eid Interoperability for PEGS NATIONAL PROFILE BULGARIA

Transcription

1

2 This reprt / paper was prepared fr the IDABC prgramme by: Authr s name: Gerge Dimitrv (Dimitrv, Petrv & C Law Offices) Crdinated by: Js Dumrtier - Hans Graux, time.lex Cntract N. 1, Framewrk cntract ENTR/05/58-SECURITY, Specific cntract N 3 Disclaimer The views expressed in this dcument are purely thse f the writer and may nt, in any circumstances, be interpreted as stating an fficial psitin f the Eurpean Cmmissin. The Eurpean Cmmissin des nt guarantee the accuracy f the infrmatin included in this study, nr des it accept any respnsibility fr any use theref. Reference herein t any specific prducts, specificatins, prcess, r service by trade name, trademark, manufacturer, r therwise, des nt necessarily cnstitute r imply its endrsement, recmmendatin, r favuring by the Eurpean Cmmissin. All care has been taken by the authr t ensure that s/he has btained, where necessary, permissin t use any parts f manuscripts including illustratins, maps, and graphs, n which intellectual prperty rights already exist frm the titular hlder(s) f such rights r frm her/his r their legal representative. This paper can be dwnladed frm the IDABC website: Eurpean Cmmunities, 2007 Reprductin is authrised, except fr cmmercial purpses, prvided the surce is acknwledged. 2

3 Executive summary The prject aims t prpse a slutin t the legal, technical and rganisatinal issues related t the creatin f an interperable Pan-Eurpean identity management infrastructure. The EU Member States, Candidate Cuntries and EEA Cuntries are intrducing mre sphisticated ways t manage identities in the egvernment area. Different member states are implementing different structures as their identity management slutin. The main challenge fr the prject is t prpse a general architecture that, while taking int accunt the existence f different mdels, is able t cpe with them by btaining the final gal f interperability. The prject shuld cnclude with several different prpsals hw t build interperability withut affecting member states wn existing infrastructures. This dcument describes the current situatin regarding the use f electrnic authenticatin means in Bulgarian egvernment applicatins. 3

4 Table f Cntents EXECUTIVE SUMMARY 3 1 DOCUMENTS APPLICABLE DOCUMENTS REFERENCE DOCUMENTS 5 2 GLOSSARY DEFINITIONS ACRONYMS 8 3 INTRODUCTION GENERAL STATUS AND MOST SIGNIFICANT EIDM SYSTEMS BACKGROUND AND TRADITIONAL IDENTITY RESOURCES EGOVERNMENT STRUCTURE NATIONAL EGOVERNMENT COOPERATION AND COORDINATION TRADITIONAL IDENTITY RESOURCES EIDM FRAMEWORK MAIN EGOVERNMENT POLICIES WITH REGARD TO EIDM LEGAL FRAMEWORK TECHNICAL ASPECTS ORGANISATIONAL ASPECTS INTEROPERABILITY EIDM APPLICATIONS FUTURE TRENDS/EXPECTATIONS ASSESSMENT 18 4

5 1 Dcuments 1.1 Applicable Dcuments [AD1] Framewrk Cntract ENTR/05/58-SECURITY 1.2 Reference Dcuments [RD1] [RD2] [RD3] [RD4] [RD5] [RD6] [RD7] egvernment in the Member States f the Eurpean Unin 5th Editin May Eurpean Electrnic Signatures Study DIRECTIVE 1999/93/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL f 13 December 1999 n a Cmmunity framewrk fr electrnic signatures s_en.pdf Decisin 2003/511/EC f 14 July 2003 n the publicatin f reference numbers f generally recgnised standards fr electrnic signature prducts in accrdance with Directive 1999/93/EC f the Eurpean Parliament and f the Cuncil, OJ L 175, , p.45 DIRECTIVE 2004/18/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL f 31 March 2004 n the crdinatin f prcedures fr the award f public wrks cntracts, public supply cntracts and public service cntracts IDABC Wrk Prgramme Third Revisin DIRECTIVE 2004/17/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL f 31 March 2004 crdinating the prcurement prcedures f entities perating in the water, energy, transprt and pstal services sectrs 5

