Smart Cards in Europe: eID Avalanche

This is the second in a collection of posts titled “Smart Cards in Europe”. In the introductory post we said that Europe is about to receive 1 billion “Smart Cards capable of strong authentication and digital signatures”. An event which has the potential to transform the way we do e-commerce. The origin of this avalanche is two-fold:

1. Smart Cards issued by governments in order to identify their citizens (“Electronic IDentification Cards” or “e-IDs”).
2. Smart Cards issued by banks to replace magnetic strip bank cards (“EMVs”).

This second post focus on the first case. We have analyzed the current status of e-ID implementations in 32 European countries, representing 565 million people (source: Eurostat). Our findings can be summarized as follows:

By 2010, 437 million people (82% of the European population) will live in countries with electronic ID cards (e-IDs).

If you don’t believe us, keep on reading:

Countries in Europe that already have an e-ID scheme

Ten countries, representing 153 million inhabitants (27% of the European population):

1. Spain (44,474,600): Spain started to introduce an e-ID sheme ( DNI electrónico ) in March 2006. As of November 2007 a total of 1,500,000 e-IDs had been issued. From December 2007 e-IDs will be issued throughout Spain. Projections are: 6.5 million e-IDs issued by December 2008 and 18 million by December 2009. Besides the electronic ID, Spain also has 14 commercial certification authorities (lawyers, notaries, registrars, regional governments, banks, etc.). See also physical description, demo and video of the DNIe.
2. Italy (58,751,711): Having completed two experimental phases in 2003 and 2004, Italy is currently deploying its Carta d’identità elettronica (CIE). By October 2005 2 million CIEs had been issued. The aim is to replace 40 million conventional ID cards by 2011 at a rate of 8 million per year. Apart from the CIE, Italy has 19 commercial certification authorities.
3. Portugal (10,569,600): Following the initial introduction of e-ID cards in February 2007, Portugal is preparing to start a full-scale rollout in 2008 and expects to issue 2 million Cartão de Cidadão per year. By July 2008 the new e-ID should be available throughout the country. Portugal also has 1 commercial certification authority.
4. Belgium (10,511,400): Belgium started deployment of its eID in September 2004. To date, 6,500,000 eIDs have been issued. Plans are to reach 8,000,000 by December 2009. Belgium has 2 commercial certification authorities. The Belgian government also issues e-IDs to minors and non-nationals.
5. Sweden (9,047,800): Sweden began to introduce its nationellt identitetskort in October 2005. So far, some 3,000,000 e-IDs have been issued (almost all in software format). Sweden is a special case in that e-IDs are not issued by the government but by authorized companies (banks, system integrators, etc.).
6. Austria (8,265,900): The rollout started in 2000 and is already complete. There are some 8,000,000 Bürgerkarte (citizen cards) in circulation. An original feature in this case is that there is no “one” type of e-ID: an e-ID can be stored in government-issued cards, bank cards or SIM cards.
7. Finland (5,255,580): The Finnish e-ID, or FINEID , like the Austrian one, can be stored in smart cards, bank cards or SIM cards. It was launched in 1999 but did not include an electronic signature until 2004. The Finnish government announced plans to issue around 135,000 FINEIDs by the end of 2007. Citizens who so wish may include their health insurance information in their FINEID.
8. Estonia (1,344,700): Estonia is probably the most advanced country in Europe in the adoption of electronic signatures by the general population. The Estonian ID-Card was launched in January 2002 and today is used by more than 1,000,000 citizens (almost 90% of the population). The Estonian government is working to create a Mobile-ID, so that the certificate can be stored in mobile devices.
9. Norway (4,770,000): Norway’s main commercial certification authorities are Telenor and the banks. Norwegians can obtain their e-ID from lottery offices, social security offices and banks. The certification authorities responsible for issuing certificates are ZebSign and BankID.
10. Iceland (307,700): The Icelandic government has reached an agreement with the banks under which all debit cards issued after the end of 2007 will incorporate government e-IDs.

Countries in Europe that are planning to launch e-IDs in 2008

Eight countries, representing 184 million inhabitants (32% of the European population):

1. Germany (82,438,000): Germany has declared on various occasions that it intends to deploy its Digital IDCard in 2008, which will include the ability to use pseudonyms online. Germany has 8 commercial certification authorities.
2. France (62,518,600): After various delays (to incorporate feedback from the public), France has stated its intention to put its Identité Nationale Electronique Sécurisée (INES) into effect in 2008. The plan is to include electronic signatures, although the first generation of cards may not have this functionality. France has 11 commercial certification authorities.
3. Netherlands (16,357,992): The Dutch DigiD service offers three levels of security: low (username & password), medium (SMS authentication) and high (on-card PKI). So far, 6 million citizens use low DigiD for authentication, while 2 million use medium DigiD. The high-security DigiD, known as eNIK , may be introduced in 2008. The Netherlands has 4 commercial certification authorities.
4. Hungary (10,076,600): Requirements and specifications for the development of the Hungarian e-ID, HUNEID, and its prototype implementation were published at the end of 2004. Introduction is expected in January 2008.
5. Bulgaria (7,679,200): Following the optimistic government announcement that issuance of e-IDs would start in 2007, the rollout is now expected to start in 2008. The Bulgarian Government owns 1 commercial certification authority, which is authorized to issue digital certificates to citizens.
6. Latvia (2,291,000): Following the passing of e-ID regulations by the Latvian Council of Ministers, the introduction of e-IDs is scheduled for 2008. Latvia has 1 commercial certification authority.
7. Slovenia (2,003,400): The Slovenian e-ID project was officially launched in February 2003 but was then suspended. A fresh start is expected in 2007-2008. Slovenia has 4 commercial certification authorities.
8. Malta (404,346): Malta is taking a four-pronged approach to the deployment of electronic IDs. The third phase started in 2007. All that remains is the fourth stage, which includes the issue of e-ID cards. Everything suggests this could happen in 2008.

