eidas Regulation (EU) 910/2014 and the Connecting Europe Facility Boosting trust & security in the Digital Single Market

Transcription

1 eidas Regulation (EU) 910/2014 and the Connecting Europe Facility Boosting trust & security in the Digital Single Market Food Chain in the Digital Single Market 9 November 2016, Brussels Elena Alampi DG CONNECT, European Commission elena.alampi@ec.europa.eu

2 eidas Key legal aspects Art 114 TFEU on internal market as the legal basis Free movement of products and services One Regulation for eid and trust services directly applicable in the 28 MS 28 implementing acts and 1 delegated act to further specify the technical aspects of the Regulation: eid: 4 implementing acts ets: 24 implementing acts and 1 delegated act 2

3 What is eidas about? eid Validation Preservation Electronic signatures Electronic documents eidas Electronic seals Website authentication Electronic delivered registered services Electronic time stamps 3

4 The eidas Regulation provides for eid & TS: 4

5 eidas Trust services 5

6 eidas Electronic signature and seals Nondiscrimination as evidence in legal proceedings (art ) Legal effect (art ) Qualified esignature: only for natural persons Assimilation to handwritten signature Qualified eseal: only for legal persons Presumption of integrity of the data and correctness of the origin Recognition in all MS of a qualified electronic signature /seal based on a qualified certificate issued in one MS (art ) 6

7 eidas Electronic documents Nondiscrimination of electronic documents visàvis paper documents as evidence in legal proceedings (art.46) Ensures validity and legal certainty of crossborder electronic transactions through the impossibility for Courts to reject a document on the grounds that it is in electronic form 7

8 eidas: Key principles for eid The Regulation does not impose the use of eid Sovereignty of MS to use or introduce means for eid Cooperation between Member States Mandatory crossborder recognition only to access public services eid Interoperability framework Full autonomy for private sector Principle of reciprocity relying on defined levels of assurance 8

9 Countries with nationally supported eid schemes Nearly all Member States (will) have a nationally supported eid scheme in place Preliminary data from the ongoing CEF eid Stakeholder Analysis Report by Deloitte Countries with eid schemes: AT, BE, DE, DK, EE, ES, FI, HR, HU, IT, IS, LT, LU, LV, MT, NL, NO, PT, RO, SE, SK, TR, UK Countries settingup national eid schemes: BG, CY, CZ, EL, FR, SI Countries to be confirmed: IE, PL Information provided by MSs (as of 1 January 2016): eid cards in 15 MSs (6 planned), other eid means in 24 MSs 25 MSs having either an eid card or other eid means 9

10 Timeline Entry into force of the eidas Regulation eid DSI v.1 eidas compliant eid 29/09/2015 Voluntary crossborder recognition 29/09/2018 Mandatory crossborder recognition Trust services esignature Directive rules Date of application of eidas rules for trust services 10

11 The eidas Legal Framework Legal Act Reference Adoption date Entry into force eidas Regulation 910/ ( application provisions on TS) ID on procedural arrangements for MS cooperation on eid (art. 12.7) 2015/ eid IR on interoperability framework (art. 12.8) Corrigendum C(2015) 8550 of IR assurance levels for electronic identification means (art. 8.3) 2015/ / Trust services ID on circumstances, formats and procedures of notification (art. 9.5) IR on EU Trust Mark for Qualified Trust Services (art.23.3) ID on technical specifications and formats relating to trusted lists (art. 22.5) ID on formats of advanced electronic signatures and seals (art & 37.5) ID on standards for the security assessment of qualified signature and seal creation devices (art & 39.2) 2015/ (notified to Ms) 2015/ / / /

12 Where does eidas have an impact? UMM&DS Uniform User Management and Digital Signatures ehgi ehealth Governance Initiative ECI European Citizens' Initiative ESSN European Social Security Number SUP Directive on singlemember private limited liability companies PSD2 Revised Directive on Payment Services AML4 4th AntiMoney Laundering Directive 12

13 EU egovernment Action Plan Accelerating the digital transformation of government (COM(2016) 179 final) Underlying principles: Digital Once Inclusiveness Openness Crossborder Interoperability Trustworthiness by only and and by by and Default principle accessibility transparency default default Security References to eidas: Policy priority 1 ("Modernise public administration with ICT, using key digital enablers") actions: "Further efforts by all administrations are needed to accelerate the take up of electronic identification and trust services for electronic transactions in the internal market [...] actions to accelerate crossborder and crosssector use of eid (including mobile ID) in digitally enabled sectors (such as banking, finance, ecommerce and sharing economy) and in the public sector namely on the European ejustice Portal. The Commission will also explore the need to facilitate the usage of remote identification and secure authentication in the retail financial services" "The Commission will gradually introduce the 'digital by default' principle when interacting online with external stakeholders, using eidas services (in 2018), einvoicing (in 2018) and eprocurement (in 2019)." 13