6 2 Glssary 2.1 Definitins In the curse f this reprt, a number f key ntins are frequently referred t. T avid any ambiguity, the fllwing definitins apply t these ntins and shuld als be used by the crrespndents. Entity: anyne r anything that is characterised thrugh the measurement f its attributes in an eidm system. This includes natural persns, legal persns and assciatins withut legal persnality; it includes bth natinals and nn-natinals f any given cuntry. eidm system: the rganisatinal and technical infrastructure used fr the definitin, designatin and administratin f identity attributes f entities. This Prfile will nly elabrate n eidm systems that are cnsidered a key part f the natinal eidm strategy. Decentralised slutins (state/regin/prvince/cmmune ) can be included in the scpe f this Prfile if they are cnsidered a key part f the natinal eidm strategy. eidm tken (r tken ): any hardware r sftware r cmbinatin theref that cntains credentials, i.e. infrmatin attesting t the integrity f identity attributes. Examples include smart cards/usb sticks/cell phnes cntaining PKI certificates, Authenticatin 1 : the crrbratin f the claimed identity f an entity and a set f its bserved attributes. (i.e. the ntin is used as a synnym f entity authenticatin ). Authrisatin: the prcess f determining, by evaluatin f applicable permissins, whether an authenticated entity is allwed t have access t a particular resurce. Unique identifiers: an attribute r a set f attributes f an entity which uniquely identifies the entity within a certain cntext. Examples may include natinal numbers, certificate numbers, etc. Official registers: data cllectins held and maintained by public authrities, in which the identity attributes f a clearly defined subset f entities is managed, and t which a particular legal f factual trust is attached (i.e. which are generally assumed t be crrect). This includes Natinal Registers, tax registers, cmpany registers, etc. egvernment applicatin: any interactive public service using electrnic means which is ffered entirely r partially by r n the authrity f a public administratin, fr the mutual 1 Fr the purpses f this Prfile, the ntin f authenticatin is cnsidered t be synnymus with entity authenticatin, as ppsed t data authenticatin. The ntin f identificatin shuld be avided t avid cnfusin. 6

7 benefit f the end user (which may include citizens, legal persns and/r ther administratins) and the public administratin. Any frm f electrnic service (including stand-alne sftware, web applicatins, and prprietary interfaces ffered lcally (e.g. at a lcal ffice cunter using an electrnic device)) can be cnsidered an egvernment applicatin, prvided that a certain degree f interactivity is included. Interactivity requires that a transactin between the parties must be invlved; ne-way cmmunicatin by a public administratin (such as the publicatin f standardised frms n a website) des nt suffice. esignature: data in electrnic frm which are attached t r lgically assciated with ther electrnic data and which serve as a methd f authenticatin with regard t this data. Nte that this als includes nn-pki slutins. Advanced electrnic signature: an electrnic signature which meets the fllwing requirements: (a) it is uniquely linked t the signatry; (b) it is capable f identifying the signatry; (c) it is created using means that the signatry can maintain under his sle cntrl; and (d) it is linked t the data t which it relates in such a manner that any subsequent change f the data is detectable; Again, this definitin may cver nn-pki slutins. Qualified electrnic signature: advanced electrnic signatures which are based n a qualified certificate and which are created by a secure-signature-creatin device, as defined in the esignatures Directive 2. Validatin: the crrbratin f whether an esignature was valid at the time f signing. 2 See 7

8 2.2 Acrnyms A2A... Administratin t Administratin A2B... Administratin t Businesses A2C... Administratin t Citizens CA... Certificatin Authrity CRL... Certificate Revcatin Lists CSP... Certificate Service Prvider eid... Electrnic Identity eidm... Electrnic Identity Management IAM... Identity and Authenticatin Management IDM... Identity Management OCSP... Online Certificate Status Prtcl OTP... One-Time Passwrd PKCS... Public-Key Cryptgraphy Standards PKI... Public Key Infrastructure SA... Supervisin Authrity SOAP... Simple Object Access Prtcl SCVP... Server-based Certificate Validatin Prtcl SSCD... Secure Signature Creatin Device USB... Universal Serial Bus TTP... Trusted Third Party XAdES... XML Advanced Electrnic Signature XML... extensible Markup Language XML-DSIG... XML Digital Signature 8

