPA</a>. The SEPA zone encompasses 31 european countries (<a href="http://en.wikipedia.org/wiki/European_Union_member_state" target="_blank">EU-27</a> plus Liechtenstein, Iceland, Norway and Switzerland).<br />
<a href="http://en.wikipedia.org/wiki/Single_Euro_Payments_Area" target="_blank"><img src="http://blog.negonation.com/es/wp-content/uploads/2008/03/sepa.PNG" alt="sepa.PNG" /></a></p>
<p>To make SEPA a reality, all the EU banks need to agree on the same standards and implement the same procedures to ensure interoperability at the moment of accepting a card. To give an example, a cash machine (ATM) in Austria should be capable of accepting and understanding a card issued by an Italian bank. Said and done: the standard was developed by Europay, Mastercard and Visa and they called it <a href="http://en.wikipedia.org/wiki/EMV">EMV</a> (the initials of the three companies). EMV will mean that there will be no difference between national and transfers within Europe. EMV will make SEPA a reality &#8211; meaning cheaper payments and faster money transfers between countries in the eurozone.</p>
<p>The EMV standard is based on &#8220;Smart cards with a microprocessor chip&#8221; and this microprocessor chip is capable of storing not just financial applications (EMV) but also other types of application such as strong authentication and digital signature. As you can see, EMV cards are (or have the capability to be) similar in functionality to eID smart cards. The only difference is that they are issued by a bank instead of a government.</p>
<h3>EMV deployment phases in Europe</h3>
<p>The banks of these 31 countries are obliged by SEPA to migrate all their magnetic strip cards to EMV smart cards. They have from January 2008 to 31st December 2010 to do the migration.</p>
<p>Experts consider that most of these countries will have completed the migration to EMV by 2009, one year before the deadline:</p>
<ul>
<li>2006: United Kingdom has already completed 90-100%. France 50-90%. Rest 10-50%.</li>
<li>2007: United Kingdom and France will have completed 90-100%. Rest 50% to 90%.</li>
<li>2008: All will have completed 90-100%, except for Germany, which will have completed 50-90%.</li>
<li>2009: All will have completed 90-100% of migration to EMV.</li>
</ul>
<h3>Conclusions</h3>
<p>If you live in Europe, you will soon have an EMV smart card in your pocket.<br />
Europe is the undisputed leader at global level in EMV deployment (since 2002 &#8211; see slides 3 and 5 of <a href="http://globalplatform.org/presentations/toronto/07-Martyn-Global-Platform-Toronto.ppt" target="_blank">this presentation</a>). Europe has more than 50% of the total number of smart cards in the world (of the 590 million smart cards worldwide, 300 million are in Europe). Europe has more smart cards than magnetic strip cards (of the 587 million bank cards in Europe, 300 million are smart cards). The obligations imposed by SEPA on European banks mean that Europe will increase this lead.</p>
<p>We&#8217;re not saying that all EMV cards will be capable of digital signature (<a href="http://blog.negonation.com/en/smart-cards-in-europe-eid-avalanche/">like the majority of eID cards</a>). We are saying that (1) if the banks want to use it, the technology is there and (2) many do plan on using it. In our conversations with the main card issuers in Spain, the majority have plans to incorporate signature certificates in the chips. The objective is that the client identifies his/her self and signs online with a card and the look and feel of the bank. Once the adverts start, it&#8217;s difficult to imagine the rest of the banks failing to offer the same functionality.</p>
<h3>EMV around the world</h3>
<p>Europe is not alone: Banks in various countries are migrating their magnetic strip cards to EMV smart cards (Turkey, Brazil, Taiwan, Japan, Malaysia etc.).</p>
<p>As of year-end 2006 there were 3 billion bank cards in circulation. Of these, between 515 (source: GIA Cartes Bancaires) and 590 million (source: Deutsche Bank) were microprocessor smart cards:</p>
<ul>
<li>Europe: 300 million smart cards.</li>
<li>Asia/Pacific: 150 million smart cards.</li>
<li>South America: 140 million smart cards.</li>
<li>USA: Has no EMV-compliant cards and, as with e-ID cards, is reluctant to introduce them.</li>
</ul>
<p>Given the benefits of smart cards, it is just a matter of time before banks around the world change from magnetic strip to smart cards. The growth potential in this sector lies in the prospective migration of the 2.5 billion magnetic strip cards in circulation. Deutsche Bank estimates smart card growth of 18% CAGR in the payments industry between 2006 and 2010. In 2006 430 million smart cards were sold &#8211; 12% penetration, with France and Germany leading the way. In 2007 544 million were expected to have been sold (34% attributable just to EMV migration). In 2010, 600 million smart cards are expected to be sold every year with 26% penetration.</p>
<blockquote><p><strong><em>By 2010 there will be 830 million EMV cards in Europe, Asia and Latin America.</em></strong></p></blockquote>
<p>Something is changing, don&#8217;t you think?</p>
<p>Next post (and the last in the series): &#8220;Smart cards in Europe: Conclusions&#8221;.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.negonation.com/en/smart-cards-in-europe-emv-avalanche/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Smart Cards in Europe: eID Avalanche</title>
		<link>http://blog.negonation.com/en/smart-cards-in-europe-eid-avalanche/</link>
		<comments>http://blog.negonation.com/en/smart-cards-in-europe-eid-avalanche/#comments</comments>
		<pubDate>Sat, 29 Mar 2008 20:14:34 +0000</pubDate>
		<dc:creator>David Blanco</dc:creator>
				<category><![CDATA[e-Signatures]]></category>
		<category><![CDATA[Identity]]></category>
		<category><![CDATA[Internet]]></category>

