IP: Fwd: FINLAND MULLS PUTTING NATIONAL IDs ON CELL PHONES (fromNewsScan Daily) (fwd)

[Sampo Syreeni]

On Fri, 10 Aug 2001, Eugene Leitl wrote:

>>FINLAND MULLS PUTTING NATIONAL IDs ON CELL PHONES
>>The Finnish government is considering using SIMs -- the subscriber
>>information modules inside every cell phone -- to take the place of its
>>national identity card, and eventually even a passport.

Essentially they are thinking about putting FINEID into SIMs alongside the
GSM subscriber application. FINEID is PKI implemented by the Finnish
government, or more accurately, Väestörekisterikeskus (Population Register
Center). See http://www.fineid.fi/. It is currently used in the smartcard
version of our national ID card which is used to enable dsigging
transactions with governmental and municipal authorities. If I'm not
entirely mistaken, Finnish law has already been amended to make dsigs
binding in the eyes of the law, so basically you can use the card for any
transaction. The infrastructure is not widely deployed, yet, and few people
have FINEID enabled ID cards.

About Eugene's fears, one already needs a national ID card here, since it is
needed to "prove" your identity whenever you have dealings with governmental
authorities, or try to withdraw money from a bank, or whathaveyou. (In fact
this is one of the fun countries where the police has the authority to
detain you until such time they can verify your identity, for no reason
whatsoever.) Since everybody has one such document already, and the vast
majority also has a cell phone, the extension to FINEID on SIM ought to be
relatively painless. I suspect there will be little outrage over the matter,
here.

>>Under the plan, the
>>computer chip embedded in every SIM would store personal information,
>>transforming the SIM into a person's legal proof of identity.

That personal information is very limited in the current incarnations of
FINEID. The application is basically a government certified binding between
a running identifier (called SATU) assigned by person, and the person's
first and last names. It is pretty strange that even as we do have a unique
ID ("henkilötunnus") in use for the populus, that is not included on-card.
SATU does constitute another such number, if it's ever assigned to a
significant majority of Finnish people, but there seems to be no way for an
ordinary reader of an ID card to tie SATU to the national ID. VRK of course
has the means, since they assign both numbers, and the info likely leaks...

Now, it is quite probable that they'll include a digitized photograph and
maybe fingerprints if FINEID is ever used to sub for a passport. That is
something even I'm pretty concerned about. The same goes doublefold for any
attempt to make the FINEID app invokable remotely, when the SIM is attached
to a phone.

>>Currently FINEID uses a smart card and a card reader attached to a PC,
>>but the plan is to migrate to an SIM, says Vesa Vatka of the Finnish
>>Population Register Center in Helsinki. (New Scientist)

Which, of course, are basically the same thing. I believe the application
already exists. It'll likely be put out in a year or two, likely without a
significant counter-reaction over here.

The interesting part for most people on this list is that if the application
ever gathers support on the phone manufacturer side, it might well be that
the app has some potential to spread abroad as a result. I'm mainly speaking
about Nokia, with its Finnish roots and dominance of the GSM market, but
also whichever companies thrive in the 3G mobile arena -- the latter will
work unchanged in Europe, Japan and the US. If models are produced which
support PKI-on-phone, they might well be easy to deploy throughout the
world.

Sampo Syreeni, aka decoy, mailto:decoy at iki.fi, gsm: +358-50-5756111
student/math+cs/helsinki university, http://www.iki.fi/~decoy/front