9 3 Intrductin 3.1 General status and mst significant eidm systems The mst significant IDM system, cntaining a key set f data fr all natural persns in Bulgaria, is the Unified System fr Civil Registratin and Administrative Service f the Ppulatin (USCRASP - The data kept in USCRASP is mandatry fr all ther administrative infrmatin systems. The unique identifier fr all Bulgarian citizens and fr all freign citizens permanent residing in Bulgaria is the Unified Citizen Number (UCN). A similar kind f unique identifier fr all nn-natinals cntinually residing in the cuntry is the Persnal Number f the Freigner (PNF). Bulgaria des nt issue any electrnic ID cards r ther eidm tkens fr natural persns. The nly eidm tken cncerning the natural persns which is planned t be issued after 31 st f Octber 2007 is a passprt with an electrnic cmpnent cntaining sme basic identificatin data. Due t the refrm at the present mment the mst significant eidm system fr legal and ther entities in Bulgaria is the BULSTAT Register. This register cntains the key identificatin data fr every cmpany, nn-prfit rganisatin, public institutin, ther kind f legal entity, branch f freign cmpany, self-emplyee etc. in Bulgaria. Befre the end f 2007 anther majr eidm system the Cmmercial Register will becme peratinal. The new Cmmercial Register will be the first entirely electrnic IDM system in the cuntry. At the mment all entities registered in the BULSTAT Register have а unique identifier the BULSTAT number. These numbers are als issued t all natural persns registered in the BULSTAT Register, but their BULSTAT numbers are identical t their UCN. When the Cmmercial Register becmes peratinal the BULSTAT number f every cmpany will be transfrmed in a Unique Identificatin Cde (UIC). An ID paper BULSTAT card is issued fr every entity registered in the BULSTAT Register. On demand, the traditinal paper BULSTAT card culd be replaced by an eid card cntaining a micrprcessr chip with the identificatin data entered in the BULSTAT Register. Hwever, at this stage the electrnic BULSTAT cards are ptinal. After the adptin f the new Electrnic Gvernance Act 3 (EGA) the abve mentined unique identifiers will serve fr electrnic identificatin f the entities with regard t their access t electrnic administrative services. On the basis f the relevant unique identifier the administrative bdies will be bliged t btain all ther identificatin data directly fr the relevant IDM system USCRASP, the BULSTAT Register r the Cmmercial Register. 3 The draft Electrnic Gvernance Act was submitted t the Bulgarian Natinal Assembly n 31 st f July 2007, 9

10 3.2 Backgrund and traditinal identity resurces egvernment structure Тhe use f eidm systems in the cntext f egvernment can nt be cnsidered well crdinated r based n cmmn plicies. At the present mment the Bulgarian egvernment is at a stage f develpment whereby the available electrnic services are develped mre as separate elements than as being a part f an rganised structure. The egvernment prjects are usually implemented separately within the administrative bdies and under the cntrl and the crdinatin f these bdies. The general rules and requirements with regard t the hrizntal integratin between the administrative bdies, the persns charged with public functins and the rganisatins prviding public services will be laid dwn in the new EGA. Accrding t a draft f the EGA the abve persns will be bliged t cllect all the necessary identificatin data fr the users f their electrnic services ex ffici frm the initial data administratr (i.e. the IDM system/ther fficial register etc.). Thus all entities will be identified n the basis f their unique identifier, and the administrative bdies, the persns charged with public functins and the rganizatins prviding public services will btain the identificatin data directly frm the relevant IDM system (USCRASP, Cmmercial Register and Register BULSTAT). As far as the main structure f the Bulgarian administratin is based n tw layers f subjectin, the develpment f the Bulgarian egvernment ught t be seen als in tw directins: Central (natinal) egvernment Under the crdinatin f the central (natinal) bdies; Under the crdinatin f the reginal (territrial) bdies; Lcal egvernment Under the crdinatin f the bdies f the lcal self-gvernance. Since August 2005 the Minister f the State Administratin and Administrative Refrm is cmpetent fr the develpment, rganisatin, crdinatin and supervisin f the implementatin f the state plicy in the field f the egvernment. Anther state authrity in charge f the develpment f sme aspects f the egvernment in Bulgaria is the Chairpersn f the State Agency fr Infrmatin Technlgies and Cmmunicatins. The lcal egvernment initiatives are mainly crdinated by the lcal authrities Natinal egvernment cperatin and crdinatin After the establishment f the new Ministry f the State Administratin and the Administrative Refrm (August 2005) several prjects fr the develpment f the general egvernment framewrk fr 10