		<guid isPermaLink="false">http://blog.negonation.com/en/smart-cards-in-europe-eid-avalanche/</guid>
		<description><![CDATA[This is the second in a collection of posts titled &#8220;Smart Cards in Europe&#8221;. In the introductory post we said that Europe is about to receive 1 billion &#8220;Smart Cards capable of strong authentication and digital signatures&#8221;. An event which has the potential to transform the way we do e-commerce. The origin of this avalanche [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://blog.negonation.com/es/wp-content/uploads/2008/04/eu-y-eid.png" alt="Ready or not, here I come" align="right" />This is the second in a collection of posts titled &#8220;Smart Cards in Europe&#8221;. In the introductory post we said that Europe is about to receive 1 billion &#8220;Smart Cards capable of strong authentication and digital signatures&#8221;. An event which has the potential to transform the way we do e-commerce. The origin of this avalanche is two-fold:</p>
<ol>
<li>Smart Cards issued by governments in order to identify their citizens (&#8220;Electronic IDentification Cards&#8221; or &#8220;e-IDs&#8221;).</li>
<li>Smart Cards issued by banks to replace magnetic strip bank cards (&#8220;EMVs&#8221;).</li>
</ol>
<p>This second post focus on the first case. We have analyzed the current status of e-ID implementations in 32 European countries, representing 565 million people (source: <a href="http://epp.eurostat.ec.europa.eu/portal/page?_pageid=0,1136162,0_45572082&amp;_dad=portal&amp;_schema=PORTAL">Eurostat</a>). Our findings can be summarized as follows:</p>
<blockquote><p><strong>By 2010, 437 million people (82% of the European population) will live in countries with electronic ID cards (e-IDs).</strong></p></blockquote>
<p>If you don&#8217;t believe us, keep on reading:</p>
<h3>       <strong>Countries in Europe that already have an e-ID scheme</strong></h3>
<p>Ten countries, representing 153 million inhabitants (27% of the European population):</p>
<ol>
<li>         <strong>Spain</strong> (44,474,600): Spain started to introduce an e-ID sheme (<em>           <a href="http://www.dnielectronico.es/">DNI electrónico</a>         </em>) in March 2006. As of November 2007 <a href="http://www.diariodenavarra.es/actualidad/noticia.asp?not=2007110215245417&amp;dia=20071102&amp;seccion=nacional&amp;seccion2=politica">a total of 1,500,000 e-IDs had been issued</a>. <a href="http://www.dnielectronico.es/oficina_prensa/noticia_destacada/mapa_prov_mapeado.html">From December 2007 e-IDs will be issued throughout Spain</a>. Projections are: 6.5 million e-IDs issued by December 2008 and 18 million by December 2009. Besides the electronic ID, Spain also has <a href="http://www11.mityc.es/prestadores/busquedaPrestadores.jsp">14 commercial certification authorities</a> (lawyers, notaries, registrars, regional governments, banks, etc.). See also <a href="http://negonation.com/wiki/index.php?title=Image:Dnie_descrip.jpg">physical description</a>, <a href="http://www.elpais.es/fotogalerias/popup_animacion.html?xref=20060310elpepunac_1">demo</a> and <a href="http://www.youtube.com/watch?v=XvhxLtOn5AM">video</a> of the DNIe.</li>
<li>         <strong>Italy</strong> (58,751,711): Having completed two experimental phases in 2003 and 2004, Italy is currently deploying its <em>Carta d’identità elettronica</em> (CIE). By October 2005 <a href="http://www.epractice.eu/document/718">2 million CIEs</a> had been issued. The aim is to replace 40 million conventional ID cards by 2011 at a rate of 8 million per year. Apart from the CIE, Italy has <a href="http://www.cnipa.gov.it/site/it-IT/Attivit%C3%A0/Certificatori_accreditati/Elenco_certificatori_di_firma_digitale/Certificatori_attivi/">19 commercial certification authorities</a>.</li>
<li>         <strong>Portugal</strong> (10,569,600): Following the <a href="http://www.epractice.eu/document/123">initial introduction of e-ID cards in February 2007</a>, Portugal is preparing to start a full-scale rollout in 2008 and expects to issue 2 million <em>           <a href="http://www.cartaodocidadao.pt/">Cartão de Cidadão</a>         </em> per year. By July 2008 <a href="http://www.epractice.eu/document/3765">the new e-ID should be available throughout the country</a>. Portugal also has <a href="http://www.multicert.pt/">1 commercial certification authority</a>.</li>
<li>         <strong>Belgium</strong> (10,511,400): Belgium started deployment of its <a href="http://eid.belgium.be/en/navigation/12000/index.html">           <em>eID</em>         </a> in September 2004. To date, <a href="http://www.ibz.rrn.fgov.be/index.php?id=597&amp;L=0">6,500,000 <em>eIDs</em> have been issued</a>. Plans are to reach <a href="http://eid.belgium.be/en/navigation/36118/index.html">8,000,000 by December 2009</a>. Belgium has <a href="http://www.mineco.fgov.be/information_society/e-signatures/list_e_signature_nl.pdf">2 commercial certification authorities</a>. The Belgian government also issues e-IDs to minors and non-nationals.</li>
<li>         <strong>Sweden</strong> (9,047,800): Sweden began to introduce its <em>           <a href="http://www.polisen.se/inter/nodeid=33378&amp;pageversion=1.html">nationellt identitetskort</a>         </em>in October 2005. So far, some <a href="http://www.epractice.eu/document/3494">3,000,000 e-IDs have been issued</a> (almost all in software format). Sweden is a special case in that e-IDs are not issued by the government but by <a href="http://www.avropa.nu/templates/ramavtalsomrade____224.aspx">authorized companies</a> (banks, system integrators, etc.).</li>
<li>         <strong>Austria</strong> (8,265,900): The rollout started in 2000 and is already complete. There are some 8,000,000 <em>           <a href="http://www.buergerkarte.at/">Bürgerkarte</a>         </em> (citizen cards) in circulation. An original feature in this case is that there is no &#8220;one&#8221; type of e-ID: an e-ID <a href="http://www.digitales.oesterreich.gv.at/site/5268/default.aspx#a1">can be stored in government-issued cards, bank cards or SIM cards</a>.</li>