Countries that are planning to launch e-ID schemes after 2008

Seven countries, representing 134 million inhabitants (23% of the European population):

1. United Kingdom (60,393,100): The National Identity Scheme is currently under development by the UK Identity and Passport Service (IPS). Its main goal is to introduce e-ID cards in the UK. Procurement of e-ID cards has already started and suppliers will be selected in May 2008. The first e-IDs are expected to be issued to British citizens in 2009 or 2010. The United Kingdom also has 4 commercial certification authorities.
2. Ireland (4,209,000): In June 2004 the Irish government established the framework for Public Service Cards(PSC), which will be used for authentication and electronic identification. Following Portugal’s example, the PSC will include a range of functions (social services, medical card, etc.).
3. Poland (38,518,241): Poland is studying the possibility of introducing an e-ID card, known as a Multifunctional Personal Document (MPD), to replace a variety of identity cards. Poland is aware of the need for an e-ID and is undecided whether to set up a new state-owned CA to issue MPDs or to delegate the role to commercial CAs. Changes in the law are needed. Poland has 4 commercial certification authorities.
4. Romania (21,610,200): Romania has started to work on e-IDs and biometric passports and has already issued an international invitation to tender for these projects. Romania has 5 commercial certification authorities.
5. Slovakia (5,389,100): The Slovakian government has plans to introduce e-IDs (called “BIFO”) and passports. Slovakia has 9 commercial certification authorities. Since March 2007, Slovakian citizens holding a digital certificate have had 1,000 “contact points” where they can sign electronically.
6. Lithuania (3,403,300): No e-IDs have been issued as yet, but the government is treating e-IDs as a priority. The Lithuanian e-ID will be multifunctional (government, health, loyalty programs, tickets, etc.). It is thought that it could be launched in 2009-2010. Lithuania has 1 commercial certification authority. To popularize electronic signatures, the government will issue 300,000 certificates to citizens completely free of charge before 2009.
7. Cyprus (766,414): The government of Cyprus has stated its intention to issue e-IDs but has provided no further information.

Countries that have no plans to launch e-ID schemes but that have commercial certification authorities

Three countries, representing 83 million inhabitants (14% of the European population):

1. Turkey (72,500,000): Turkey has 3 commercial certification authorities.
2. Czech Republic (10,251,790): The Czech Republic has 3 commercial certification authorities.
3. Luxembourg (480,222): Luxembourg has 1 commercial certification authority.

Countries that have no plans to launch e-ID schemes and no commercial certification authorities

Four countries, representing 21 million inhabitants (4% of the European population):

1. Greece (11,125,200): The Greek government has plans to create 5 government-owned certification authorities.
2. Denmark (5,427,400).
3. Croatia (4,442,803).
4. Liechtenstein (34,905).

Conclusion

In Europe, in terms of population:

• 27% of the population of the 32 European countries lives in a country that has an e-ID scheme (at varying stages of implementation).
• 32% lives in a country that is planning to launch e-IDs in 2008.
• 23% lives in a country that is planning to launch e-IDs after 2008.
• 14% lives in a country that has no plans to launch e-IDs but that does have commercial certification authorities.
• 4% lives in a country that has no plans to launch e-IDs and no commercial CAs.

Europe is not alone: Various countries have started issuing national identity cards in the form of e-ID smart cards (China, Qatar, Morocco, Thailand, Hong Kong, Oman, etc.). Some are planning to do so in the near future (Peru, Argentina, Brazil, Mexico, etc.). Others are considering the possibility (U.S.A., Russia, etc.). Although eID is a small segment of the overal smart card market, all the experts agree that it has the strongest growth prospects (21% CAGR) and is likely to grow dramatically over the next few years. Of all the emerging new applications of smart cards this is the largest market because the number of ID cards in circulation (worldwide, 1 in 2 people has an ID card, i.e. 3 trillion IDs) is much greater than the number of passports (1 in 10 people), transport cards (1 in 3), or driving licenses. According to the “Deutsche Bank Smart Cards report 2007″, e-ID smart cards in the “Other: Government ID, Passport, Health, Transport” category had 7% penetration worldwide in 2006. Projections are that an average of 400 million e-ID smart cards will be issued each year, reaching 17% penetration in 2010. If these projections are met:

In 2015, 84% of people with an ID will have an e-ID.

Something is changing, don’t you think?

Next post: Smart Cards in Europe: EMV Avalanche.

By David Blanco
Saved in: e-Signatures, Identity, Internet | 5 comments » | 29 March 2008