11 imprving the crdinatin in relatin t the integratin f new egvernment applicatins and fr ensuring the interperability f the egvernment applicatins, have cmmenced. The gvernment has manifested a plitical will fr cmbining the effrts f bth institutins - Ministry f the State Administratin and the Administrative Refrm and State Agency fr Infrmatin Technlgies and Cmmunicatins. The mst significant step fr imprving the egvernment crdinatin will be the adptin f the new EGA. On the base f the new EGA prvisins the Ministry and the State Agency will adpt jintly several secndary legislative acts. Generally, bth main peratinal IDM systems (USCRASP and Register BULSTAT) in Bulgaria are accessible fr the administrative bdies. Hwever the data exchange between these systems and the infrmatin systems f the administrative bdies can nt be cnsidered as based n unified plicies. At the present mment mst f the egvernment applicatins use the UCN fr the identificatin f their users. Unfrtunately almst all f the peratinal egvernment applicatins btain the UCN directly frm the certificate fr the electrnic signature f the user. This practice impses atypical functins n the certificates f the electrnic signatures and their cntent. Thus the functins f the main IDM systems with regard t the identificatins f the entities are displaced by the secndary surces f identificatin data the certificates fr electrnic signatures Traditinal identity resurces The main traditinal identity resurces in Bulgaria are USCRASP (fr natural persns), Cmmercial registers at the district curts and Register BULSTAT. The Bulgarian state authrities traditinally relied mstly n the cmbinatin f the USCRASP, created in 1977, and the mandatry paper based identity card, intrduced after 1999 with the adptin f the Bulgarian Identity Dcuments Act. The traditinal paper ID tkens fr the legal entities identificatin are the curt decisin fr registratin and the BULSTAT ID card. USCRASP is a natinal database fr administrative identificatin and registratin f the natural persns which is kept up t date based n the natinal Ppulatin Registers and Registers f the Civil Status Certificates. Accrding t Art. 25 f the Civil Registratin Act (CRA) USCRASP includes the fllwing data fr all natural persns registered in it: 1. Name; 2. Pseudnym r ther names f the persn abrad; 3. Gender; 4. Date f birth; 5. UCN/PNF; 6. Citizenship; 7. Place f birth; 8. Birth certificate - number, date and place f cmpilatin; 9. Official residence; 10. Family status; 11. Certificate f Marriage - number, date and place f cmpilatin; 12. Spuse - UCN r date f birth, name, gender, fficial residence, citizenship, and fr the deceased - number, date and place f cmpiling the death certificate; 13. Bill f divrce - number, date and place; 11