<li>         <strong>Finland</strong> (5,255,580): The Finnish e-ID, or <a href="http://www.fineid.fi/en">           <em>FINEID</em>         </a>,  like the Austrian one, can be stored in smart cards, bank cards or SIM cards. It was launched in 1999 but did not include an electronic signature until 2004. The Finnish government announced plans to issue around <a href="http://www.digitales.oesterreich.gv.at/site/5268/default.aspx#a1">135,000 FINEIDs by the end of 2007</a>. Citizens who so wish may include their health insurance information in their FINEID.</li>
<li>         <strong>Estonia</strong> (1,344,700): Estonia is probably the most advanced country in Europe in the adoption of electronic signatures by the general population. The Estonian <a href="http://www.pass.ee/2.html">           <em>ID-Card</em>         </a> was launched in January 2002 and today is used by more than 1,000,000 citizens (<a href="http://www.epractice.eu/document/295">almost 90% of the population</a>). The Estonian government is working to create a Mobile-ID, so that the certificate can be stored in mobile devices.</li>
<li>         <strong>Norway</strong> (4,770,000): <a href="http://www.epractice.eu/document/3557">Norway&#8217;s main commercial certification authorities</a> are Telenor and the banks. Norwegians can obtain their e-ID from lottery offices, social security offices and banks. The certification authorities responsible for issuing certificates are <a href="http://www.zebsign.no/">ZebSign</a> and <a href="http://www.bankid.no/">BankID</a>.</li>
<li>         <strong>Iceland</strong> (307,700): The Icelandic government has reached an agreement with the banks under which all debit cards issued after the end of 2007 will incorporate government e-IDs.</li>
</ol>
<h3>       <strong>Countries in Europe that are planning to launch e-IDs in 2008</strong></h3>
<p>Eight countries, representing 184 million inhabitants (32% of the European population):</p>
<ol>
<li>         <strong>Germany</strong> (82,438,000): Germany has declared <a href="http://www.epractice.eu/document/3359">on</a>         <a href="http://www.enisa.europa.eu/doc/pdf/Workshop/June2007/authentication_ws.pdf">various</a>         <a href="http://ec.europa.eu/idabc/servlets/Doc?id=29077">occasions</a> that it intends to deploy its <em>Digital IDCard</em> in 2008, which will include the <a href="http://www.epractice.eu/document/4441">ability to use pseudonyms online</a>. Germany has <a href="http://www.bundesnetzagentur.de/enid/Elektronische_Signatur/Zertifizierungsdiensteanbieter_ph.html">8 commercial certification authorities</a>.</li>
<li>         <strong>France</strong> (62,518,600): After various delays (to incorporate feedback from the public), France has stated its intention to put its <em>Identité Nationale Electronique Sécurisée</em>         <a href="http://www.cites-numeriques.fr/CARTIDELEC.pdf">(INES) into effect in 2008</a>. The plan is to include electronic signatures, although <a href="http://www.epractice.eu/document/3350">the first generation of cards may not have this functionality</a>. France has <a href="http://www.net-entreprises.fr/Html/certificat.htm">11 commercial certification authorities</a>.</li>
<li>         <strong>Netherlands</strong> (16,357,992): The Dutch<em>           <a href="http://www.digid.nl/">DigiD</a>         </em> service offers three levels of security: low (username &amp; password), medium (SMS authentication) and high (on-card PKI). So far, 6 million citizens use low DigiD for authentication, while 2 million use medium DigiD. The high-security DigiD, known as <a href="http://matrix.e-overheid.nl/row.aspx?matrixid=product&amp;rowid=23&amp;view=ICTU-basis">           <em>eNIK</em>         </a>, may be introduced in 2008. The Netherlands has <a href="http://ec.europa.eu/information_society/eeurope/2005/all_about/security/esignatures/index_en.htm#netherlands">4 commercial certification authorities</a>.</li>
<li>         <strong>Hungary</strong> (10,076,600): Requirements and <a href="http://www.itktb.hu/engine.aspx?page=ias">specifications</a> for the development of the Hungarian e-ID, <em>HUNEID</em>, and its prototype implementation were published at the end of 2004. Introduction is expected in January 2008.</li>
<li>         <strong>Bulgaria</strong> (7,679,200): Following the <a href="http://www.sofiaecho.com/article/a-solution-to-id-fraud-in-bulgaria/id_22539/catid_23">optimistic government announcement</a> that issuance of e-IDs would start in 2007, the rollout is now expected to start in 2008. The Bulgarian Government owns <a href="http://www.is-bg.net/site_io/?cat=108#content_1">1 commercial certification authority</a>, which is authorized to issue digital certificates to citizens.</li>
<li>         <strong>Latvia</strong> (2,291,000):  Following the passing of <a href="http://www.likumi.lv/doc.php?id=87685">e-ID regulations</a> by the Latvian Council of Ministers, the introduction of e-IDs is <a href="http://www.epractice.eu/document/3404">scheduled for 2008</a>. Latvia has <a href="http://info.e-me.lv/en/">1 commercial certification authority</a>.</li>
<li>         <strong>Slovenia</strong> (2,003,400): The Slovenian e-ID project was officially launched in February 2003 but was then suspended. A <a href="http://www.epractice.eu/document/3476">fresh start is expected in 2007-2008</a>. Slovenia has <a href="http://www.epractice.eu/document/3404">4 commercial certification authorities</a>.</li>
<li>         <strong>Malta</strong> (404,346): Malta is taking a four-pronged approach to the deployment of electronic IDs. The third phase started in 2007. All that remains is the fourth stage, which includes the <a href="http://www.epractice.eu/document/99">issue of e-ID cards</a>. <a href="http://ec.europa.eu/information_society/eeurope/2005/all_about/security/esignatures/index_en.htm#malta">Everything</a> suggests this <a href="https://www.cosic.esat.kuleuven.be/modinis-idm/twiki/bin/view.cgi/Main/MalteseProfile?skin=print.pattern">could happen in 2008</a>.</li>
