Digital Identity: Some Lessons from the Netherlands
In the Netherlands, more national digital identity systems have been launched over the past years. This is of great benefit to organizations concerned with tackling the challenges of securely managing a growing number of digital users’ identities and accounts and unlocking the full potential of digital identity.
In this article, we describe the challenges that organizations are faced with in order to unlock the full potential of using digital identities and the importance of introducing national or supranational Identity and Access Management initiatives that meet appropriate security standards and allow users to use the same digital identity across multiple platforms, organizations, and even geographical borders.
Common digital identity solutions not only make life easier for the organization’s IT managers, but also enable online users to decide for themselves how much personal information they want to share with an organization, how they share it, and when – which will ultimately improve the users’ willingness to engage with the organization.
DigiD and eHerkenning
Currently, there are two national digital identity systems in the Netherlands: DigiD and eHerkenning. DigiD is the public digital identity that citizens are using to interact with the government. eHerkenning is a similar solution for organizations that can be used for both public and private services.
DigiD is well known by the citizens in the Netherlands. In 2015, the identity system had more than 12 million users, which is equal to around 87% of the Dutch citizens over 16 years old.
However, being in the field of Identity Management, I also see some challenges to the DigiD solution:
-
There are no private organizations involved in offering this digital identity and it can only be used for public services.
-
There are a number of security issues with the current implementation.
-
The level of assurance of the authentication is STORK level 2 [1] and that is not secure enough when the new EU regulation on electronic identification and trust services (eIDAS) for electronic transactions in the European internal market becomes active.
eHerkenning is offered through a public-private network of organizations, called participants, that are offering authentication services based on a number of common standards to secure availability, functionality, and security. The participants still have the opportunity to deliver their own authentication services as well.
Obvious challenges to the eHerkenning solution are:
-
It can only be used by organizations and not by consumers and citizens.
- T
he number of organizations using eHerkenning is limited — for instance, the Dutch Chamber of Commerce and Dutch tax services are not using it.
Idensys – A New Digital Master Key
Already with the current solutions, the Netherlands is one of the front-runners in developing national digital identity systems, but due to the challenges of DigiD and eHerkenning, I am very excited that there is a new identity solution currently being tested in the Netherlands – Idensys – that is a common private-public platform for both citizens and organizations.
The goals of Idensys are:
To give citizens and consumers the possibility to use a high level of assurance authentication (besides STORK level 2 that DigiD offers, also STORK level 3 and 4)
-
To lower the amount of digital identities that citizens and consumers have, to increase information security, and to lower administrative costs
Other benefits from the public-private cooperation in Idensys will be:
-
Freedom of choice: People can choose which authenticator they want to use (of course only of the participants).
-
Diversity: Idensys will make sure there will be authenticators for every individual, also for handicapped, elderly, children, etc.
-
Continuity: The network has multiple participants, so if one participant is not available, the whole infrastructure keeps functioning.
-
Innovation: Because Idensys is a public-private collaboration, the participants are challenged to keep innovating both their own services and platform as a whole.
-
Affordable: Due to competition between the participants, optimization of services (and as a result, price) is necessary to keep being competitive in this network.
-
Security: The government governs this platform and participants that are not complying with the regulations can and will be excluded from the platform. Single-party platforms would not be able to have this possibility.
Safewhere Identify Offers Full Support for DigiD and eHerkenning
At Safewhere, we value and encourage the development of national or other common digital identity systems as they benefit both our customers in making their Identity and Access Management simpler and more secure and our customers’ end users in gaining more control over their digital identity and personal information.
Therefore, our Safewhere Identify platform offers full out-of-the-box support for both DigiD and eHerkenning and other national digital identity systems such as NemID in Denmark and BankID in Sweden.
As Identify is based on open standards, we can – and will continuously – add support for other relevant national identity systems.
[1] STORK Level of Assurance:
- Level of Assurance (LOA) 1: Little or no confidence in the asserted identity’s validity
- Level of Assurance (LOA) 2: Some confidence in the asserted identity’s validity
- Level of Assurance (LOA) 3: High confidence in the asserted identity’s validity
- Level of Assurance (LOA) 4: Very high confidence in the asserted identity’s validity