12 14. Children - UCN r date f birth, name, gender, fficial residence, citizenship, and fr the deceased - number, date and place f cmpiling the death certificate; 15. Mther - UCN r date f birth, name, gender, fficial residence, citizenship, and fr the deceased - number, date and place f cmpiling the death certificate; 16. Father - UCN r date f birth, name, gender, fficial residence, citizenship, and fr the deceased - number, date and place f cmpiling the death certificate; 17. Brthers/Sisters - UCN r date f birth, name, name f the ther parent - if they are nt with the same mther r father, gender, fficial residence, citizenship, and fr the deceased - number, date and place f cmpiling the death certificate; 18. Issued identity dcument - type, number, date f issuance; 19. Legal restrictins (type); 20. Changes f all the items frm 1 t 20 inclusive, previus fficial residence, peculiarities, date f cmpiling the Persnal Registratin File, name and signature f the fficial; 21. Deceased date and place f the death; 22. Death certificate - number, date and place f cmpiling. Each municipality keeps the infrmatin fr the ppulatin n its territry up t date and maintains the Ppulatin Registers and Registers f the Civil Status Certificates. All Ppulatin Registers and Registers f the Civil Status Certificates are incrprated in the centralised data base f USCRASP. USCRASP btains weekly ntificatins fr all changes f identificatin data kept in it frm the several institutins which are described in the relevant sectin belw. Persns are first entered int USCRASP depending n their status, but the mst cmmn pssibilities include registratin at birth, naturalisatin r btaining permissin fr cnstant stay in Bulgaria. Persnal Registratin Cartn fr each persn entered in these registers is kept 130 years after the date f its cmpiling. Access t the infrmatin in these registers is restricted. All Bulgarian citizens and freigners wh have permissin t stay fr mre than three mnths in the cuntry have identity cards. Depending n the case, this card wuld be an identity card (Bulgarian citizens), identity card fr cntinually staying freigner, identity card fr permanent residing freigner r card fr refugee" r ther kind f temprary identity dcuments. The identity card cntains a number f data printed n it, specifically: full name 4, UCN/PNF, natinality, date and place f birth, gender, date and place f issuance f the card, date f expiry, title and number f the card, picture f the bearer, fficial residence, height, eyes clur and peculiarities if any. The card is mandatry, and is issued t any child frm the age f 14. The card als cntains a picture f the persn and a scanned cpy f his/her handwritten signature. The validity duratin f the ID card depends n its type. ID cards fr freigners are similar, cntaining largely the same data. Infrmatin regarding legal entities is traditinally kept in Cmmercial Registers, which are maintained at the district curts 5 in the districts where the legal persns are established. Identificatin infrmatin fr the legal entities is als kept in the BULSTAT Register at the Registry Agency. Thus at the present mment there are tw simultaneus registratins fr mst f the legal entities at the Cmmercial Registers and at the BULSTAT Register. After the start f the new Cmmercial Register at the Registry Agency this parallel registratin will remain nly fr nn-prfit entities. 4 Generally mst f Bulgarian citizens have three names. 5 The district curts where the current Cmmercial Registers are kept are

13 After July 2007 the new administrative and centralised electrnic Cmmercial Register shuld becme peratinal. All data kept in the Cmmercial Registers at the district curts will be transferred t the Registry Agency in electrnic frm. The current registers at the district curts cntain all acts which were submitted t the curt by the legal representatives f the entities as well as the curt reslutins fr entering the relevant data. As a result f the refrm in the Cmmercial Register the databases f the BULSTAT Register and f the current Cmmercial Registers will be cnslidated in ne unified electrnic base register. Alng with the abve mentined registratins at the Cmmercial Registers at the district curts and at the BULSTAT Register until the end f 2005, anther registratin the tax registratin was als mandatry. As a result f a majr refrm at the present mment the tax administratin (Natinal Revenue Agency) btains ex ffici all necessary identificatin data fr the entities frm the BULSTAT Register. The data exchange between the BULSTAT Register and the Natinal Revenue Agency culd be cnsidered as a majr success in the field f eidm up t nw. Summarily, the BULSTAT Register cntains infrmatin fr all legal entities established under Bulgarian law r having an establishment in Bulgaria, fr all institutins, as well as fr natural persns wh are independently prfessinally active as entrepreneurs r self-emplyees. Given this diversity f subjects, the registered infrmatin als varies, but it generally includes the BULSTAT number, name, place f establishment, legal frm (in case f legal entities), legal status 6, date f establishment, management bdies, legal representatives, scpe f activity, capital, funders and any ther legally required identificatin data. All entities registered at the BULSTAT Register have identity BULSTAT cards. Thus, the traditinal identity infrastructure can be said t cnsist f centrally kept but lcally maintained paper registers fr natural persns and legal persns, and f an identity cards (persnal ID cards, BULSTAT cards r bth) t all entities registered in them. 3.3 eidm framewrk Main egvernment plicies with regard t eidm Backgrund At the present mment mst f the egvernment applicatins use the UCN fr the identificatin f their users, but almst all f the peratinal egvernment applicatins btain it directly frm the certificate fr the electrnic signature f the user. This practice impses atypical functins n the certificates fr the electrnic signatures and their cntent. Thus the functins f the main IDM systems with regard t the identificatins f the entities are displaced by secndary surces f identificatin data the certificates fr electrnic signatures. Currently the universal electrnic signature is the nly type f electrnic signature that can be used fr egvernment applicatins, where frmal requirements fr dcuments exchange are established by 6 This includes e.g. all acts fr establishment, changes r striking ff f the legal entity. 13