</ol>
<h3>       <strong>Countries that are planning to launch e-ID schemes after 2008</strong></h3>
<p>Seven countries, representing 134 million inhabitants (23% of the European population):</p>
<ol>
<li>         <strong>United Kingdom</strong> (60,393,100): The <a href="http://www.ips.gov.uk/identity/scheme.asp">National Identity Scheme</a> is currently under development by the UK Identity and Passport Service (IPS). Its main goal is to introduce e-ID cards in the UK. <a href="http://www.ips.gov.uk/identity/press-2007-08-09.asp">Procurement of e-ID cards has already started</a> and <a href="http://www.securitydocumentworld.com/public/news.cfm?&amp;m1=c_10&amp;m2=c_6&amp;m3=e_0&amp;m4=e_0&amp;subItemID=1163">suppliers will be selected in May 2008</a>. The <a href="http://www.epractice.eu/document/3512">first e-IDs are expected to be issued to British citizens in 2009</a>         <a href="http://www.epractice.eu/document/4107">or 2010</a>. The United Kingdom also has <a href="http://ec.europa.eu/information_society/eeurope/2005/all_about/security/esignatures/index_en.htm#uk">4 commercial certification authorities</a>.</li>
<li>         <strong>Ireland</strong> (4,209,000): <a href="http://www.epractice.eu/document/3386">In June 2004 the Irish government established the framework</a> for <em>Public Service Cards</em>(PSC), which will be used for authentication and electronic identification. Following Portugal&#8217;s example, the PSC will include a range of functions (social services, medical card, etc.).</li>
<li>         <strong>Poland</strong> (38,518,241): Poland is <a href="http://www.epractice.eu/document/3440">studying the possibility of introducing an e-ID card</a>, known as a <em>Multifunctional Personal Document</em> (MPD), to replace a variety of identity cards. <a href="http://ec.europa.eu/idabc/servlets/Doc?id=29093">Poland is aware of the need for an e-ID</a> and is undecided whether to set up a new state-owned CA to issue MPDs or to delegate the role to commercial CAs. Changes in the law are needed. Poland has <a href="http://ec.europa.eu/information_society/eeurope/2005/all_about/security/esignatures/index_en.htm#poland">4 commercial certification authorities</a>.</li>
<li>         <strong>Romania</strong> (21,610,200): Romania has started to work on e-IDs and biometric passports and <a href="http://www.epractice.eu/document/3458">has already issued an international invitation to tender for these projects</a>. Romania has <a href="http://ars.mcti.ro/">5 commercial certification authorities</a>.</li>
<li>         <strong>Slovakia</strong> (5,389,100): <a href="http://www.epractice.eu/document/3467">The Slovakian government has plans to introduce e-IDs</a> (called &#8220;BIFO&#8221;) and passports. Slovakia has <a href="http://www.nbusr.sk/en/electronic-signature/ca-list/index.html%20%20">9 commercial certification authorities</a>. Since March 2007, <a href="http://www.epractice.eu/document/251">Slovakian citizens holding a digital certificate have had 1,000 &#8220;contact points&#8221;</a> where they can sign electronically.</li>
<li>         <strong>Lithuania</strong> (3,403,300): No e-IDs have been issued as yet, but the government is treating e-IDs as a priority. The Lithuanian e-ID will be multifunctional (government, health, loyalty programs, tickets, etc.). <a href="http://www.epractice.eu/document/3413">It is thought that it could be launched in 2009-2010</a>. Lithuania has <a href="http://www.ssc.lt/">1 commercial certification authority</a>. To popularize electronic signatures, <a href="http://www.epractice.eu/document/160">the government will issue 300,000 certificates to citizens</a> completely free of charge before 2009.</li>
<li>         <strong>Cyprus</strong> (766,414): The government of Cyprus has stated its <a href="http://www.epractice.eu/document/3305">intention to issue e-IDs</a> but has provided no further information.</li>
</ol>
<h3>       <strong>Countries that have no plans to launch e-ID schemes but that have commercial certification authorities</strong></h3>
<p>Three countries, representing 83 million inhabitants (14% of the European population):</p>
<ol>
<li>         <strong>Turkey</strong> (72,500,000): Turkey has <a href="http://ec.europa.eu/idabc/servlets/Doc?id=29099">3 commercial certification authorities</a>.</li>
<li>         <strong>Czech Republic</strong> (10,251,790): The Czech Republic has <a href="http://ec.europa.eu/idabc/servlets/Doc?id=29074">3 commercial certification authorities</a>.</li>
<li>         <strong>Luxembourg</strong> (480,222): Luxembourg has <a href="https://www.luxtrust.lu/%20%20%20%20">1 commercial certification authority</a>.</li>
</ol>
<h3>       <strong>Countries that have no plans to launch e-ID schemes and no commercial certification authorities</strong></h3>
<p>Four countries, representing 21 million inhabitants (4% of the European population):</p>
<ol>
<li>         <strong>Greece</strong> (11,125,200): The Greek government has plans to create 5 government-owned certification authorities.</li>
<li>         <strong>Denmark</strong> (5,427,400).</li>
<li>         <strong>Croatia</strong> (4,442,803).</li>
<li>         <strong>Liechtenstein</strong> (34,905).</li>
</ol>
<h3>Conclusion</h3>
<p>In Europe, in terms of population:</p>
<ul>
<li>27% of the population of the 32 European countries lives in a country that has an e-ID scheme (at varying stages of implementation).</li>
<li>32% lives in a country that is planning to launch e-IDs in 2008.</li>
<li>23% lives in a country that is planning to launch e-IDs after 2008.</li>
