ADAPID D7: E-Government I

This report presents the work done within ADAPID in the area of e-government applications. We have chosen electronic petitions as our case-study for the implementation of a proof-of-concept demonstrator for its properties as an interactive and participatory e-democracy application.

In order to comply with the specific privacy and security requirements of electronic petitions, we have had to overcome the limited functionalities of the Belgian e-ID cards by using more advanced identity management technologies. Our e-petition design and implementation uses the Belgian e-ID for initial authentication, and then allows the user to obtain an anonymous credential that can be used to electronically sign petitions on a server.

By using anonymous credentials, our demonstrator reconciles two seemingly contradictory requirements: it allows anonymous petition signing, while it imposes restrictions on who is entitled to sign and ensures that each citizen can only sign a particular petition once. Multiple signing of a petition with the same anonymous credential is detectable by our protocols, such that repeated signatures can be eliminated.

This report presents a description of the proof-of-concept demonstrator design and implementation, and gives an introduction to the anonymous credential cryptographic protocols that the demonstrator builds on in order to provide the required functionalities. Additionally, we discuss unique and context-specific identifiers and point out their differences.

From a legal point of view, very little regulation specifically tailored to the activities of epetition servers exists. The lack of specific rules does not mean e-petition servers operate in a legal void, as a number of regulations of a general nature are applicable. There are several unresolved questions regarding the application of these legal regulations, though this is due more to the lack of jurisprudence on these matters, than to inherent flaws of the legal framework. The e-petition server achieves a notable advance in protecting user privacy by shielding off any and all identifiable information about the users through the use of anonymous credentials and communications channels. Even when the broadest interpretation of the term is adopted, the e-petition server does not process personal data of its users.