14 law. The certificates fr such signatures are issued by certificatin service prviders registered at the Bulgarian Cmmunicatins Regulatin Cmmissin (at present fur such prviders are registered). These certificates culd be used als fr any ther purpses. In rder t crrespnd t the requirements f the egvernment applicatins that are peratinal at present, the gvernment institutins have pushed the certificatin service prviders t include sme special attributes in the certificates fr universal signatures (like the UCN, fr example). This practice reveals serius prblems with eidm principles in Bulgarian egvernment at the mment. Prir registratin is ften required as a precnditin fr granting access t particular egvernment services. Since the legislatin presently in frce des nt determine any particular rules in respect t the authenticatin prcess within the usage f egvernment services (except fr usage f electrnic signatures), each administrative bdy implements its wn rules and requirements fr prvisin f electrnic services. Tw main appraches culd be distinguished: prir annuncement by the user; Paper annuncement has t be submitted t the relevant state authrity (the authrity which prvides the service) in writing. The annuncement shuld reveal infrmatin abut the user, such as: identificatin data, representative (if the user is a legal entity) and infrmatin abut certificate fr universal electrnic signature which will be used fr the purpses f this particular egvernment service. prir nline registratin/submissin f the annuncement; The infrmatin abut the certificate f the user in this case is usually submitted by filling in different nline registratin frms. The annuncement has t be signed with the signature which will be used fr btaining the egvernment service. Authenticatin plicies In Octber 2006 a draft f new EGA was elabrated. The new legislative act will lay dwn the main rules with regard t eidm in Bulgaria and will unify the existing authenticatin plicies. After the adptin f the new egvernance Act, special regulatins fr the usage f electrnic signatures fr egvernment applicatins will als be adpted. The key principle f EGA with regard t the eidm plicies is related t the requirement that all administrative bdies, persns charged with public functins and rganisatins prviding public services shuld btain autmatically the identificatin infrmatin fr the entities directly frm the s called prir data administratr nly n the base f their unique identifier. Thus there shuld be nly ne authentic surce fr each piece f infrmatin, t be reused by all egvernment applicatins. Hwever until nw there is n fficial authenticatin plicy in Bulgaria that defines a strict hierarchy f the different authenticatin systems in use. 14

15 Unique Identifiers All entities, registered in Register BULSTAT have unique identifier BULSTAT number. Furthermre all natural persns (natinals r nn-natinals) registered in USCRASP have UCN/PNF. Bth types f identificatin numbers are used as a unique identifier and are printed n the relevant persnal ID r BULSTAT card. These numbers can be used fr btaining mre infrmatin related t the entities frm USCRASP and Register BULSTAT but als frm many ther fficial registers and data bases (prperty register, cmmercial register, tax and scial security data bases etc.). The BULSTAT number will be als transfrmed in Unique Identificatin Cde fr all entities entered int the new centralized Cmmercial Register at the Registry Agency. The abve identificatin number will als be the unique identifier fr the purpses f all egvernment applicatins accrding t the draft EGA. It will serve fr electrnic identificatin f the entities with regard t their access t all available electrnic administrative services. On the basis f the relevant unique identifier the administrative bdies will be bliged t btain all ther identificatin data directly frm the relevant eidm system. The EGA will ensure that every entity will be able t indicate its unique identifier when applying fr any available electrnic administrative service except in cases where the identificatin f the applicant is nt necessary. Official registers and tkens The main fficial registers that are used fr eidm purpses at the present mment are USCRASP and BULSTAT Register. The identificatin f the natural persns is based n their paper ID cards as well as n the identificatin data kept in USCRASP. Fr egvernment purpses there is a pssibility t check up UCN/PNF and the identificatin data by electrnic means. The identificatin f the entities entered int BULSTAT Register can als be verified thrugh the traditinal paper BULSTAT cards, as well as thrugh an nline check in the BULSTAT Register. Official surces f identificatin data are als the Cmmercial registers at the district curts but the main tken fr identificatin f the entities entered in them is the paper certificate fr gd standing issued by the relevant curt where the entity is established. The validity f this kind f certificates is up t 6 mnths frm the date f their issuance. eid cards and eidm tkens Until nw there are n plans fr intrducing an eid card fr natural persns in Bulgaria. Hwever, accrding t the last amendment f the Bulgarian Identity Dcuments Act (BIDA) passprts with an integrated electrnic cmpnent will be issued after 31 st f Octber The electrnic cmpnent will cntain the infrmatin which is printed n the passprt, picture, finger prints and place f birth f the passprt wner. The frmats f the electrnic data will be in accrdance with the recmmendatins f the Internatinal Civil Aviatin Organisatin (ICAO), DOC The data in the electrnic cmpnent will be electrnically signed. 15

