Impact

@firma is the first major centralised service aimed at providing free horizontal electronic services to all the public administrations of the country. This is really an exceptional case in Spain,where already 300 eGovernment services are actively using the validation system(62 public authorities from the central administration, 12 regional governments and 27 local governments). The Ministry of Presidency of Spain acknowledges this project as one of the essential pieces for the uptake of eID and electronic signatures in Spain, and from which all eGov services are already experiencing the benefits, with no cost for them. Having in mind on one hand that by 2010 50% of the Spanish Public Procurement must be made by electronic means (eProcurement) with digital certificates, and that on the other hand that there is an eGov service removing the legal obligation for citizens to present paper photocopies for administrative transactions already providing 200 000 transactions through @firma, and furthermore, that 16 million citizens will be already in possession of the eID card, the number of transactions of @firma in 2010 could increase even further from the current figure of 1.2 million transactions per month,helping to achieve an earlier than expected ROI.

Track record of sharing

In order to create a European interoperable eID Management by 2010 allowing the mutual recognition of other countrys eID and eSignatures, @firma is a good case to extend to the rest of Europe as a proxy or centralised national eID verification service. Other countries could also create a common and centralised eID and eSignatures service for their own eGovernment applications existing within their borders in a rational and cost effective way. Also, the existence of a national eID Service in each country would help to create a European eID Management scheme where each nation would offer and exchange eID and eSignature verification services of their nationals living abroad through the interconnection of the various national front-end services, helping to create and deploy pan European eGovernment services and also the free movement of citizens and companies.

In addition to this, @firma is in the process of supporting other MS CA´s such as the Portuguese eID card. In the short and medium term @firma will have to incorporate all the foreign qualified CAs included in the MS TSL as part of the obligation derived of the transposition of the Services Directive, in addition to the CAs to be incorporated in the Stork project for a large scale pilot on eID. This approach would change if there were a central VA in Europe in charge of cross-border validation services or the possibility that other Member States also established a national VA to which make requests and referral cross-border validations.

Lessons learnt

We believe that @firma experience in Spain can be translated to the European Level.

In order to create a European interoperable eID and signature framework enabling the mutual recognition of other countrys eID and eSignatures, @firma is a good case to extend to the rest of Europe by either:

• Launching a PanEuropean proxy or centralised eID/ signature verification service of all qualified certificates available in Europe operated by a supranational organization and at disposal of MS eGOV services or,
• creating a federation of @firmas following the Spanish federated model where each MS operates an instance of @firma and therefore provides the validation services of the qualified certificates included in its own national domain to other MS. This solution would be a kind of cluster of interconnected national VAs that provide cross-border validation Services from a MS to another.

Lesson 1 - @firma has already being pointed out by the EU Commission in the context of the IDABC Preliminary study on Mutual Recognition of eSignatures for eGovernment Applications across Europe, as a very good example of efficient validation for eSignature: "The limited number of supported CSPs is a major barrier to interoperability. If every application would have to support all European established CSPs, the situation will quickly become unmanageable. A very good example of efficient validation has been set-up in Spain.The way how Spain has solved the validation problematic would certainly be a good practice to take into account at the European level".

Lesson 2 - This centralised building up approach to create a common service providing eID and eSignature features to eGovernment applications has been proved to be a rational and cost effective approach and a key enabler for the eID in Spain. It has unburden eGovernment applications of the hard tasks of developing SW modules to deal with the creation/ verification of the eSignature, the handling of crypto libraries, CRL and OCSP protocols for the verification of digital certificates or the need of physical network connection to all Certification Service Providers of the country.