Finland's argument for a smartcard future

In December 1999 Finland became the first country to offer its citizens a digital ID card for secure transactions, both online and in the real world. The solution uses PKI encryption technology and paves the way for a new generation of electronic services.

Since this introduction, secure electronic transactions have become central to Finnish society and are now building blocks as vital as railroads and highways were in the last century.

Finland has the highest rate of net usage per capita in the world and public services via the medium have been developed at a brisk pace that is set to increase further. With the ID card scheme citizens can take care of official business and duties at home or work without having to worry about office hours, weekends or the physical location of government bureaux.

The electronic ID card (the FINEID card) issued by the Finnish Population Register Centre (FPRC) - besides its traditional use as a photographic record and travel document within Europe - contains government-branded digital certificates allowing users to perform secure online transactions, create trustworthy digital signatures and send secure emails.

Designed as a national infrastructure providing services to millions of Finns, the solution works to a set of common, open standards. This was pivotal in allowing third party organisations to integrate their own online services.

Secure use requires reliable infrastructure

When dealing with sensitive business, we need to know with certainty who it is we are communicating with. This means documents transferred via the internet may have to be encrypted, and sometimes a digital signature is required.

The FINEID card is a plastic smartcard complete with microchip, and compatible service outlets are being made available to people at public libraries and municipal service centres, as well as at particular info kiosks.

Moreover, services can be accessed directly from computers at home or at work via the internet. Also, mobile phones and digital TVs are being lined up as end user terminals.

This all means authentication is vital.

The FPRC is a state agency and serves as the certification authority for digital identities. In an administrative role, the FPRC is responsible for providing the government with certificate services and creating and maintaining the infrastructure required for the system.

The FPRC has outsourced all of the elements of the infrastructure. ICL Invia acts as the main technology integrator, and iD2 Technologies as the supplier of the PKI technology. Finnish telco Sonera won the helpdesk contract for revocation services and NovaCall runs the end user helpdesk. Elisa Communications manages the database of public keys and the archive of certificates. The Smartcards are from Setec.

Benefits of the system

By using the electronic identification infrastructure, private individuals can make use of a wide range of services provided both by the public and private sectors. These services can be used around the clock without the restrictions imposed by office hours. The idea is that users of electronic services save both time and money.

What's more, the new online infrastructure brings time and cost savings to the government and corporations as well as citizens. For example, users can notify the government online of any changes to their address, while automatically updating the Finnish Post Office's records in the same transaction.

Also, private companies can more easily communicate and trade with their customers. OKO Bank, for example, has become one of the first organisations to use the ID smartcards and PKI system to enable citizens to manage their finances over the internet, using the FINEID card.

Both the government and corporations using the new online infrastructure anticipate lower operating costs due to the reduced pressure on more costly face-to-face channels such as branches.

Besides making services easily accessible, perhaps the key to the take up of the ID smartcard is that the system is based on open, mostly de facto standards such as PKI, ISO 7816, X.500, LDAP, and RSA.

And now other countries are looking at Finland's experience to see what can be learned.

* Vesa Vatka is speaking in the Information Security Solutions Europe Conference & Exhibition, 27 to 29 September, Barcelona, Spain. For further information visit the website http://www.eema.org/isse or contact isse@eema.org

He is the development manager of the Finnish Population Register Centre (FPRC).

All FINEID-specifications, implementation profiles of the standards mentioned above, can be found from http://www.vaestorekisterikeskus.fi .