16 Generally the identity BULSTAT cards fr the entities entered in the BULSTAT Register are paper cards. As an ptin since August 2005 the legal representative f each entity is entitled t demand the issuance f a BULSTAT card with an integrated micrprcessr chip cntaining the data entered in the BULSTAT Register. At this stage, the issuance f BULSTAT cards with micrprcessr chip is ptinal, and these cards are nt ppular as an eidm tken. Fr nw there are n practical advantages t wning such an eidm tken (such as e.g. facilitated access t electrnic administrative services) Legal framewrk The main legal framewrk fr the existing IDM systems and fr the identificatin tkens is laid dwn in: - the Civil Registratin Act (prmulgated n 27 July 1999) regarding the ppulatin registers, USCRASP and the unique identifier f the natural persns, which is the basic legal surce; - the Bulgarian Identificatin Dcuments Act (in frce as f 05 April 1999) regarding the ID cards and the new passprts with integrated electrnic cmpnent; - the Register BULSTAT Act (in frce as f 11 August 2005) regarding the unique identifier f the entities and the new electrnic BULSTAT cards fr the entities entered in this register; - the Cmmercial Register Act which will be in frce as f 1 July 2007 and which will intrduce the electrnic and centralized registratin f all cmmercial entities and will regulate their unique identifiers; As mentined abve, there is n legal framewrk fr eidm in Bulgaria. The main legislative act which will regulate the electrnic identificatin principles is EGA. EGA will likely be adpted by the Bulgarian Parliament in a few mnths. Bulgaria has n specific regulatins with regard t the prcess f authenticatin in general. The Bulgarian e-dcuments and e-signatures Act (EDESA) f 6 Octber 2001 transpses the prvisins f the e-signatures Directive, but des nt apply t authenticatin as such. At the present mment there are n mandatry eidm tken. The main existing IDM systems - USCRASP and BULSTAT Register, cmbine electrnic data bases and paper ID tkens with unique identifiers. The state and municipal administratin has electrnic access t USCRASP. The infrmatin kept in USCRASP is available nly fr the persn whm it cncerns r in case where particular and lawful interest is prved but there is n peratinal electrnic infrmatin service with this regard. Fr the general public an ptin fr electrnic verificatin f the crrectness f the UCN is intrduced. The BULSTAT Register data base is accessible fr the all state administratins. A paid electrnic infrmatin service is prvided by the BULSTAT Register with regard t private sectr needs. The main certificatin and privacy plicies are laid dwn in EDESA and in the Persnal Data Prtectin Act. Special requirements regarding electrnic transmissin f persnal data are als stipulated in Regulatin N 1 frm 7 February 2007 fr the minimal level f technical and rganizatinal measures and the admissible kinds f prtectin f the persnal data issued by the Bulgarian Persnal Data Prtectin Cmmissin. Legal entities can be represented electrnically by their legal representatives r by ther persns authrised by them. EDESA distinguishes tw persns related t the electrnic signature the titular and the authr. The authr signs the electrnic statement with his electrnic signature n behalf f the titular and culd be nly a natural persn. In cases where the titular is a natural persn wh signs the 16

