Lack support for the critical Article 5.2 - pseudonymous qualified signatures

  • Stephan Engberg profile
    Stephan Engberg
    25 August 2016 - updated 4 years ago
    Total votes: 0

Isolate transactions with Pseudonymous Id

We need structured identity and interoperability which is what eIDAS is about. However to think identity and security is even benefitting from Identification is vital fallacy as Identification is inbalanced and allways creating interdependance.

/futurium/en/file/rootproblemidentifikationistheproblemjpgroot_problem_identifikation_is_the_problem.jpg

Root Problem - Identification is the problem

 

The critical element of eIDAS regulation is therefore article 5.2 which is about means to balance and separate controls. Any element not supporting this cannot be said to faciliatate or create trust and only one element in the transaction not doing so is enough to violate the entire transaction. This start with the Id being the "trojan horse" that make all data personal data outside the control of the citizen and thus the core source of distrust.

Any transactional use should always be according to eIDAS article 5.2 with Privacy by Design protection against ID service providers able to learn about transactions but with some mechanisms to e.g. a judge can if agreements are breached. Otherwise the structure will inherently create interdependance damaging both security, trust and market processes.

 

/futurium/en/file/positivetrustcirclejpgpositive_trust_circle.jpg

Positive Trust Circle

If user decide to leak identifying data in the transactions will thus not be according to eIDAS structure.

 

This is not about support for social interactions, but essential for trade and eGov to function without reversing value chains or reducing the consumer to analyzed objects instead of the critical innovation and value creator through choice.  (https://ec.europa.eu/futurium/en/content/digital-identification-incompatible-single-market)

It should be noted that this single element is the difference between eIDAS Id structures being pro-Charter or enherently structures incompatible with DSM. GDPR - as a bad and bureaucratic compromise without incorporating core security means - cannot compensate for id structures that enforce transaction thus forcing data control to shift from citizens to some destabilizing infrastructure and third parties.

Point: Sofar I see an alarming lack of security and trust in eIDAS initiatives. Actions are mostly about someone taking ownership of citizens and market processes without considering security. There is an urgent need to create interoperable standards, support and chaning vocabulary of "trust" to encorporate the basic difference between identification and pseudonymous id (only requiring trust towards technology implementation and the judge).