IT Experts: Lack of Security Awareness Despite High Expertise?
The New Year is a time to embrace change – which is exactly what the German federal states and administrations hope for the new Smart eID. Available in Germany since December 2021, it enables citizens to save their national identity cards directly to a smartphone. In addition to a smartphone, all that’s required is a PIN and the “AusweisApp2” app. They are designed to optimise two particular aspects of identity management: low awareness of the online identification function to date and user-friendliness. With this in mind, the new eID function offers numerous application areas that make everyday life for citizens more digital, more independent and more in step with the times. Nevis sheds light on the subject and provides an overview of the most important areas of application for the Smart eID with regard to identity management.
Want to use a smartphone as an electronic ID? In Germany, this has been possible since the Smart eID Act was introduced last June following its approval by the Federal Council. The Act has been in force since September. It laid the foundation for the evolution of the existing online identification function of the national identity card and now incorporates the user’s smartphone to a greater extent.
The Smart eID – modern and flexible
The combination of smartphone, app and PIN – in future, that’s all you will need to verify your digital identity when shopping online or opening a bank account in the virtual domain. And you can do all this without having to visit the passport office. This is made possible by the Smart eID, which refers to electronic identification by smartphone. It is designed as an easy way to check a user’s digital identity in the context of identity management on the internet, which is why it complements the national identity card. However, the standard plastic national identity card is still needed for citizens travelling abroad or passing police checkpoints because the digital version is not sufficient.
In focus: protecting identity data
The starting point was the OPTIMOS 2.0 funding project that saw the Federal Office for Information Security (BSI) collaborate with Telekom Security and Samsung. They developed the hardware-based security architecture for the Smart eID and focused on the protection of identity data. It was ultimately possible to do this and meet the security requirements of the BSI by combining smartphones with the security chips now being installed in a growing number of smartphones. The first devices from the Samsung Galaxy S series have been supported since December. However, these devices will be joined by additional devices from other manufacturers in the first half of 2022.
How does the new system of digital identification using mobile phones actually work?
The authentication process begins with a secret 6-digit number for the online identity card and the national identity card with its integrated chip. All national identity cards already contain this chip, although ID cards with automatically activated chips have only been issued since 2017. Those who still have an earlier identity card with a deactivated chip or who have forgotten the PIN issued along with the national identity card can request this free of charge from the relevant citizen’s office. The data required is sent by post within a few days. Then, all that’s required is to install the “AusweisApp2” app on the smartphone and read in the national identity card once to transfer and store the data from the chip. To do this, the user simply presses the national identity card against the smartphone for a few seconds. From then on, the user can identify themselves online at any time without constantly having to have their national identity card to hand and holding it up to the smartphone again. What’s more, this also dispenses with the process of reading in with the help of an NFC card reader of the type used in the previous online identification function. This not only improves user convenience but also flexibility.
So much for the benefits – what are the use cases?
The Federal Ministry of the Interior alone lists 166 application areas of the federal agency, the federal states and administrative districts as well as private companies where the Smart eID can be used.
One thing is immediately clear at first glance: the administrative districts with 75 services offer the highest number of scenarios, followed by private companies with 48 services. Looking at the country as a whole also reveals some significant differences. For instance, the state of North-Rhine Westphalia tops the list of federal states with 30 application areas. It is followed in second place by Brandenburg with 13 applications, with Baden-Wuerttemberg and Bavaria coming third with ten application areas each. Bottom of the list are Schleswig-Holstein and Hamburg with one application each. However, these discrepancies are compensated by the 63 applications that can be used nationwide.
A detailed view
The use cases can be roughly divided into their application areas. Of these, the following themes are particularly prominently represented:
- Visits to official offices dominate the ranking of application areas and account for almost 70 per cent of applications. These include the following: issuing birth certificates online, completing and filing tax declarations online, and applying for COVID-19 bridging supports.
- Every fifth application can be attributed to the application area of administrative portals, giving this area the second-highest number of applications. Examples include the ability to access digital administration services or the service and citizens’ portals of individual administrative districts. The Smart eID can now also be used to request police clearance certificates or to access information about the commercial central register.
- For financial matters, the Smart eID offers an alternative to the standard Video-Ident or in-branch identification processes. For instance, applicants opening a securities deposit account with their preferred bank will be able to identify themselves in future using POSTIDENT and the online identification card, or even open a current account. Access to the online portal for payroll and salary accounting is also possible using the Smart eID in many cases.
- The internet-based vehicle registration system (i-Kfz) covers all aspects of online vehicle registration from registering a new vehicle to decommissioning an end-of-life vehicle. This service is available in almost all regions and replaces the need to visit the vehicle registration office. The Smart eID can also be used to viewpoints awarded for traffic violations by the Federal Motor Transport Authority in Flensburg online.
- The telecommunications category consists mainly of nationwide solutions offered by private companies. These include activating newly purchased prepaid cards, SIM cards or a CallYa digital tariff.
- Other application areas include insurance, emails and signatures. For example, applications for BAföG funding (Federal Education and Training Assistance Act) can now be submitted virtually on the associated website by means of smartphone identification.
Delay in issuing digital PINs
News about the revision of the Smart eID has spread and the revision itself is currently presenting the BSI with logistical challenges. This is due to a strong interest in the Smart eID and the high number of requests to issue PINs online. Although it should theoretically have been possible to request these on the website since December, the service has yet to be launched. The Federal Office for Information Security (BSI) recently announced that while work on the new service was at an advanced stage, further testing of the system’s stability under high capacity utilisation is still required. A definitive date when this data will be issued online without the need to visit a citizen’s office was not mentioned.