17 statement by himself, he will be als seen as an authr. If the titular is a legal entity r a natural persn wh will be represented by ther persn, then infrmatin abut the grunds f the representatin pwer f the authr must be entered in the certificate. Anther ptin is the prir ntificatin submitted t the relevant administrative bdy that the legal entity will be represented electrnically by a duly authrised natural persn Technical aspects As described abve there is n legal framewrk regarding the eidm in Bulgaria. Fr this reasn there are n built up eidm infrastructure and peratinal eidm system till nw. With this regard there are n relevant technical aspects and characteristics f the eidm systems that culd be analysed in the present sectin. As far as n unified plicies and technical standards are adpted until the present mment the infrmatin belw can nt be cnsidered applicable in all cases. Hwever fr the access t USCRASP a universal electrnic signature 7 is needed. The nline database f the BULSTAT Register is available after prir registratin using a username and passwrd. The egvernment applicatin usually cnnects directly t the crrespnding CA validatin service in rder t verify the signature. The registered certificatin service prviders are bliged t maintain an electrnic register f the certificates issued by them using LDAP access. Often the administratin keeps a lcal cpy f the CRL, which is updated every three hurs. The name f the titular and the signatry, as well as their UNC/BULSTAT can be verified nline by direct check in at the databases f the natinal authrities in charge f keeping these data Organisatinal aspects As nted abve, identificatin f the citizen is primarily based n his UCN. Similarly, identificatin f the cmpanies and rganisatins is based n their UICs (BULSTAT numbers). Each municipality keeps the infrmatin fr the ppulatin n its territry up t date and maintains the Ppulatin Registers and Registers f the Civil Status Certificates up t date. All Ppulatin Registers and Registers f the Civil Status Certificates are incrprated in the centralized data base f USCRASP which is kept by the Bulgarian Ministry f Reginal Develpment and Public Wrks. The centralised data base f USCRASP is maintained n the base f all paper and electrnic ntificatins submitted by the municipalities t the Ministry. Weekly ntificatin fr all changes f identificatin data f the persns entered in USCRASP is als submitted by the Ministry f Interir, the Ministry f Justice, the Ministry f Health, the Ministry f Educatin and Science, the Ministry f Labur and Scial Plicy and by the curts. The infrmatin in the BULSTAT Register is entered and maintained by the administratin f the Registry Agency n the base f applicatins submitted by the legal representatives f the legal entities r by the natural persns registered in it. The entities that are bliged t submit applicatins fr their 7 The certificate fr universal electrnic signature is kind f certificate fr qualified electrnic signature but issued by certificate service prvider registered in the Bulgarian Cmmunicatins Regulatin Cmmissin. 17

18 registratin in the BULSTAT Register are explicitly listed in the Register BULSTAT Act. These entities are als bliged t ntify the Registry Agency f each change f their status r f any ther infrmatin entered in the BULSTAT Register. 3.4 Interperability As the Bulgarian eidm systems and plicies are still in prcess f develpment, there is n relevant infrmatin cncerning their crss-brder interperability which culd be described in this sectin. 3.5 eidm Applicatins The main eidm applicatin used by public sectr bdies as well as by private sectr is the nline data base f the BULSTAT Register. The ther existing eidm applicatin is the electrnic data base f USCRASP which is accessible nly fr the state and municipal authrities. Hwever bth applicatins have mstly infrmatinal functins. 3.6 Future trends/expectatins As indicated abve, the fcus f the Bulgarian apprach is n the use f unique identifiers. The majr future step in the develpment f eidm in Bulgaria will be the adptin f EGA. EGA will utline all main future trends with regard t the eidm systems. 3.7 Assessment The greatest advantage f the traditinal Bulgarian IDM system is the existence f unique identifiers fr bth natural persns and legal entities. These unique identifiers are used successfully fr identificatin by bth public and private sectrs until nw. In this regard it is apprpriate that the existing traditinal unique identifiers be used als fr the purpses f eidm in Bulgaria. Hwever the current stage f develpment f eidm in Bulgaria is inadequate cmpared t the existing eidm systems in ther EU cuntries. Insfar as wrng practices are presently applied by the different state authrities in relatin t the identificatin f the entities fr the purpses f the egvernment applicatins, the refrm in IDM plicies will cst significant effrts. As a negative aspect f the Bulgarian s eidm apprach culd be cnsidered the lack f any plans fr implementatin f eid cards. 18