Project of the Month May 2003

The Towards the Digital Town Hall Project:  A Secure Key to the Municipal Services

Today a growing number of municipalities are enabling their citizens to serve themselves via the Internet. Until now, however, a major problem has been the need for a digital signature that is both secure and easy to use. In the municipality of Aalborg Kommune the problem has been solved by a secure electronically enabled communication between citizens and the municipal services – and now some of the Aalborg solutions are transferred to a new nationwide project.

By Naia Bang/Texthuset Aalborg
Go to the Aalborg municipal service shop. Bring along personal identification - a passport or a driver's licence – and your social security card. You will then receive a personal certificate via e-mail. The certificate is a software applet to be installed on your computer. Using a personal key, a password – you can now contact the municipality without the risk of hackers or other unauthorized interfering persons ”looking over your shoulder”. Only the receiving case official will be able to read this. This also applies if the municipality is sending information to you. This way you will be able to retrieve information, which the municipal services would otherwise only be allowed to send to you via ordinary mail. To cut it short, this is the result of the efforts put into the ”Towards the Digital Town Hall” project over two and a half years, a project under the Digital North Denmark run by the municipality of Aalborg and the KMD. - The digital signature we apply has been developed by the KMD, and it is basically identical to the one Helge Sander, Minister of Science, Technology and Development, will introduce in the OCES, Offentlige Certifikater til Elektronisk Service (Public Certificates for Electronic Services) project. Only that ours is more secure because you need to meet in person to acquire your certificate and key, explains Joan Rasmussen who is in charge of the project, and a consultant of the IT-Department at the municipality of Aalborg.

Not Quite User-Friendly
When the ”Towards the Open Digital Guildhall” project was selected to be a DDN project during the winter of 2000, several experiments with digital signatures had been carried out already. - But their success was not unconditional to say the least. In Ringsted they experimented with a chip card and a special box to read the card. Later on the Digital Municipalities worked on another solution. Common to these experiments were the best of intentions – but technical problems, however, were the stumble block. So only a limited number of citizens had experienced working with a digital signature, when we set out, explains Bent Kærgaard, IT manager of the civic and revenue department of Aalborg municipality. Joan Rasmussen continues: - We were coping with initial technical problems, too. First we completed one test. It proved the project absolutely unfit to go public. Another two tests returned this result, too. So we put the process on hold for a period of time, while the KMD strived to develop a more user-friendly system. The problems caused the project, which was due to be concluded by the end of 2002, to apply for an additional 6 months period. So the project is not to be concluded until June 30th 2003.

Monitor Your Tax Case
The criterion for the project to be successful was that 75 percent of the test persons would be able to install the certificate within 30 minutes – unassisted. The breakthrough came during spring and early summer 2002, and June 20th saw the launch of the ”View Your Own Tax Case” subproject. Citizens with a tax case – in practice anybody having correspondence pending with the Aalborg municipal revenues department – could now monitor their case on the Internet. Using the personal certificate they were now enabled to log-on using their key and watch all memos in the case. In ”View Your Own Tax Case” it was concluded that it would be convenient for citizens to copy their legal advisor, accountant – or relatives – on the correspondence and to allow them a say on behalf of the citizen. So the project people developed an electronic authorization. This authorization has a time limit and can be issued by the citizen who is having the case only. Further the person to hold the authorization will need a certificate – available in the service shop as usual. - Our authorization component is quite unique. The OCES project has adopted it and will deploy it to the full, reports Bent Kærgaard, making no attempt to hide the thrill of being a groundbreaker in a field attracting such a massive public focus.

Digital Fingerprints
Many citizens are not feeling safe by submitting personal information via the Internet - and with good reason. This is why we are experiencing so much attention to the development of a digital signature. - The principle of the digital signature is already known from home banking for example. Our project also enables secure e-mails. The digital signature works just like a written signature – or your personal fingerprint: This is the recipient's proof that the sender is the person he or she maintains to be – and that nobody can modify that e-mail on its path from the submitter to the recipient, explains Bent Kærgaard. There is an additional option of encrypting – ie. encoding – the message allowing the key holder only to read it. This means that citizens holding a certificate can submit a removal notice, and they can apply for a covered address.

Security - Also when Falling Ill
The town hall has issued around 170 staff certificates. For example all case officials have been issued a certificate enabling them to communicate with the citizens. These are personal certificates. - This excludes a colleague from just opening and reading personal e-mails from the citizens in case of eg. sick leave. So we have worked to find a solution that will not compromise security. The solution is that a strictly limited number of employees are allowed access to private keys and passwords, and to use it for opening mails. Security procedures have been established to define when and how this is allowed to happen. In such cases the employee's certificate should be disabled, and the colleague on sick leave should be notified and have a new certificate issued, points out Joan Rasmussen.

Deploying the OCES
Today around 200 certificates have been issued – and not only the technically minded have been to the Service shop to collect a certificate. Males and females alike in all age brackets are making use of the offer to monitor their own tax case. If they want to they can also make use of the option to send encrypted messages to other certificate holders. Once the project is concluded, these people will be issued a new certificate. For the Ministry of Science, Technology and Development has decided that the new public certificates, OCES, are to be delivered by the TDC – and not the KMD, who has developed the certificates used by the Aalborg municipality. - Obviously we will be migrating to the OCES certificates while continuously extending the user options. With an OCES certificate the civic public and the industries will not only have the option of direct communication with Aalborg municipality – now they will be able to apply this in their correspondence with tax authorities and other public authorities. This will heavily escalate the number of users. The objective of the TDC is to supply an OCES certificate to two million Danes over the next three years, reports Joan Rasmussen. - And we are one or two years ahead of other municipalities that are now making their initial experience with digital signatures and the use of certificates. We have gained a lot of positive experience – not least on an organisational level, is the unanimous statement of Joan Rasmussen and Bent Kærgaard.

Read more about the project on www.det-digitale-nordjylland.dk

To the top