<li>14% lives in a country that has no plans to launch e-IDs but that does have commercial certification authorities.</li>
<li>4% lives in a country that has no plans to launch e-IDs and no commercial CAs.</li>
</ul>
<p>Europe is not alone: Various countries have started issuing national identity cards in the form of e-ID smart cards (China, Qatar, Morocco, Thailand, Hong Kong, Oman, etc.). Some are planning to do so in the near future (Peru, Argentina, Brazil, Mexico, etc.). Others are considering the possibility (U.S.A., Russia, etc.). Although eID is a small segment of the overal smart card market, all the experts agree that it has the strongest growth prospects (21% CAGR) and is likely to grow dramatically over the next few years. Of all the emerging new applications of smart cards this is the largest market because the number of ID cards in circulation (worldwide, 1 in 2 people has an ID card, i.e. 3 trillion IDs) is much greater than the number of passports (1 in 10 people), transport cards (1 in 3), or driving licenses. According to the  “Deutsche Bank Smart Cards report 2007″, e-ID smart cards  in the &#8220;Other: Government ID, Passport, Health, Transport&#8221; category had 7% penetration worldwide in 2006. Projections are that an average of 400 million e-ID smart cards will be issued each year, reaching 17% penetration in 2010. If these projections are met:</p>
<blockquote><p><strong>In 2015, 84% of people with an ID will have an e-ID.</strong></p></blockquote>
<p>Something is changing, don&#8217;t you think?</p>
<p>Next post: <a href="http://blog.negonation.com/en/smart-cards-in-europe-emv-avalanche/">Smart Cards in Europe: EMV Avalanche</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.negonation.com/en/smart-cards-in-europe-eid-avalanche/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Smart cards in Europe: Introduction</title>
		<link>http://blog.negonation.com/en/smart-cards-in-europe-introduction/</link>
		<comments>http://blog.negonation.com/en/smart-cards-in-europe-introduction/#comments</comments>
		<pubDate>Tue, 25 Mar 2008 22:59:09 +0000</pubDate>
		<dc:creator>David Blanco</dc:creator>
				<category><![CDATA[e-Signatures]]></category>
		<category><![CDATA[Identity]]></category>
		<category><![CDATA[Internet]]></category>

		<guid isPermaLink="false">http://blog.negonation.com/en/smart-cards-in-europe-introduction/</guid>
		<description><![CDATA[&#160; Today we start a new series of posts entitled &#8220;Smart cards in Europe&#8221;. Our intention is to describe the avalanche of cards are set to arrive in Europe in the next 5 years, signal the magnitude of the phenomenon that promises/threatens to transform literally the way we do electronic commerce and propose a realistic [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://blog.negonation.com/es/wp-content/uploads/2008/04/eu.png" alt="Ready or not..." align="right" /></p>
<div class="comment-body David Blanco">&nbsp;</p>
<blockquote><p>Today we start a new <strong>series of posts entitled &#8220;Smart cards in Europe&#8221;. </strong></p>
<p>Our intention is to describe the avalanche of cards are set to arrive in Europe in the next 5 years, signal the magnitude of the phenomenon that promises/threatens to transform literally the way we do electronic commerce and propose a realistic strategy to prevent this change corrupting the Internet that we all love.</p>
</blockquote>
</div>
<h3>What is a smart card?</h3>
<p>It is a card, similar to a credit card, that includes a chip/microcomputer capable of executing different types of applications including &#8220;authentication&#8221; and &#8220;digital signature&#8221;.</p>
<p>This is a smart card issued by the Portugese government:</p>
<p><a href="http://blog.negonation.com/en/?attachment_id=336" target="_blank" rel="attachment wp-att-336" title="smarcard-eid.gif"><img src="http://blog.negonation.com/es/wp-content/uploads/2008/04/smarcard-eid.gif" alt="smarcard-eid.gif" /></a></p>
<p>This is a smart card issued by a Belgian bank:</p>
<p><a href="http://blog.negonation.com/en/?attachment_id=337" target="_blank" rel="attachment wp-att-337" title="smartcard-emv.jpg"><img src="http://blog.negonation.com/es/wp-content/uploads/2008/04/smartcard-emv.jpg" alt="smartcard-emv.jpg" /></a></p>
<p>This is a smart card issued by a German telecommunications firm:</p>
<p><a href="http://blog.negonation.com/en/?attachment_id=338" target="_blank" rel="attachment wp-att-338" title="smartcard-mobile.jpg"><img src="http://blog.negonation.com/es/wp-content/uploads/2008/04/smartcard-mobile.jpg" alt="smartcard-mobile.jpg" /></a></p>
<p>The main idea: many different organizations in many different companies issue many different smart cards.</p>
<p>There are two types of smart card, depending on the type of chip:</p>
<ul>
<li>         <em>Smart card with memory chip</em>: cheaper. Contain only non-volatile memory, perform a single function and don&#8217;t process data. Not capable of performing digital signature. Used predominantly in transport, PayTV, corporate security, pre-paid telephones, loyalty programs etc. This type of card is becoming obsolete. They represent 4% of the market (by value) and demand is increasing but only in single-digit figures.</li>
<li>         <em>Smart card with microprocessor chip</em>: more expensive. They are a type of mini-computer that includes processor, memory and an operating system on the chip. Can be single- or multi-application, in which case, the microprocessor is capable of running different applications, including authentication and digital signature. Predominately used in government (&#8220;e-IDs&#8221;), banking (&#8220;EMV&#8221;) and telecommunications (&#8220;SIM&#8221;), health etc. applications. Microprocessor cards represent the future of smart cards. They are applicable to a wide range of sectors, a large part of which are in the early phases of development. They represent 96% of the market (by value) and demand keeps rising.</li>
