E-ID Public Beta: POC

At the end of March, a public test infrastructure for the federal government's new E-ID went live. The code for its various components is available as open-source software (MIT licence). The public beta now under way, together with the learner's permit pilot in Schaffhausen, is meant to validate the platform's architecture and robustness.

During Tegonal's Open Source Week, Fabian and Alwin took a closer look at the newly available infrastructure and built a small POC to validate a possible use case.

Background

After voters rejected the first E-ID proposal, the federal government drew some important lessons. The current project was built in-house (with help from various external experts, of course) and, as mentioned, is available as OSS. Having private companies run it is off the table. Its key principles are privacy first and decentralised data storage. So far, so good.

How the technical infrastructure is built

The technical design of the E-ID ecosystem looks well thought out and has already reached a stage that would allow a wide range of applications. Neither the components nor the data are (necessarily) held centrally. For example, you can register and run your own verifier instances. We couldn't tell whether this will later be reserved for government bodies.

The Android wallet app currently doesn't use Google APIs for the "Secure Environment" check or the built-in Android Authentication; it implements the security layer itself. That isn't necessarily a bad thing, but it does mean extra work.

The swiyu E-ID app is simple to use, and it tells users clearly which of their data is being shared for the check at hand.

For a project at this stage, the documentation and tooling are very good, and they're clearly being expanded all the time.

Unfortunately, we didn't have time for an in-depth code review.

POC: age check (when shopping)

To get some hands-on experience with the E-ID straight away, we built a proof-of-concept application. It runs an age check on a small Raspberry Pi system with a touchscreen.

The test app can switch modes to check either the age alone or the age together with the stored photo.

Easy to use, and easy to exclude

With the use case behind the POC, we also want to show that introducing an E-ID will raise further questions and create new appetites. Widespread use for simple, everyday cases will shut people out. We need to discuss which uses justify an (implicit) obligation to show ID.

But there are opportunities too. Sanctuary cities that issue city cards could also issue them digitally. The infrastructure now in place would allow it.