14 WHAT IS CEF 14

15 WHAT IS A BUILDING BLOCK THE CORE OF THE CEF BUILDING BLOCKS ARE INTEROPERABILITY AGREEMENTS that have demonstrated to facilitate crossborder/ crosssector technical interoperability in the delivery of digital services, in particular egovernment digital services. A BUILDING BLOCK IS A PACKAGE COMPOSED OF INTEROPERABILITY AGREEMENTS, SERVICES AND SOMETIMES SAMPLE SOFTWARE that accelerate and facilitate the adoption of common technical specifications with minimal (or no) adaptations. These interoperability agreements are typically based on existing formalised technical specifications and standards. 15

16 Digital Service Infrastructures Europeana Safer Internet ejustice ODR ehealth eprocurement EESSI Open Data Portal BRIS Sector Specific DSIs more can be added in the future edelivery eid esignature Building Blocks DSIs einvoicing etranslation Cybersecurity more can be added in the future 16

17 CEF Work Programmes: DSIs' funds are planned every year

18 CEF edelivery 18

19 Networking Layer Messaging and Transport Layer SUBMIT Applications Layer Inner Security 4Corner Model 4 Corner Model Required component Optional component Party A ORIGINAL SENDER CORNER C1 Endtoend Security CORNER C4 Party B FINAL RECIPIENT SUBMIT Backend NOTIFY 1 or several Inner Security Backend 1 or several NOTIFY DELIVER Connector NOTIFY AS4 NOTIFY Connector SENDER CORNER C2 Crossparty Security CORNER C3 RECEIVER Access Point SEND RECEIVE Access Point DELIVER Internet

20 Uptake of edelivery ) CEF Projects Crossborder implementations ODR DG JUST FLUX DG MARE ehealth DG SANTE CISE DG MARE eprocurement DG GROW EUCEG DG SANTE EESSI DG EMPL LRI DG JUST EU ejustice portal DG JUST EUGO DG GROW BRIS (ECP) DG JUST ECRIS DG JUST Cybersecurity DG CONNECT PNR DG HOME etranslation DGT Tachonet DG MOVE Commission Managed Services Member States led projects eprior etrustex DIGIT DIGIT esens Preaward pilot ecodex LSP LSP OpenPeppol LSP Other EU institutions esens LSP CISH The European Council Commitment to analyse Commitment to reuse Reusing Update since Q2 16

21 CEF eidbuilding on existing solutions 14 EU Member States and Associated Countries; 29 consortium partners; 6 pilots STORK participating countries 58 consortium partners 4 new pilots applications: STORK Sustainability ECASSTORK integration New Use Cases, New pilots, New domains esens STORK 1.0 ISA Actions 1.4, 1.5

22 Interoperability infrastructure under CEF STORK I & II esens CEF/DSIs Opinion of the Cooperation Network (art 14 (d) of CID 2015/296): eid DSI v.1 eidas compliant H2020 Mutual recognition

23 eidas & CEF eid timeline eidas Regulation established a legal framework and trust model for the mutual recognition of notified nationally supported eids across borders By Sep 2018 public administrations who offer services that require online authentication must accept notified eids from other Member States CEF eid: CEF provides software and support services; financially supports the deployment in MS (min. 10 MS are deploying it)

24 Typical scenario: Accessing a service using your national eid Citizen eidas Node eidas Node Service Provider Service Provider Identity Provider(s) Attributes Provider(s) Identity Provider(s) Attributes Provider(s) BELGIUM Giving access to foreigners to Romanian services Giving access to Romanians to Foreign services when abroad POLAND

25 CEF esignature Opensource software library: Digital Signature Services (DSS) Trusted List management software: Trusted List Manager (TL Manager)

26 Trusted List Manager Management of: List of Trusted Lists National Trusted Lists Centralised list of pointers to national Trusted Lists (List of Trusted Lists) Supervised Q QCSP CA s AKI CA s AKI CA s AKI QCSP xyz CA s AKI CA s AKI CA s AKI CSP CSP CSP CSP CSP CSP CSP CSP CSP CSP xyz CSP xyz CSP xyz CSP CSP xyz CSP CSP xyz CSP CSP xyz CSP CSP xyz CSP CSP xyz CSP CSP xyz CSP CSP xyz CSP CSP xyz CSP CSP CSP xyz CSP CSP CSP CSP xyz xyz xyz CSP CSP xyz xyz CSP xyz CSP xyz CSP xyz National Trusted Lists

27 Digital Signature Services (DSS) Opensource software library Creation, extension and validation of esignatures/eseals, checking them against trusted lists for qualified status Features eidasaligned. Opensource software under LGPL 2.1. Written in Java (version 1.7 and above). Supports validation of countersignatures and multiple signatures. Flexible library that can be: Reused in different topologies: In an applet, as a standalone application, serverbased, or any combination. Used in its entirety or on a modulebymodule basis. Adapted to numerous usages via configuration files or extension points. Support standards on esig/eseals. Transparent use of signature creation devices (e.g. Smartcards, Hardware Security Modules, software).

28 For further information and feedback Web page on eidas eidas Observatory Text of eidas Regulation in all languages Connecting Europe Facility Catalogue of Building Blocks eidas functional mailbox & twitter 28