</ul>
<h3>Why should I care?</h3>
<p>Because a <strong>smart card with a microprocessor chip allows strong authentication (verification of identity) and digital signature</strong>. Both (authentication and signature) are extremely powerful tools which will soon become ubiquitous. The massive deployment of smart cards with authentication and digital signature have the potential to change the way we interact on the Internet, do electronic commerce and how we deal with anonymity and privacy online.</p>
<p>And there&#8217;s more. Europe, for technological and legislative reasons, is at the centre of the tsunami:</p>
<ol>
<li><em>Technology</em>: Europe has (and will have) the highest concentration of smart cards capable of digital signature in the world. It&#8217;s not just that Europe has more than 50% of the smart cards in the world (300 million according to “Deutsche Bank Smart Cards report 2007″) but also that, as we&#8217;ll demonstrate in this series of posts, it is about to receive <strong>1 billion smart cards</strong> with microprocessors issued by governments and banks.</li>
<li><em>Legislation</em>: European directive 1999/93/CE on digital signature names &#8220;qualified digital signature&#8221; as the most advanced form of digital signature and gives it the same effect as a hand-written signature. For a digital signature to have &#8220;qualified&#8221; status, it should be generated by a &#8220;Secure Signature Creation Device&#8221; like, for example (you&#8217;ve guessed it) the chip on a smart card. And yes, you read that correctly &#8211; &#8220;the same effect as a hand-written signature&#8221;. So, the discussions as to whether the technology is secure or not are irrelevant. The law, by default, assumes that it is. If one of the parties denounces the signature, they bear the responsibility of proof i.e. they must demonstrate that the technology and processes used in the qualified digital signature were not secure (<em>I&#8217;ll save you the suspense&#8230;no one is going to do this</em>). A technology blessed by the law. Checkmate. End of discussion. <a href="https://www.tractis.com/contracts/490915454">We&#8217;ve studied 30 countries </a> (the <a href="http://en.wikipedia.org/wiki/European_Union_member_state" target="_blank">EU-27</a> plus Croatia, Turkey and Liechtenstein) and they&#8217;ve all implemented the directive. In summary, Europe enjoys <strong>uniform &#8220;qualified digital signature&#8221; legislation</strong> that gives the same power to digital signatures as hand-written ones. <em> </em></li>
</ol>
<p>The massive deployment of smart cards with digital signature backed up by the law promises great benefits (more agile relationships with government, secure electronic commerce, lower bank commissions&#8230;) but also <strong>serious implications for your rights and liberties as a citizen and consumer</strong>. Surprisingly, whether it&#8217;s for lack of knowledge, incredulity or voluntary blindness, this matter is not receiving the attention it deserves from the internet community.</p>
<p>We all know what happens when you don&#8217;t make a decision: reality decides for you.</p>
<h3>Why is no one talking about this?</h3>
<p>There are three reasons:</p>
<ol>
<li>Whether we like it or not, the &#8220;conscience&#8221; of the internet, the A-list bloggers, the main thinkers and analysers of the net are in the USA. Whether we like it or not, europeans typically echo the movements, initiatives and debates that are generated in the USA and there they don&#8217;t know, understand or care what happens in Europe.</li>
<li>The majority of Europeans think that this is nothing new. Smart cards have been in circulation for years and nothing bad has happened. They don&#8217;t understand that they are thinking of smart cards with memory chips and not the microprocessor type. They look the same from the outside but inside they&#8217;re not.</li>
<li>Many people doubt that &#8220;digital signature&#8221; will be widely adopted. Digital signature and Public Key Infrastructure (PKI) have been around many years and nothing bad has happened. They don&#8217;t realise that it hasn&#8217;t worked until now for business not technological reasons. Before there was no business case: no company was willing to assume the cost of issuing digital signature cards to their employees, providers and clients. Now that the costs have fallen, European governments have decided to assume this responsibility and oblige the banks to do the same.</li>
</ol>
<p>This time it&#8217;s serious. The ball is in our court.</p>
<p>Next post: &#8220;<a href="http://blog.negonation.com/en/smart-cards-in-europe-eid-avalanche/">Smart cards in Europe: e-ID avalanche</a>&#8220;.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.negonation.com/en/smart-cards-in-europe-introduction/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>A preview of the Tractis API</title>
		<link>http://blog.negonation.com/en/a-preview-of-the-tractis-api/</link>
		<comments>http://blog.negonation.com/en/a-preview-of-the-tractis-api/#comments</comments>
		<pubDate>Wed, 31 Oct 2007 20:15:19 +0000</pubDate>
		<dc:creator>David García</dc:creator>
				<category><![CDATA[Announcements]]></category>
		<category><![CDATA[Identity]]></category>
		<category><![CDATA[Programming]]></category>
		<category><![CDATA[Tractis]]></category>

		<guid isPermaLink="false">http://blog.negonation.com/en/a-preview-of-the-tractis-api/</guid>
		<description><![CDATA[We&#8217;re working to launch the Tractis API in the middle of November. The API will allow you to connect directly with our back-end and use digital certificates to authenticate your users, store documents, digitally sign contracts and lots more besides. The back-end Tractis services are organized into three groups according to purpose: identity services, document [...]]]></description>
			<content:encoded><![CDATA[<p>We&#8217;re working to launch the Tractis API in the middle of November. The API will allow you to connect directly with our back-end and use digital certificates to authenticate your users, store documents, digitally sign contracts and lots more besides.</p>
<p>The back-end Tractis services are organized into three groups according to purpose: identity services, document management services and digital signature services.</p>
<p><a href="http://blog.negonation.com/es/wp-content/uploads/2007/10/tractis-backend-big.png"><img alt="tractis-backend-small.png" id="image235" src="http://blog.negonation.com/es/wp-content/uploads/2007/10/tractis-backend-small.png" /></a></p>
<h3>Externally accessible services</h3>
<h4>1. Identity services:</h4>
<ul>
<li><u>Identity Federation Server</u>: Allows single sign-on to Tractis services. A typical use-case is where a customer of a Tractis organization uses multiple services but only has to identify themselves once (to the user organization).</li>
<li><u>Identity and Attribute Authority</u>: Allows the management, certification and verification of attributes of individuals and organizations</li>
<ul>
<li>Management: Allows definition of access control on different attributes, according to their nature.</li>
<li>Certification: Allows connections to 3rd party attribute repositories and the presentation of challenges of the holders of an identity (example: authentication using personal certificates issued by a trusted authority).</li>
<li>Verification: Allows the lookup of information stated by the user (phone number, address etc.).</li>
</ul>
</ul>
<h4>2. Document management services:</h4>
<ul>
<li><u>Contract Management System</u>: Allows complete contract lifecycle management.</li>
<li><u>Long-term Archive</u>: Allows long-term storage of documents, guaranteeing their future reproducibility, integrity and authenticity.</li>
</ul>
<h4>3. Digital signature services:</h4>
<ul>
<li><u>Semantic Validation Authority</u>: Verifies the validity of electronically signed documents from a legal and technical point of view. Supports advanced digital signatures based on the AdES format.</li>
</ul>
<p>The &#8220;Evidence Manager&#8221; acts above all these services. It stores and preserves evidence for future investigative processes. The evidence manager allows us to show evidence to 3rd parties with regarding the operations performed by the different services.</p>
<h3>Internal-only services</h3>
<p>As you can see from the diagram, all these services use a series of internal components to guarantees (integrity, durability etc.) all operations performed by the platform.</p>
<ul>
<li><u>Time Stamping Authority:</u> Applies time stamps to electronic documents, permitting demonstration of document content at a given moment in time.</li>
<li><u>Trusted Time Sources</u>: Providers of Date/Time information synchronized through multiple channels (i.e. internet, phone&#8230;) with official sources of time such as the Real Observatorio de la Armada (Spanish Royal Navy Observatory) &#8211; official time in Spain.</li>
<li><u>Attribute Repository</u>: Allows storage of user attributes and roles (responsibility, membership of professional organizations&#8230;) and makes them available them to the applications that request for them.</li>
</ul>
<p>Finally, Tractis integrates with Certification Authorities around the world.</p>
<h3>Why use this functionality?</h3>
<p>We are going to open up the functionality progressively. Initially, we&#8217;ll open parts of the &#8220;Identity and Attribute Authority&#8221; and the &#8220;Contract Management System&#8221;, which will allow:</p>
<ol>
<li>Authenticating users via digital certificates (Spanish electronic ID card &#8211; <a target="_blank" href="http://www.dnielectronico.es/oficina_prensa/noticia_destacada/noticia_new.html">DNIe</a> &#8211; included), free of charge, from your website.</li>
<li>Automating the bulk sending of personalized contracts to your customers, asking for their digital signature.</li>
</ol>
<p>All these services will be offered remotely by Tractis. You don&#8217;t need to develop, install, configure or maintain an infrastructure valued in millions of euros that is within reach of only the biggest banks. You only need <a href="http://www.tractis.com/signup">a Tractis account</a> and to integrate with the API.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.negonation.com/en/a-preview-of-the-tractis-api/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The end of legislative islands</title>
		<link>http://blog.negonation.com/en/the-end-of-legislative-islands/</link>
		<comments>http://blog.negonation.com/en/the-end-of-legislative-islands/#comments</comments>
		<pubDate>Sat, 06 Jan 2007 12:50:08 +0000</pubDate>
		<dc:creator>David Blanco</dc:creator>
				<category><![CDATA[Business]]></category>
		<category><![CDATA[Identity]]></category>
		<category><![CDATA[Justice]]></category>
		<category><![CDATA[Tractis]]></category>

		<guid isPermaLink="false">http://blog.negonation.com/en/we-live-in-a-world-of-legislative-islands/</guid>
		<description><![CDATA[A huge problem for the Internet nation Most of us don&#8217;t mind buying something on eBay for 20, 30, 40, or 50 euros/dollars but when it&#8217;s more than that&#8230;we think it twice. The reason is because we know that if something goes wrong, there&#8217;s little we can do about it. We don&#8217;t know the other [...]]]></description>
			<content:encoded><![CDATA[<h3>A huge problem for the Internet nation</h3>
<p>Most of us don&#8217;t mind buying something on eBay for 20, 30, 40,  or 50 euros/dollars but when it&#8217;s more than that&#8230;we think it twice. The reason is because we know that if something goes wrong, there&#8217;s little we can do about it. We don&#8217;t know the other party’s identity, where they live or the law in their country. And even if we knew, we&#8217;d probably do nothing about it. We live in a world of legislative islands. Traditional justice is slow, expensive, and complex. It is an inefficient system. No wonder why so many people think it&#8217;s not worth facing such a nightmare to recover such sums. Fear, lack of recourse&#8230; the end result is that millions of transactions every year never actually happen. The hidden treasure of eCommerce. An unrealised potential. eCommerce, as we know it now, is a shadow of what it really could be.</p>
<p>We have been talking about this problem for ages, however an answer has never been found yet. It&#8217;s a hairy problem with different names and different faces: authentication, lack of recourse, non-legally binding contracts and, lately, <a target="_blank" href="http://www.technorati.com/search/identity+2.0%20AND%20identity">identity 2.0</a>. People mistake contract validity with contract enforcement. Anyone can open an e-mail account with Yahoo and click on the &#8220;I accept Terms and Conditions&#8221; button. It&#8217;s a valid contract, but you are going to have a hard time trying to enforce it in the real world, in front of a real court of law. Who clicked on the button? From where? Was it you from this particular IP, or was it someone else surfing via a proxy? That’s not a contract, it&#8217;s a joke!.</p>
<p>At Tractis, we believe that slow, expensive and complex justice is not real justice. A world of legislative islands is OK for big companies with strong international presence, loads of time, money and expert lawyers; but it&#8217;s useless for an individual or <abbr lang="en" title="Small and Medium Business">SMB</abbr>. We believe that when online agreements become a joke, you are losing business and money. We&#8217;re committed to find a solution. Tractis allows you to negotiate and sign <u><strong>online contracts that you can actually enforce</strong></u> in the real world.</p>
<h3>Interfacing technologies and legislations</h3>
<p>Tractis technology is capable of processing digital certificates issued by any certification authority, it being a government (i.e: spanish national ID card), a private company (i.e. Verisign), or a professional association (i.e. Bar Association). And we are not only talking about <abbr lang="en" title="Public Key Infrastructure">PKI</abbr>, we&#8217;re actually opening Tractis to any authentication method: mobile authentication, OpenID, <abbr lang="en" title="Pretty Good Privacy">PGP</abbr>, Biometric, or one-time-tokens to name  a few.</p>
<p>And yes, Tractis is much more. It allows you to easily navigate and edit contracts, make public or private comments that only your negotiation team can read, lock a contract until you finish your changes, review and compare old versions, invite team members to join you, perform multilateral negotiations and grant permissions at an individual level (administrators, editors, readers, invisible?, signer?). Very soon you&#8217;ll be able to visit Tractis library, a library of contracts and clauses shared by the community so you can choose a template and start negotiating right away.</p>
<p>What I would like you to keep in mind is that most governments around the world grant the same validity to digital signatures than to their handwritten counterparts. This isn’t only happening in all European Union countries, but also in countries such as US, Canada, China, Brazil, Argentina, etc. In other words, <strong>a Tractis contract is valid and enforceable in all those countries</strong>.</p>
<p>Think about it. Contracts are everywhere. Software licenses, rental agreements, warranties, broadband Internet, financial services, used-goods auctions&#8230; you name it. Once you have an online contract that you can enforce, a world of possibilities opens to you, such as worldwide arbitration with legally binding decisions, or micro-insurance &#8211; &#8220;<em>buy on eBay with Tractis microinsurance, pay us 5 dollars and, if the other party rips you off, we&#8217;ll give you your money back</em>&#8221; (and we&#8217;ll recover the debt from the other party by enforcing the contract in his/her jurisdiction). Sounds interesting? It is. Tractis solves a very real problem that has been with us for years.</p>
<h3>Justice is ripe for disruption</h3>
<p>We&#8217;ve got as far as we can with informal means: e-mails, pseudo-anonymity, reputation systems. They are fine. But at Tractis we are focused on the formal communications, the 100 euros/dollars barrier where the parties take very seriously things such as authentication, proof-of-content, receipt, delivery, contract enforcement. Think real estate, cars, industrial machinery, jewellery, collectibles&#8230; high-end categories that amount for 40% eBay&#8217;s <abbr lang="en" title="Gross Merchandise Value">GMV</abbr> last year. <span style="font-weight: bold">We mean real business</span>.</p>
<p>It&#8217;s a big problem. It&#8217;s an enormous task. But it can be done. In the same way that Skype uses an open, independent and decentralised network to bring the telcos to their knees, Tractis uses the internet to compete with traditional courts and insurance companies where they can&#8217;t follow. We are interfacing technologies as much as we are interfacing legislations.</p>
<p>As we speak, we&#8217;re working on finishing Tractis and we hope to launch in the first half of 2007. We want Tractis to provide you with the tools to enable a low-cost, simple and fast international system of justice. Justice for, from and by the Internet nation.</p>
<p>Happy new year. It&#8217;s gonna be great. Help us to <a href="http://del.icio.us/post?url=http://www.tractis.com/account/login&#038;title=Tractis">spread the word</a>!</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.negonation.com/en/the-end-of-legislative-islands/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

